mirror of
https://github.com/block/buzz.git
synced 2026-11-04 00:12:02 +00:00
zizmor flagged the checkout SHA comment as `# v6` when it's actually pinned to v6.0.2. Also pin create-github-app-token to its commit SHA instead of the rolling `@v3` tag.