ci: bump Redline to askalf/ci@9e4fe74

.github/workflows/auto-release.yml

@@ -34,7 +34,7 @@ jobs:
       id-token: write # keyless Sigstore signing (attest-build-provenance)
       attestations: write # persist the attestation in GitHub's store
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
         with:
           fetch-depth: 0
           persist-credentials: false # tag push below supplies the token explicitly

.github/workflows/ci.yml

@@ -45,7 +45,7 @@ jobs:
           - os: windows-latest
             node: 22
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
         with:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
@@ -74,7 +74,7 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
         with:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
@@ -139,7 +139,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
         with:
           persist-credentials: false
       - name: actionlint

.github/workflows/codeql.yml

@@ -36,7 +36,7 @@ jobs:
         # checkouts under pull_request_target, over-broad token permissions.
         language: [javascript-typescript, actions]
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
         with:
           persist-credentials: false
       - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0

.github/workflows/docker.yml

@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
         with:
           persist-credentials: false
 

.github/workflows/fleet-status-backfill.yml

@@ -18,6 +18,6 @@ jobs:
       checks: read
       statuses: write
     steps:
-      - uses: askalf/ci/actions/fleet-status@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+      - uses: askalf/ci/actions/fleet-status@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
         with:
           all-open: 'true'

.github/workflows/fleet-status-self-test.yml

@@ -26,10 +26,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
         with:
           persist-credentials: false
 
-      - uses: askalf/ci/actions/fleet-status-check@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+      - uses: askalf/ci/actions/fleet-status-check@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
         with:
           min-own-exprs: '5'

.github/workflows/fleet-status.yml

@@ -66,7 +66,7 @@ jobs:
       checks: read
       statuses: write
     steps:
-      - uses: askalf/ci/actions/fleet-status@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+      - uses: askalf/ci/actions/fleet-status@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
         with:
           pr: ${{ github.event.pull_request.number || github.event.issue.number || github.event.workflow_run.pull_requests[0].number }}
           head-repo: ${{ github.event.workflow_run.head_repository.full_name }}

.github/workflows/fuzz.yml

@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 40
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
         with:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0

.github/workflows/marketplace-watch.yml

@@ -44,7 +44,7 @@ jobs:
       contents: write # push the snapshot to the watch branch
       issues: write # open/close the per-skill triage issues
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
         with:
           persist-credentials: false # the snapshot push supplies the token explicitly in its URL
 

.github/workflows/npm-drift-watch.yml

@@ -35,7 +35,7 @@ jobs:
       contents: read
       issues: write # open/close the drift issue
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
         with:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0

.github/workflows/public-text.yml

@@ -18,6 +18,6 @@ concurrency:
 
 jobs:
   public-text:
-    uses: askalf/ci/.github/workflows/public-text.yml@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+    uses: askalf/ci/.github/workflows/public-text.yml@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
     with:
-      redline-ref: 6290c052b725054b09d45ecbeb6664194a778c79
+      redline-ref: 9e4fe74e2f24173da83d2e1b7002556a8e1eaa02

.github/workflows/publish.yml

@@ -29,7 +29,7 @@ jobs:
       id-token: write # OIDC trusted publishing (job-scoped)
       contents: read
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
         with:
           persist-credentials: false
 

.github/workflows/redline-fix.yml

@@ -43,9 +43,9 @@ concurrency:
 jobs:
   fix:
     # Pinned so a change to the fix workflow reaches this repo only through a reviewed bump here.
-    uses: askalf/ci/.github/workflows/redline-fix-run.yml@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+    uses: askalf/ci/.github/workflows/redline-fix-run.yml@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
     with:
-      redline-ref: 6290c052b725054b09d45ecbeb6664194a778c79
+      redline-ref: 9e4fe74e2f24173da83d2e1b7002556a8e1eaa02
       # truecopy-fix is this repository's fix-lane runner: its own non-root account, one job
       # per registration. Only this workflow targets that label.
       runner-label: truecopy-fix

.github/workflows/redline.yml

@@ -47,9 +47,9 @@ jobs:
     # checked by the called workflow (open, not a draft, head in this repo) before anything is fetched.
     if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository)
     # Pinned so a change to the review workflow reaches this repo only through a reviewed bump here.
-    uses: askalf/ci/.github/workflows/redline-review.yml@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+    uses: askalf/ci/.github/workflows/redline-review.yml@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
     with:
-      redline-ref: 6290c052b725054b09d45ecbeb6664194a778c79
+      redline-ref: 9e4fe74e2f24173da83d2e1b7002556a8e1eaa02
       runner-label: redline
       pr: ${{ inputs.pr }}
       head: ${{ inputs.head }}

.github/workflows/scorecard.yml

@@ -24,7 +24,7 @@ jobs:
       id-token: write # required by publish_results (OIDC attestation)
     steps:
       - name: Checkout code
-        uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+        uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
         with:
           persist-credentials: false
 

.github/workflows/truecopy-gate.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ${{ (github.repository != 'askalf/truecopy' || github.event.pull_request && (github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')) && 'ubuntu-latest' || fromJSON('["self-hosted","truecopy-exec"]') }}
     timeout-minutes: 10
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@6290c052b725054b09d45ecbeb6664194a778c79 # main 2026-10-24, askalf/ci#129
+      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
         with:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0