From cb61f5411e5e3aaa252e82772ec510cc05d99eae Mon Sep 17 00:00:00 2001
From: Frans van Dorsselaer <17404029+dorssel@users.noreply.github.com>
Date: Sat, 17 Oct 2026 10:47:35 +0200
Subject: [PATCH] Fix SLSA provenance

---
 .github/workflows/slsa.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/slsa.yml b/.github/workflows/slsa.yml
index 4ad21ef..15c1193 100644
--- a/.github/workflows/slsa.yml
+++ b/.github/workflows/slsa.yml
@@ -62,9 +62,9 @@ jobs:
 
   provenance:
     needs: [subjects]
-    # This will fail, because generator_generic_slsa3 demands using version pinning, instead of hash pinning.
-    # Instead, use the workflow from the 'slsa' branch.
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0
+    # This is a fix, because generator_generic_slsa3 demands using version pinning, instead of hash pinning.
+    # Do not merge this into the default branch.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0 # f7dd8c54c2067bafc12ca7a55595d5ee9b75204a
 
     permissions:
       actions: read