mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-18 08:36:13 +00:00
Tobias GesellchenandClaude Opus 4.7
0556492fe4
Replace floating major-tag references (uses: foo/bar@vN) with the specific commit SHAs they currently resolve to, annotated with the fully-versioned tag (# vX.Y.Z) for human readability. Pinning to a SHA makes the action behaviour reproducible across runs and removes the supply-chain risk of a maintainer (or attacker) moving a tag to a new commit. One documented exception: semgrep/semgrep-action does not publish v1.x.y semver tags — v1 is their only canonical release name on that line — so it keeps a "# v1" annotation with an inline explanation. actions/dependency-review-action's previous "@v5" reference would have failed at run time: that repo only ships fully-versioned tags (v5.0.0), no moving v5 alias. Pinned to v5.0.0 explicitly. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>