Chris Lu 0d3aebbcbe ci: pin the actions the signing jobs newly run by commit ...

These run with registry credentials and the OIDC token that signs under
the repository's identity, so a retargeted tag upstream must not be able
to reach them.

Claude-Session: https://claude.ai/code/session_01A5zMqzaUg1Snur4Yg8xJGa

2026-09-03 10:25:02 -07:00

..

action.yml

ci: pin the actions the signing jobs newly run by commit

2026-09-03 10:25:02 -07:00