chore(release): make a release verifiable, and pin what builds it (epic #701, phase 5) (#759)

* chore(release): build once, and publish sha256sums and provenance (epic #701, phase 5) * chore(ci): pin every third-party action by commit sha (epic #701, phase 5) * test(ci): anchor the dependabot guard on the ecosystem it must cover
2026-08-31 14:32:20 -07:00
parent 9816fe2d16
commit 0ba029b015
12 changed files with 480 additions and 90 deletions
@@ -13,4 +13,8 @@ permissions:

 jobs:
  welcome:
+    # Deliberately unpinned: this is our own org's shared workflow, inside the
+    # same trust boundary as this repository, and the point of it is that a
+    # change to the welcome text reaches every VocaHQ repo without 30 bumps.
+    # Everything third-party is pinned by SHA (tests/test_workflow_action_pins.py).
    uses: VocaHQ/.github/.github/workflows/issue-welcome.yml@main