--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Commit 2ce41f38e7cfacb4cb00d7a986f824939e286ad0
Parents : 97730e3
Author : Ivan <ivan@quad4.io>
Signature : Invalid signer <e46112d44649266d71fe2193e00a4710>, author is <ivan@quad4.io>
Date : 2026-07-06T11:07:48-05:00
fix(ci): update SLSA generator references in workflows to use version tags instead of commit SHAs for improved reliability
Changes
2 files changed, 18 insertions(+), 8 deletions(-)
Diff
diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 76004411..86089ab2 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -12,9 +12,14 @@
# actions/cache@v4.2.0 1bd1e32a3bdc45362d1e726936510720a7c30a57
# actions/setup-java@v4.7.1 c5195efecf7bdfc987ee8bae7a71cb8b11521c00
#
-# SLSA generator (pinned to v2.1.0 commit):
+# SLSA generator: must be referenced by tag (@vX.Y.Z), not by commit SHA.
+# slsa-verifier can only confirm the reusable workflow ran from a trusted
+# release ref when called this way; a SHA pin makes the generator's own
+# builder-fetch step fail with "Invalid ref: <sha>. Expected ref of the
+# form refs/tags/vX.Y.Z". See slsa-github-generator README "Referencing
+# SLSA builders and generators".
# slsa-framework/slsa-github-generator/generator_generic_slsa3.yml@v2.1.0
-# f7dd8c54c2067bafc12ca7a55595d5ee9b75204a
+# (tag v2.1.0 = f7dd8c54c2067bafc12ca7a55595d5ee9b75204a)
name: Build release
@@ -464,7 +469,7 @@ jobs:
id-token: write
contents: write
actions: read
- uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a
+ uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
with:
base64-subjects: ${{ needs.collect-linux-slsa-subjects.outputs.hashes }}
upload-assets: false
@@ -482,7 +487,7 @@ jobs:
id-token: write
contents: write
actions: read
- uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a
+ uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
with:
base64-subjects: ${{ needs.collect-desktop-slsa-subjects.outputs.hashes }}
upload-assets: false
@@ -531,7 +536,7 @@ jobs:
id-token: write
contents: write
actions: read
- uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a
+ uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
with:
base64-subjects: ${{ needs.collect-android-flatpak-slsa-subjects.outputs.hashes }}
upload-assets: false
diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
index 5e5a18b4..0dd113b0 100644
--- a/.github/workflows/pypi.yml
+++ b/.github/workflows/pypi.yml
@@ -16,9 +16,14 @@
# actions/upload-artifact@v5.0.0 330a01c490aca151604b8cf639adc76d48f6c5d4
# actions/download-artifact@v5.0.0 634f93cb2916e3fdff6788551b99b062d0335ce0
#
-# SLSA generator (pinned to v2.1.0 commit):
+# SLSA generator: must be referenced by tag (@vX.Y.Z), not by commit SHA.
+# slsa-verifier can only confirm the reusable workflow ran from a trusted
+# release ref when called this way; a SHA pin makes the generator's own
+# builder-fetch step fail with "Invalid ref: <sha>. Expected ref of the
+# form refs/tags/vX.Y.Z". See slsa-github-generator README "Referencing
+# SLSA builders and generators".
# slsa-framework/slsa-github-generator/generator_generic_slsa3.yml@v2.1.0
-# f7dd8c54c2067bafc12ca7a55595d5ee9b75204a
+# (tag v2.1.0 = f7dd8c54c2067bafc12ca7a55595d5ee9b75204a)
#
# Third-party pin (resolve before bumping release/v1):
# curl -sS "https://api.github.com/repos/pypa/gh-action-pypi-publish/commits/release/v1" | jq -r '.sha'
@@ -166,7 +171,7 @@ jobs:
id-token: write
contents: write
actions: read
- uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a
+ uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
with:
base64-subjects: ${{ needs.build.outputs.hashes }}
upload-assets: false
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────