[workflow-audit] 1 unexplained change(s) on 2026-08-20

[github-actions]

1 unexplained commit(s) touching .github/workflows/ or .config/tend.yaml since 2026-08-19T07:49:48Z.

Routine Renovate pin bumps and reproducible tend regenerations are
classified and omitted — see the run summary for what was skipped.
Everything below needs a human to account for it.

e5a614a — ci(release): gate provenance OIDC tokens on a v*-tag-only environment

• Author: Ned Twigg ned.twigg@diffplug.com (self-declared; not proof of origin)
• Date: 2026-08-19 06:29:11 -0700
• Refs: main,remotes/origin/fix-credential-env remotes/origin/fix/enrollment-response-guard,remotes/origin/main
• Files:
  • .github/workflows/release.yml
• View diff