From 3c686130cdf38b541bcaf600af2755bb4f6fd1a8 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 13:15:53 +0000
Subject: [PATCH 01/16] ci: bump Redline to askalf/ci@a0e4d15 in redline.yml

---
 .github/workflows/redline.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/redline.yml b/.github/workflows/redline.yml
index 976bc9d..fca187c 100644
--- a/.github/workflows/redline.yml
+++ b/.github/workflows/redline.yml
@@ -47,9 +47,9 @@ jobs:
     # checked by the called workflow (open, not a draft, head in this repo) before anything is fetched.
     if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository)
     # Pinned so a change to the review workflow reaches this repo only through a reviewed bump here.
-    uses: askalf/ci/.github/workflows/redline-review.yml@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120
+    uses: askalf/ci/.github/workflows/redline-review.yml@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
     with:
-      redline-ref: 25592aa4c8e47dc6b3a29a55c7df6472784c1d9a
+      redline-ref: a0e4d158cef53c461deb53322c4f3826c1e93bad
       runner-label: redline
       pr: ${{ inputs.pr }}
       head: ${{ inputs.head }}

From 2ec0111cbe629131622a42044a1bc47f1a4f3030 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 13:15:55 +0000
Subject: [PATCH 02/16] ci: bump Redline to askalf/ci@a0e4d15 in
 redline-fix.yml

---
 .github/workflows/redline-fix.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/redline-fix.yml b/.github/workflows/redline-fix.yml
index d0b485d..610d2fb 100644
--- a/.github/workflows/redline-fix.yml
+++ b/.github/workflows/redline-fix.yml
@@ -43,9 +43,9 @@ concurrency:
 jobs:
   fix:
     # Pinned so a change to the fix workflow reaches this repo only through a reviewed bump here.
-    uses: askalf/ci/.github/workflows/redline-fix-run.yml@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120
+    uses: askalf/ci/.github/workflows/redline-fix-run.yml@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
     with:
-      redline-ref: 25592aa4c8e47dc6b3a29a55c7df6472784c1d9a
+      redline-ref: a0e4d158cef53c461deb53322c4f3826c1e93bad
       # truecopy-fix is this repository's fix-lane runner: its own non-root account, one job
       # per registration. Only this workflow targets that label.
       runner-label: truecopy-fix

From f959b77e297e8e3acee74a676f3918afe48e53fe Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 13:15:57 +0000
Subject: [PATCH 03/16] ci: bump Redline to askalf/ci@a0e4d15 in
 public-text.yml

---
 .github/workflows/public-text.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/public-text.yml b/.github/workflows/public-text.yml
index d183d17..d2e6c0b 100644
--- a/.github/workflows/public-text.yml
+++ b/.github/workflows/public-text.yml
@@ -18,6 +18,6 @@ concurrency:
 
 jobs:
   public-text:
-    uses: askalf/ci/.github/workflows/public-text.yml@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120
+    uses: askalf/ci/.github/workflows/public-text.yml@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
     with:
-      redline-ref: 25592aa4c8e47dc6b3a29a55c7df6472784c1d9a
+      redline-ref: a0e4d158cef53c461deb53322c4f3826c1e93bad

From 5375e866faca5ab46733bcf5b05e80ab6bc05a41 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 13:16:00 +0000
Subject: [PATCH 04/16] ci: bump action pins to askalf/ci@a0e4d15 in
 auto-release.yml

---
 .github/workflows/auto-release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
index 0ab2dfd..d2d0fc2 100644
--- a/.github/workflows/auto-release.yml
+++ b/.github/workflows/auto-release.yml
@@ -34,7 +34,7 @@ jobs:
       id-token: write # keyless Sigstore signing (attest-build-provenance)
       attestations: write # persist the attestation in GitHub's store
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120
+      - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
         with:
           fetch-depth: 0
           persist-credentials: false # tag push below supplies the token explicitly

From edface5ffc3ee7f58efc1f539599979c46fde0f6 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 13:16:02 +0000
Subject: [PATCH 05/16] ci: bump action pins to askalf/ci@a0e4d15 in ci.yml

---
 .github/workflows/ci.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c99f5c8..f661a6e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,7 +45,7 @@ jobs:
           - os: windows-latest
             node: 22
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120
+      - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
         with:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
@@ -74,7 +74,7 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120
+      - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
         with:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
@@ -139,7 +139,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120
+      - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
         with:
           persist-credentials: false
       - name: actionlint

From 27763528c58d006f1a4c8aff2935de0533a0c9d1 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 13:16:04 +0000
Subject: [PATCH 06/16] ci: bump action pins to askalf/ci@a0e4d15 in codeql.yml

---
 .github/workflows/codeql.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4647d6e..0f93f98 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -36,7 +36,7 @@ jobs:
         # checkouts under pull_request_target, over-broad token permissions.
         language: [javascript-typescript, actions]
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120
+      - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
         with:
           persist-credentials: false
       - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0

From 213ec6deccfee2afbe4550c5172cb476d4836371 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 13:16:06 +0000
Subject: [PATCH 07/16] ci: bump action pins to askalf/ci@a0e4d15 in docker.yml

---
 .github/workflows/docker.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index bac2afd..fdf6d9d 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120
+      - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
         with:
           persist-credentials: false
 

From 681d9c5bad25c22ce3bad862f66b5e149d422faa Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 13:16:09 +0000
Subject: [PATCH 08/16] ci: bump action pins to askalf/ci@a0e4d15 in
 fleet-status-backfill.yml

---
 .github/workflows/fleet-status-backfill.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/fleet-status-backfill.yml b/.github/workflows/fleet-status-backfill.yml
index 2fbf255..f5c3b67 100644
--- a/.github/workflows/fleet-status-backfill.yml
+++ b/.github/workflows/fleet-status-backfill.yml
@@ -18,6 +18,6 @@ jobs:
       checks: read
       statuses: write
     steps:
-      - uses: askalf/ci/actions/fleet-status@919ee2a6b49a4e45d447b9b188c198c37fcd2b72 # main 2026-10-24, askalf/ci#121
+      - uses: askalf/ci/actions/fleet-status@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
         with:
           all-open: 'true'

From 831b31191bfae12ec304a1e01f3db5decc9f7885 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 13:16:11 +0000
Subject: [PATCH 09/16] ci: bump action pins to askalf/ci@a0e4d15 in
 fleet-status-self-test.yml

---
 .github/workflows/fleet-status-self-test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/fleet-status-self-test.yml b/.github/workflows/fleet-status-self-test.yml
index 041b9f6..0d97893 100644
--- a/.github/workflows/fleet-status-self-test.yml
+++ b/.github/workflows/fleet-status-self-test.yml
@@ -26,10 +26,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@919ee2a6b49a4e45d447b9b188c198c37fcd2b72 # main 2026-10-24, askalf/ci#121
+      - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
         with:
           persist-credentials: false
 
-      - uses: askalf/ci/actions/fleet-status-check@919ee2a6b49a4e45d447b9b188c198c37fcd2b72 # main 2026-10-24, askalf/ci#121
+      - uses: askalf/ci/actions/fleet-status-check@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
         with:
           min-own-exprs: '5'

From cbc6abc55b9d200e8e82259481b73b51685525ff Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 13:16:13 +0000
Subject: [PATCH 10/16] ci: bump action pins to askalf/ci@a0e4d15 in
 fleet-status.yml

---
 .github/workflows/fleet-status.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/fleet-status.yml b/.github/workflows/fleet-status.yml
index 09dd64f..e999e02 100644
--- a/.github/workflows/fleet-status.yml
+++ b/.github/workflows/fleet-status.yml
@@ -66,7 +66,7 @@ jobs:
       checks: read
       statuses: write
     steps:
-      - uses: askalf/ci/actions/fleet-status@919ee2a6b49a4e45d447b9b188c198c37fcd2b72 # main 2026-10-24, askalf/ci#121
+      - uses: askalf/ci/actions/fleet-status@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
         with:
           pr: ${{ github.event.pull_request.number || github.event.issue.number || github.event.workflow_run.pull_requests[0].number }}
           head-repo: ${{ github.event.workflow_run.head_repository.full_name }}

From 59fde1bb3b6d979b9020178eff4b3a58e970c952 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 13:16:15 +0000
Subject: [PATCH 11/16] ci: bump action pins to askalf/ci@a0e4d15 in fuzz.yml

---
 .github/workflows/fuzz.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index e3b69d7..7dcda81 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 40
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120
+      - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
         with:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0

From 14cb30dbfa9f4ba148d72f4cb3831fbe0f3d8422 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 13:16:18 +0000
Subject: [PATCH 12/16] ci: bump action pins to askalf/ci@a0e4d15 in
 marketplace-watch.yml

---
 .github/workflows/marketplace-watch.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/marketplace-watch.yml b/.github/workflows/marketplace-watch.yml
index 2735a4d..944e0b2 100644
--- a/.github/workflows/marketplace-watch.yml
+++ b/.github/workflows/marketplace-watch.yml
@@ -44,7 +44,7 @@ jobs:
       contents: write # push the snapshot to the watch branch
       issues: write # open/close the per-skill triage issues
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120
+      - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
         with:
           persist-credentials: false # the snapshot push supplies the token explicitly in its URL
 

From 36046200e07a1ab39f4d6e60510f8091bf1ff6f6 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 13:16:20 +0000
Subject: [PATCH 13/16] ci: bump action pins to askalf/ci@a0e4d15 in
 npm-drift-watch.yml

---
 .github/workflows/npm-drift-watch.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/npm-drift-watch.yml b/.github/workflows/npm-drift-watch.yml
index 14519f8..9f83d61 100644
--- a/.github/workflows/npm-drift-watch.yml
+++ b/.github/workflows/npm-drift-watch.yml
@@ -35,7 +35,7 @@ jobs:
       contents: read
       issues: write # open/close the drift issue
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120
+      - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
         with:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0

From 7f06b710ad3811244057e0a4849bbdf960fafb14 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 13:16:22 +0000
Subject: [PATCH 14/16] ci: bump action pins to askalf/ci@a0e4d15 in
 publish.yml

---
 .github/workflows/publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8bcfce4..eac8727 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -29,7 +29,7 @@ jobs:
       id-token: write # OIDC trusted publishing (job-scoped)
       contents: read
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120
+      - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
         with:
           persist-credentials: false
 

From b49d580f13184c731b9de770ff38029b29dcb690 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 13:16:24 +0000
Subject: [PATCH 15/16] ci: bump action pins to askalf/ci@a0e4d15 in
 scorecard.yml

---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 891f95b..72fa78a 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -24,7 +24,7 @@ jobs:
       id-token: write # required by publish_results (OIDC attestation)
     steps:
       - name: Checkout code
-        uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120
+        uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
         with:
           persist-credentials: false
 

From a7535b3f4c7dacd307663efee207ac61f67e0732 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sat, 24 Oct 2026 13:16:27 +0000
Subject: [PATCH 16/16] ci: bump action pins to askalf/ci@a0e4d15 in
 truecopy-gate.yml

---
 .github/workflows/truecopy-gate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/truecopy-gate.yml b/.github/workflows/truecopy-gate.yml
index e9ad871..f7c729b 100644
--- a/.github/workflows/truecopy-gate.yml
+++ b/.github/workflows/truecopy-gate.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ${{ (github.repository != 'askalf/truecopy' || github.event.pull_request && (github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')) && 'ubuntu-latest' || fromJSON('["self-hosted","truecopy-exec"]') }}
     timeout-minutes: 10
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@25592aa4c8e47dc6b3a29a55c7df6472784c1d9a # main 2026-10-24, askalf/ci#120
+      - uses: askalf/ci/actions/checkout-with-retry@a0e4d158cef53c461deb53322c4f3826c1e93bad # main 2026-10-24, askalf/ci#123
         with:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0