From e08a674b29bd3037e1fda7521a3f8100262aeb15 Mon Sep 17 00:00:00 2001 From: abrichr Date: Thu, 20 Aug 2026 06:57:39 -0400 Subject: [PATCH] ci: correct the stale version comment on the pypi-publish pin The pinned SHA dc37677b2e1c63e2034f94d8a5b11f265b73ba33 is v1.14.2, but the trailing comment still read `# release/v1`. That is the tag the pin replaced, so the comment described the wrong thing and made the pin look unpinned during an org-wide audit. The SHA does not change. This corrects the comment only, so it cannot alter release behaviour. Co-Authored-By: Claude Opus 5 --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f26b2e8..01f4a06 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -46,7 +46,7 @@ jobs: - name: Publish to PyPI if: steps.release.outputs.released == 'true' - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 - name: Publish to GitHub Releases if: steps.release.outputs.released == 'true'