Chris Lu 0d3aebbcbe ci: pin the actions the signing jobs newly run by commit ...

These run with registry credentials and the OIDC token that signs under
the repository's identity, so a retargeted tag upstream must not be able
to reach them.

Claude-Session: https://claude.ai/code/session_01A5zMqzaUg1Snur4Yg8xJGa

2026-09-03 10:25:02 -07:00

..

fix-fusermount-setuid

ci: harden the fusermount3 repair (#10485)

2026-07-29 14:02:33 -07:00

sign-image

ci: pin the actions the signing jobs newly run by commit

2026-09-03 10:25:02 -07:00