fix: pin auths-verify-github-action to full SHA

.auths/allowed_signers

@@ -12,11 +12,12 @@
 #   <DID>@auths.local namespaces="git" ssh-ed25519 <base64-public-key>
 #
 # To add your key:
-#   1. Install Auths:    pip install auths
-#   2. Create identity:  auths init
-#   3. Configure Git:    auths git setup
-#   4. Export signers:   auths git allowed-signers --output .auths/allowed_signers
-#   5. Commit and push this file
+#   1. Install Auths CLI:
+#       Homebrew: brew tap auths-dev/auths-cli && brew install auths
+#       Cargo:    cargo install auths_cli
+#   2. Create identity:   auths init
+#   3. Export signers:    auths signers sync --output .auths/allowed_signers
+#   4. Commit and push this file
 #
 # Documentation: https://github.com/auths-dev/auths/blob/main/docs/guides/platforms/ci-cd.md
 #

.github/workflows/auths-verify-commits.yml

@@ -28,7 +28,7 @@ jobs:
           persist-credentials: false
 
       - name: Verify commits with Auths
-        uses: auths-dev/auths-verify-github-action@v1 # TODO: pin to SHA once stable
+        uses: auths-dev/auths-verify-github-action@57e304ef368d30474e5b6a04106cacde6a8ce492 # v1
         with:
           allowed-signers: .auths/allowed_signers
           fail-on-unsigned: 'false'

cookbook/security/README.md

@@ -26,7 +26,7 @@ The simulation script recreates the attack scenario and demonstrates how Auths
 verification catches the unauthorized commit:
 
 ```bash
-pip install auths
+brew tap auths-dev/auths-cli && brew install auths
 python auths_attack_simulation.py
 ```
 

cookbook/security/auths_attack_simulation.py

@@ -19,7 +19,7 @@ Why Auths prevents this:
   without the maintainer's private key stored in their device keychain.
 
 Usage:
-  pip install auths
+  brew tap auths-dev/auths-cli && brew install auths
   python auths_attack_simulation.py
 """
 import os
@@ -124,7 +124,8 @@ def main() -> None:
         print("The 'auths' CLI is not installed.")
         print()
         print("Install it with:")
-        print("  pip install auths")
+        print("  brew tap auths-dev/auths-cli && brew install auths")
+        print("  (or: cargo install auths_cli)")
         print()
         print("Or visit: https://github.com/auths-dev/auths")
         sys.exit(0)