From fd919c08b392c48c7f434e612892e3b4911b218e Mon Sep 17 00:00:00 2001
From: Ivan Pavlovic <ivan@gr-oss.io>
Date: Wed, 17 Jun 2026 20:01:23 +0200
Subject: [PATCH] security: pin actions/attest-build-provenance@v1 to commit
 SHA

Last remaining unpinned uses: ref after #5 brought everything else
to SHA-pinned node24 versions. Pinned at v1.4.4 (the SHA the v1
floating tag currently resolves to); a separate PR can bump to v4
if desired (composite, no node-runtime concern).
---
 .github/workflows/docker-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 5eb6953..853ea7d 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -60,7 +60,7 @@ jobs:
 
       - name: Generate artifact attestation
         if: github.event_name != 'pull_request'
-        uses: actions/attest-build-provenance@v1
+        uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1.4.4
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.build.outputs.digest }}