mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
J3vbandClaude Opus 5
6e8ae1cde5
Every third-party action in release.yml resolved through a mutable tag or branch inside jobs that hold TAURI_SIGNING_PRIVATE_KEY and SERVER_UPDATE_SIGNING_PRIVATE_KEY, so anyone able to repoint an upstream ref gained code execution beside OwnCord's code-signing keys. All 31 uses refs are now pinned to full commit SHAs with version comments, matching what ci.yml already does. No tests cover this change: nothing in the project exercises .github/workflows, and GitHub Actions cannot run in the local environment. The change was verified by a panel of agents on review alone. Confirmed here: the diff touches 31 uses lines and nothing else, release.yml still parses with all 6 jobs and their step counts intact, all 8 actions shared with ci.yml carry byte-identical pins, and the 3 release-only pins were checked against upstream. The release is now frozen to the pinned versions; Dependabot manages that ecosystem weekly. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>