Merge pull request #240 from KisaragiEffective/fix/zizmor

KisaragiEffective · Dec 21, 2024 · 2e1f214 · 2e1f214
2 parents cb55d44 + e57a5f4
commit 2e1f214
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/.github/workflows/zip-vpm.yml b/.github/workflows/zip-vpm.yml
@@ -22,6 +22,7 @@ jobs:
     - uses: actions/checkout@v4
       with:
         ref: ${{ inputs.tag }}
+        persist-credentials: false
     - name: Add commit hash to the manifest
       run: |
         # moreutils はおそらく追加されない上インストールすると遅いので使わない
@@ -45,7 +46,8 @@ jobs:
       shell: pwsh
     - name: Upload files
       run: |
-        gh release upload ${{ github.event.release.tag_name || inputs.tag }} vpm-src.zip
-        gh release upload ${{ github.event.release.tag_name || inputs.tag }} vpm-src.zip.sha256sum
+        gh release upload "$TAG" vpm-src.zip
+        gh release upload "$TAG" vpm-src.zip.sha256sum
       env:
         GH_TOKEN: ${{ github.token }}
+        TAG: ${{ github.event.release.tag_name || inputs.tag }}