From 90f41db619ef05c0bfe5800096f94b9ad03bb58a Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 31 May 2026 00:21:07 +0100 Subject: [PATCH] fix(ci): replace fake action SHA pins (estate-wide niche sweep) Comprehensive sweep across all niche fake SHAs found in the 2026-05-30 estate audit. Substitutions are version-faithful where the intended version exists; bumped to nearest in-major where the version comment was also hallucinated (e.g. v3.18.3 of action-slack didn't exist). All real SHAs verified via gh api repos///commits/. Provenance: project_estate_fake_action_sha_punch_list_2026_05_30. --- .github/workflows/aur-publish.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/aur-publish.yml b/.github/workflows/aur-publish.yml index 445ab15..78e3bee 100644 --- a/.github/workflows/aur-publish.yml +++ b/.github/workflows/aur-publish.yml @@ -72,7 +72,7 @@ jobs: EOF - name: Publish to AUR - uses: KSXGitHub/github-actions-deploy-aur@a97f67e69b9709c3ffad393ca39b7c4ab1bfe6a5 # v3.0.1 + uses: KSXGitHub/github-actions-deploy-aur@a97f56a8425a7a7f3b8c58607f769c69b089cadb # v3.0.1 if: ${{ secrets.AUR_SSH_PRIVATE_KEY != '' }} with: pkgname: vext @@ -126,7 +126,7 @@ jobs: sed -i "s/^sha256sums_aarch64=.*/sha256sums_aarch64=('$AARCH64_SUM')/" PKGBUILD-bin - name: Publish vext-bin to AUR - uses: KSXGitHub/github-actions-deploy-aur@a97f67e69b9709c3ffad393ca39b7c4ab1bfe6a5 # v3.0.1 + uses: KSXGitHub/github-actions-deploy-aur@a97f56a8425a7a7f3b8c58607f769c69b089cadb # v3.0.1 if: ${{ secrets.AUR_SSH_PRIVATE_KEY != '' }} with: pkgname: vext-bin