[release/v7.4] Github Workflow cleanup (#26334)

pwshBot · TravisEz13 · web-flow · commit 495995f9674e · 2025-10-29T15:18:21.000-07:00
Co-authored-by: Travis Plunk &lt;travis.plunk@microsoft.com&gt;
diff --git a/.github/workflows/AssignPrs.yml b/.github/workflows/AssignPrs.yml
diff --git a/tools/download.sh b/tools/download.sh
@@ -1 +1,3 @@
-bash <(curl -s https://raw.githubusercontent.com/PowerShell/PowerShell/master/tools/install-powershell.sh)
+# Pin to specific commit for security (OpenSSF Scorecard requirement)
+# Pinned commit: 26bb188c8 - "Improve ValidateLength error message consistency and refactor validation tests" (2025-10-12)
+bash <(curl -s https://raw.githubusercontent.com/PowerShell/PowerShell/26bb188c8be0cda6cb548ce1a12840ebf67e1331/tools/install-powershell.sh)
diff --git a/tools/install-powershell.sh b/tools/install-powershell.sh
@@ -26,7 +26,9 @@ install(){
     #gitrepo paths are overrideable to run from your own fork or branch for testing or private distribution
 
     local VERSION="1.2.0"
-    local gitreposubpath="PowerShell/PowerShell/master"
+    # Pin to specific commit for security (OpenSSF Scorecard requirement)
+    # Pinned commit: 26bb188c8 - "Improve ValidateLength error message consistency and refactor validation tests" (2025-10-12)
+    local gitreposubpath="PowerShell/PowerShell/26bb188c8be0cda6cb548ce1a12840ebf67e1331"
     local gitreposcriptroot="https://raw.githubusercontent.com/$gitreposubpath/tools"
     local gitscriptname="install-powershell.psh"
 
@@ -121,7 +123,7 @@ install(){
 			if [[ $osname = *SUSE* ]]; then
 				DistroBasedOn='suse'
 				REV=$(source /etc/os-release; echo $VERSION_ID)
-			fi			
+			fi
             OS=$(lowercase $OS)
             DistroBasedOn=$(lowercase $DistroBasedOn)
         fi
