diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index 6a08b12..b9cb37d 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -34,7 +34,7 @@ jobs: id-token: write # keyless Sigstore signing (attest-build-provenance) attestations: write # persist the attestation in GitHub's store steps: - - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 + - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: fetch-depth: 0 persist-credentials: false # tag push below supplies the token explicitly diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3fd3ec9..399385e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -45,7 +45,7 @@ jobs: - os: windows-latest node: 22 steps: - - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 + - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 @@ -74,7 +74,7 @@ jobs: run: shell: bash steps: - - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 + - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 @@ -139,7 +139,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 + - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: persist-credentials: false - name: actionlint diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c6f1395..8fe4492 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -36,7 +36,7 @@ jobs: # checkouts under pull_request_target, over-broad token permissions. language: [javascript-typescript, actions] steps: - - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 + - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: persist-credentials: false - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index c703d59..8797495 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -37,7 +37,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 + - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: persist-credentials: false diff --git a/.github/workflows/fleet-status-backfill.yml b/.github/workflows/fleet-status-backfill.yml index a1c59b9..ab876d6 100644 --- a/.github/workflows/fleet-status-backfill.yml +++ b/.github/workflows/fleet-status-backfill.yml @@ -18,6 +18,6 @@ jobs: checks: read statuses: write steps: - - uses: askalf/ci/actions/fleet-status@587b0e7b20801797e60c069304dbcabb5c079ff6 # main 2026-10-25, askalf/ci#134 + - uses: askalf/ci/actions/fleet-status@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: all-open: 'true' diff --git a/.github/workflows/fleet-status-self-test.yml b/.github/workflows/fleet-status-self-test.yml index a17de84..bb79f3e 100644 --- a/.github/workflows/fleet-status-self-test.yml +++ b/.github/workflows/fleet-status-self-test.yml @@ -26,10 +26,10 @@ jobs: permissions: contents: read steps: - - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 + - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: persist-credentials: false - - uses: askalf/ci/actions/fleet-status-check@587b0e7b20801797e60c069304dbcabb5c079ff6 # main 2026-10-25, askalf/ci#134 + - uses: askalf/ci/actions/fleet-status-check@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: min-own-exprs: '5' diff --git a/.github/workflows/fleet-status.yml b/.github/workflows/fleet-status.yml index 6434bec..b872f82 100644 --- a/.github/workflows/fleet-status.yml +++ b/.github/workflows/fleet-status.yml @@ -68,7 +68,7 @@ jobs: checks: read statuses: write steps: - - uses: askalf/ci/actions/fleet-status@587b0e7b20801797e60c069304dbcabb5c079ff6 # main 2026-10-25, askalf/ci#134 + - uses: askalf/ci/actions/fleet-status@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: pr: ${{ github.event.pull_request.number || github.event.issue.number || github.event.workflow_run.pull_requests[0].number }} head-repo: ${{ github.event.workflow_run.head_repository.full_name }} diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 8a1a3e0..28d37f6 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -40,7 +40,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 40 steps: - - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 + - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 diff --git a/.github/workflows/marketplace-watch.yml b/.github/workflows/marketplace-watch.yml index 587af2e..90db818 100644 --- a/.github/workflows/marketplace-watch.yml +++ b/.github/workflows/marketplace-watch.yml @@ -44,7 +44,7 @@ jobs: contents: write # push the snapshot to the watch branch issues: write # open/close the per-skill triage issues steps: - - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 + - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: persist-credentials: false # the snapshot push supplies the token explicitly in its URL diff --git a/.github/workflows/npm-drift-watch.yml b/.github/workflows/npm-drift-watch.yml index 66b6ecf..e237c8f 100644 --- a/.github/workflows/npm-drift-watch.yml +++ b/.github/workflows/npm-drift-watch.yml @@ -35,7 +35,7 @@ jobs: contents: read issues: write # open/close the drift issue steps: - - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 + - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 diff --git a/.github/workflows/public-text.yml b/.github/workflows/public-text.yml index abba7a4..45aeb6f 100644 --- a/.github/workflows/public-text.yml +++ b/.github/workflows/public-text.yml @@ -18,6 +18,6 @@ concurrency: jobs: public-text: - uses: askalf/ci/.github/workflows/public-text.yml@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 + uses: askalf/ci/.github/workflows/public-text.yml@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: - redline-ref: 9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 + redline-ref: e6a0901235a1d880cf620d23eece2ba63bd042f9 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index e993965..cd046c9 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -29,7 +29,7 @@ jobs: id-token: write # OIDC trusted publishing (job-scoped) contents: read steps: - - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 + - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: persist-credentials: false diff --git a/.github/workflows/redline-fix.yml b/.github/workflows/redline-fix.yml index 245c279..8c89c50 100644 --- a/.github/workflows/redline-fix.yml +++ b/.github/workflows/redline-fix.yml @@ -43,9 +43,9 @@ concurrency: jobs: fix: # Pinned so a change to the fix workflow reaches this repo only through a reviewed bump here. - uses: askalf/ci/.github/workflows/redline-fix-run.yml@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 + uses: askalf/ci/.github/workflows/redline-fix-run.yml@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: - redline-ref: 9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 + redline-ref: e6a0901235a1d880cf620d23eece2ba63bd042f9 # truecopy-fix is this repository's fix-lane runner: its own non-root account, one job # per registration. Only this workflow targets that label. runner-label: truecopy-fix diff --git a/.github/workflows/redline.yml b/.github/workflows/redline.yml index 6783002..22cff55 100644 --- a/.github/workflows/redline.yml +++ b/.github/workflows/redline.yml @@ -47,9 +47,9 @@ jobs: # checked by the called workflow (open, not a draft, head in this repo) before anything is fetched. if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository) # Pinned so a change to the review workflow reaches this repo only through a reviewed bump here. - uses: askalf/ci/.github/workflows/redline-review.yml@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 + uses: askalf/ci/.github/workflows/redline-review.yml@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: - redline-ref: 9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 + redline-ref: e6a0901235a1d880cf620d23eece2ba63bd042f9 runner-label: redline pr: ${{ inputs.pr }} head: ${{ inputs.head }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 07c4afd..ca88c27 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -24,7 +24,7 @@ jobs: id-token: write # required by publish_results (OIDC attestation) steps: - name: Checkout code - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 + uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: persist-credentials: false diff --git a/.github/workflows/truecopy-gate.yml b/.github/workflows/truecopy-gate.yml index 2beb584..7d7a968 100644 --- a/.github/workflows/truecopy-gate.yml +++ b/.github/workflows/truecopy-gate.yml @@ -23,7 +23,7 @@ jobs: runs-on: ${{ (github.repository != 'askalf/truecopy' || github.event.pull_request && (github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')) && 'ubuntu-latest' || fromJSON('["self-hosted","truecopy-exec"]') }} timeout-minutes: 10 steps: - - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132 + - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0