From f96cf25189ce2f7e57336016a34432c26dae29f4 Mon Sep 17 00:00:00 2001 From: kobihikri Date: Tue, 14 Jul 2026 12:12:20 +0300 Subject: [PATCH] ci: pin winget-releaser to a full commit SHA The winget job hands WINGET_TOKEN to vedantmgoyal9/winget-releaser via the mutable @main branch. Pin to the v2 release commit so the publishing credential is only ever exposed to a fixed, reviewed version of the action. Signed-off-by: kobihikri --- .github/workflows/publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 523ef441..d96419ac 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -16,7 +16,7 @@ jobs: merge-multiple: true - name: Publish to Winget - uses: vedantmgoyal9/winget-releaser@main + uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e # v2 with: identifier: sxyazi.yazi installers-regex: 'yazi-(x86_64|aarch64)-pc-windows-msvc\.zip$'