You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We make a mention of this file in the release documentation.
It would be cool to investigate generating the file somehow and then having a test to ensure it stays correct.
(We had multiple copies in the repo and neither of them were the one used in production.)
Then we regenerate it before a release and use it to update the starter-workflows one upstream.
The text was updated successfully, but these errors were encountered:
I'm not sure it's feasible to generate it before the release. It's a chicken-and-egg problem. The hash needs to be the hash of the commit of the release, but it will change if you commit the hash before release.
I think you need to generate it after the release, and possibly create a PR that we merge in. Note also that the README's workflow example has a hash which we may want to update as well. The README is always read at HEAD by https://github.com/marketplace/actions/ossf-scorecard-action, so it works if we update it after the release.
From @laurentsimon in #301 (comment):
We make a mention of this file in the release documentation.
It would be cool to investigate generating the file somehow and then having a test to ensure it stays correct.
(We had multiple copies in the repo and neither of them were the one used in production.)
Then we regenerate it before a release and use it to update the starter-workflows one upstream.
The text was updated successfully, but these errors were encountered: