From 4672e1d8964942e2c83408cfb824b4a018cb6e4a Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 17:54:01 +0000 Subject: [PATCH] fix(ci): repin Security Scan to the panic-attack workflow that builds the scanner The pinned scan-and-report.yml at be6ac46 builds the caller repository, not the scanner. An external caller therefore has no panic-attack binary and fails at "Run scan" with exit 127 (hyperpolymath/panic-attack#276). 55ffcc9 is panic-attack main. It fetches the scanner source at the commit of the called workflow, builds it outside the workspace and scans the caller with that binary. actions.lock is not changed here. It is tool-owned, and the official refresh candidate comes from the Workflow Security Linter. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6 Signed-off-by: Claude --- .github/workflows/security-scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index db6f3da7..d880996b 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -24,6 +24,6 @@ permissions: jobs: scan: - uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@be6ac46716eaf049570ec4966f4ae4699b319689 # main 2026-10-20: dtolnay/rust-toolchain v1 at 683b588 (the b689a74 pin was a commit no tag names any more) + uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@55ffcc9a240e937edd968487af15ab45c6f0522f # main 2026-11-10: builds the scanner at the workflow commit, not the caller (panic-attack#276) secrets: VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}