build1 distinct publisher
One API call decides whether your SHA pin still means what it says
SHA pinning drew a clean line through the tj-actions compromise, and then Dependabot began bumping hashes faster than anyone could read them. The claim worth enforcing is the version comment that nothing verifies.
Publishers:dev.to
Reality
- Evidence44
- Adoption36
- Hype gap+12
- Incentives55