diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index 0ab2dfd..d2d0fc2 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -34,7 +34,7 @@ jobs: id-token: write # keyless Sigstore signing (attest-build-provenance) attestations: write # persist the attestation in GitHub's store steps: - - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120 + - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: fetch-depth: 0 persist-credentials: false # tag push below supplies the token explicitly diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c99f5c8..f661a6e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -45,7 +45,7 @@ jobs: - os: windows-latest node: 22 steps: - - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120 + - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 @@ -74,7 +74,7 @@ jobs: run: shell: bash steps: - - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120 + - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 @@ -139,7 +139,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120 + - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: persist-credentials: false - name: actionlint diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 4647d6e..0f93f98 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -36,7 +36,7 @@ jobs: # checkouts under pull_request_target, over-broad token permissions. language: [javascript-typescript, actions] steps: - - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120 + - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: persist-credentials: false - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index bac2afd..fdf6d9d 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -37,7 +37,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120 + - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: persist-credentials: false diff --git a/.github/workflows/fleet-status-backfill.yml b/.github/workflows/fleet-status-backfill.yml index 2fbf255..f5c3b67 100644 --- a/.github/workflows/fleet-status-backfill.yml +++ b/.github/workflows/fleet-status-backfill.yml @@ -18,6 +18,6 @@ jobs: checks: read statuses: write steps: - - uses: askalf/ci/actions/fleet-status@919ee2a6b49a4e45d447b9b188c198c37fcd2b72 # main 2026-10-24, askalf/ci#121 + - uses: askalf/ci/actions/fleet-status@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: all-open: 'true' diff --git a/.github/workflows/fleet-status-self-test.yml b/.github/workflows/fleet-status-self-test.yml index 041b9f6..0d97893 100644 --- a/.github/workflows/fleet-status-self-test.yml +++ b/.github/workflows/fleet-status-self-test.yml @@ -26,10 +26,10 @@ jobs: permissions: contents: read steps: - - uses: askalf/ci/actions/checkout-with-retry@919ee2a6b49a4e45d447b9b188c198c37fcd2b72 # main 2026-10-24, askalf/ci#121 + - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: persist-credentials: false - - uses: askalf/ci/actions/fleet-status-check@919ee2a6b49a4e45d447b9b188c198c37fcd2b72 # main 2026-10-24, askalf/ci#121 + - uses: askalf/ci/actions/fleet-status-check@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: min-own-exprs: '5' diff --git a/.github/workflows/fleet-status.yml b/.github/workflows/fleet-status.yml index 09dd64f..e999e02 100644 --- a/.github/workflows/fleet-status.yml +++ b/.github/workflows/fleet-status.yml @@ -66,7 +66,7 @@ jobs: checks: read statuses: write steps: - - uses: askalf/ci/actions/fleet-status@919ee2a6b49a4e45d447b9b188c198c37fcd2b72 # main 2026-10-24, askalf/ci#121 + - uses: askalf/ci/actions/fleet-status@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: pr: ${{ github.event.pull_request.number || github.event.issue.number || github.event.workflow_run.pull_requests[0].number }} head-repo: ${{ github.event.workflow_run.head_repository.full_name }} diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index e3b69d7..7dcda81 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -40,7 +40,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 40 steps: - - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120 + - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 diff --git a/.github/workflows/marketplace-watch.yml b/.github/workflows/marketplace-watch.yml index 2735a4d..944e0b2 100644 --- a/.github/workflows/marketplace-watch.yml +++ b/.github/workflows/marketplace-watch.yml @@ -44,7 +44,7 @@ jobs: contents: write # push the snapshot to the watch branch issues: write # open/close the per-skill triage issues steps: - - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120 + - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: persist-credentials: false # the snapshot push supplies the token explicitly in its URL diff --git a/.github/workflows/npm-drift-watch.yml b/.github/workflows/npm-drift-watch.yml index 14519f8..9f83d61 100644 --- a/.github/workflows/npm-drift-watch.yml +++ b/.github/workflows/npm-drift-watch.yml @@ -35,7 +35,7 @@ jobs: contents: read issues: write # open/close the drift issue steps: - - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120 + - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 diff --git a/.github/workflows/public-text.yml b/.github/workflows/public-text.yml index d183d17..d2e6c0b 100644 --- a/.github/workflows/public-text.yml +++ b/.github/workflows/public-text.yml @@ -18,6 +18,6 @@ concurrency: jobs: public-text: - uses: askalf/ci/.github/workflows/public-text.yml@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120 + uses: askalf/ci/.github/workflows/public-text.yml@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: - redline-ref: 25592aa4c8e47dc6b3a29a55c7df6472784c1d9a + redline-ref: a0e4d158cef53c461deb53322c4f3826c1e93bad diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 8bcfce4..eac8727 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -29,7 +29,7 @@ jobs: id-token: write # OIDC trusted publishing (job-scoped) contents: read steps: - - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120 + - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: persist-credentials: false diff --git a/.github/workflows/redline-fix.yml b/.github/workflows/redline-fix.yml index d0b485d..610d2fb 100644 --- a/.github/workflows/redline-fix.yml +++ b/.github/workflows/redline-fix.yml @@ -43,9 +43,9 @@ concurrency: jobs: fix: # Pinned so a change to the fix workflow reaches this repo only through a reviewed bump here. - uses: askalf/ci/.github/workflows/redline-fix-run.yml@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120 + uses: askalf/ci/.github/workflows/redline-fix-run.yml@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: - redline-ref: 25592aa4c8e47dc6b3a29a55c7df6472784c1d9a + redline-ref: a0e4d158cef53c461deb53322c4f3826c1e93bad # truecopy-fix is this repository's fix-lane runner: its own non-root account, one job # per registration. Only this workflow targets that label. runner-label: truecopy-fix diff --git a/.github/workflows/redline.yml b/.github/workflows/redline.yml index 976bc9d..fca187c 100644 --- a/.github/workflows/redline.yml +++ b/.github/workflows/redline.yml @@ -47,9 +47,9 @@ jobs: # checked by the called workflow (open, not a draft, head in this repo) before anything is fetched. if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository) # Pinned so a change to the review workflow reaches this repo only through a reviewed bump here. - uses: askalf/ci/.github/workflows/redline-review.yml@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120 + uses: askalf/ci/.github/workflows/redline-review.yml@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: - redline-ref: 25592aa4c8e47dc6b3a29a55c7df6472784c1d9a + redline-ref: a0e4d158cef53c461deb53322c4f3826c1e93bad runner-label: redline pr: ${{ inputs.pr }} head: ${{ inputs.head }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 891f95b..72fa78a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -24,7 +24,7 @@ jobs: id-token: write # required by publish_results (OIDC attestation) steps: - name: Checkout code - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120 + uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: persist-credentials: false diff --git a/.github/workflows/truecopy-gate.yml b/.github/workflows/truecopy-gate.yml index e9ad871..f7c729b 100644 --- a/.github/workflows/truecopy-gate.yml +++ b/.github/workflows/truecopy-gate.yml @@ -23,7 +23,7 @@ jobs: runs-on: ${{ (github.repository != 'askalf/truecopy' || github.event.pull_request && (github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')) && 'ubuntu-latest' || fromJSON('["self-hosted","truecopy-exec"]') }} timeout-minutes: 10 steps: - - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120 + - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0