Ping actions/attest-build-provenance

Signed-off-by: Brian Goff <cpuguy83@gmail.com>

Author: cpuguy83

.github/workflows/publish.yml

@@ -99,7 +99,7 @@ jobs:
         env:
           VSIX_PATH: ${{ steps.create_vsix.outputs.vsixPath }}
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8 # v3.1.0
         with:
           subject-path: ${{ steps.create_vsix.outputs.vsixPath }}
       - name: Create release