Zack eede3f9190 fix(github): pin org workflow refs to a sha ...

zizmor's unpinned-uses flags these @main refs. On public repos that is
reported to code scanning and exits 0, so it never blocked anything. On
private repos zizmor runs in annotations mode, exits non-zero and fails
the required check — correctly, since the finding is real.

Pin to a devtools main sha rather than the multi-runner-build-workflow
v3.1.0 tag: that tag predates #1894, so pinning to it would reintroduce
the code scanning failure on private repos.

terraform manages this content for every repo, so bumping the sha here
propagates on apply.

2026-08-04 18:32:46 +01:00

..

deployment

fix(github): pin org workflow refs to a sha

2026-08-04 18:32:46 +01:00

shared

chore: Revert "chore(deps): update terraform cloudflare to v5.21.0" (#1744)

2026-06-26 20:55:20 +02:00