diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index b559181..6a08b12 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -34,7 +34,7 @@ jobs: id-token: write # keyless Sigstore signing (attest-build-provenance) attestations: write # persist the attestation in GitHub's store steps: - - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: fetch-depth: 0 persist-credentials: false # tag push below supplies the token explicitly diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a8eaef7..3fd3ec9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -45,7 +45,7 @@ jobs: - os: windows-latest node: 22 steps: - - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 @@ -74,7 +74,7 @@ jobs: run: shell: bash steps: - - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 @@ -139,7 +139,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: persist-credentials: false - name: actionlint diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1e5c9fe..c6f1395 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -36,7 +36,7 @@ jobs: # checkouts under pull_request_target, over-broad token permissions. language: [javascript-typescript, actions] steps: - - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: persist-credentials: false - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index bc0eb6c..c703d59 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -37,7 +37,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: persist-credentials: false diff --git a/.github/workflows/fleet-status-backfill.yml b/.github/workflows/fleet-status-backfill.yml index 15d3345..32f3577 100644 --- a/.github/workflows/fleet-status-backfill.yml +++ b/.github/workflows/fleet-status-backfill.yml @@ -18,6 +18,6 @@ jobs: checks: read statuses: write steps: - - uses: askalf/ci/actions/fleet-status@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + - uses: askalf/ci/actions/fleet-status@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: all-open: 'true' diff --git a/.github/workflows/fleet-status-self-test.yml b/.github/workflows/fleet-status-self-test.yml index c195070..856a9c8 100644 --- a/.github/workflows/fleet-status-self-test.yml +++ b/.github/workflows/fleet-status-self-test.yml @@ -26,10 +26,10 @@ jobs: permissions: contents: read steps: - - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: persist-credentials: false - - uses: askalf/ci/actions/fleet-status-check@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + - uses: askalf/ci/actions/fleet-status-check@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: min-own-exprs: '5' diff --git a/.github/workflows/fleet-status.yml b/.github/workflows/fleet-status.yml index 5c02154..debb078 100644 --- a/.github/workflows/fleet-status.yml +++ b/.github/workflows/fleet-status.yml @@ -66,7 +66,7 @@ jobs: checks: read statuses: write steps: - - uses: askalf/ci/actions/fleet-status@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + - uses: askalf/ci/actions/fleet-status@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: pr: ${{ github.event.pull_request.number || github.event.issue.number || github.event.workflow_run.pull_requests[0].number }} head-repo: ${{ github.event.workflow_run.head_repository.full_name }} diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 3dac17c..8a1a3e0 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -40,7 +40,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 40 steps: - - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 diff --git a/.github/workflows/marketplace-watch.yml b/.github/workflows/marketplace-watch.yml index c546b5a..587af2e 100644 --- a/.github/workflows/marketplace-watch.yml +++ b/.github/workflows/marketplace-watch.yml @@ -44,7 +44,7 @@ jobs: contents: write # push the snapshot to the watch branch issues: write # open/close the per-skill triage issues steps: - - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: persist-credentials: false # the snapshot push supplies the token explicitly in its URL diff --git a/.github/workflows/npm-drift-watch.yml b/.github/workflows/npm-drift-watch.yml index 02838b2..66b6ecf 100644 --- a/.github/workflows/npm-drift-watch.yml +++ b/.github/workflows/npm-drift-watch.yml @@ -35,7 +35,7 @@ jobs: contents: read issues: write # open/close the drift issue steps: - - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 diff --git a/.github/workflows/public-text.yml b/.github/workflows/public-text.yml index 2d95042..abba7a4 100644 --- a/.github/workflows/public-text.yml +++ b/.github/workflows/public-text.yml @@ -18,6 +18,6 @@ concurrency: jobs: public-text: - uses: askalf/ci/.github/workflows/public-text.yml@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + uses: askalf/ci/.github/workflows/public-text.yml@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: - redline-ref: 6290c052b725054b09d45ecbeb6664194a778c79 + redline-ref: 9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 1424d55..e993965 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -29,7 +29,7 @@ jobs: id-token: write # OIDC trusted publishing (job-scoped) contents: read steps: - - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: persist-credentials: false diff --git a/.github/workflows/redline-fix.yml b/.github/workflows/redline-fix.yml index 35aba94..245c279 100644 --- a/.github/workflows/redline-fix.yml +++ b/.github/workflows/redline-fix.yml @@ -43,9 +43,9 @@ concurrency: jobs: fix: # Pinned so a change to the fix workflow reaches this repo only through a reviewed bump here. - uses: askalf/ci/.github/workflows/redline-fix-run.yml@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + uses: askalf/ci/.github/workflows/redline-fix-run.yml@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: - redline-ref: 6290c052b725054b09d45ecbeb6664194a778c79 + redline-ref: 9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # truecopy-fix is this repository's fix-lane runner: its own non-root account, one job # per registration. Only this workflow targets that label. runner-label: truecopy-fix diff --git a/.github/workflows/redline.yml b/.github/workflows/redline.yml index 68741dc..6783002 100644 --- a/.github/workflows/redline.yml +++ b/.github/workflows/redline.yml @@ -47,9 +47,9 @@ jobs: # checked by the called workflow (open, not a draft, head in this repo) before anything is fetched. if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository) # Pinned so a change to the review workflow reaches this repo only through a reviewed bump here. - uses: askalf/ci/.github/workflows/redline-review.yml@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + uses: askalf/ci/.github/workflows/redline-review.yml@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: - redline-ref: 6290c052b725054b09d45ecbeb6664194a778c79 + redline-ref: 9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 runner-label: redline pr: ${{ inputs.pr }} head: ${{ inputs.head }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index a2e148b..07c4afd 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -24,7 +24,7 @@ jobs: id-token: write # required by publish_results (OIDC attestation) steps: - name: Checkout code - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: persist-credentials: false diff --git a/.github/workflows/truecopy-gate.yml b/.github/workflows/truecopy-gate.yml index 2150bad..2beb584 100644 --- a/.github/workflows/truecopy-gate.yml +++ b/.github/workflows/truecopy-gate.yml @@ -23,7 +23,7 @@ jobs: runs-on: ${{ (github.repository != 'askalf/truecopy' || github.event.pull_request && (github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')) && 'ubuntu-latest' || fromJSON('["self-hosted","truecopy-exec"]') }} timeout-minutes: 10 steps: - - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129 + - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0