From 0d0924b7fe7b260d2346764b80a81fc017997386 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:32:10 +0000
Subject: [PATCH 01/16] ci: bump Redline to askalf/ci@e6a0901 in redline.yml

---
 .github/workflows/redline.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/redline.yml b/.github/workflows/redline.yml
index 6783002..22cff55 100644
--- a/.github/workflows/redline.yml
+++ b/.github/workflows/redline.yml
@@ -47,9 +47,9 @@ jobs:
     # checked by the called workflow (open, not a draft, head in this repo) before anything is fetched.
     if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository)
     # Pinned so a change to the review workflow reaches this repo only through a reviewed bump here.
-    uses: askalf/ci/.github/workflows/redline-review.yml@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
+    uses: askalf/ci/.github/workflows/redline-review.yml@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
     with:
-      redline-ref: 9e4fe74e2f24173da83d2e1b7002556a8e1eaa02
+      redline-ref: e6a0901235a1d880cf620d23eece2ba63bd042f9
       runner-label: redline
       pr: ${{ inputs.pr }}
       head: ${{ inputs.head }}

From 49cc2b9a5bb64ba6c7398e703db5416d9ffe3889 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:32:13 +0000
Subject: [PATCH 02/16] ci: bump Redline to askalf/ci@e6a0901 in
 redline-fix.yml

---
 .github/workflows/redline-fix.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/redline-fix.yml b/.github/workflows/redline-fix.yml
index 245c279..8c89c50 100644
--- a/.github/workflows/redline-fix.yml
+++ b/.github/workflows/redline-fix.yml
@@ -43,9 +43,9 @@ concurrency:
 jobs:
   fix:
     # Pinned so a change to the fix workflow reaches this repo only through a reviewed bump here.
-    uses: askalf/ci/.github/workflows/redline-fix-run.yml@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
+    uses: askalf/ci/.github/workflows/redline-fix-run.yml@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
     with:
-      redline-ref: 9e4fe74e2f24173da83d2e1b7002556a8e1eaa02
+      redline-ref: e6a0901235a1d880cf620d23eece2ba63bd042f9
       # truecopy-fix is this repository's fix-lane runner: its own non-root account, one job
       # per registration. Only this workflow targets that label.
       runner-label: truecopy-fix

From 8598752917e4be22478ce0b216b8eb7cc98d20ba Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:32:15 +0000
Subject: [PATCH 03/16] ci: bump Redline to askalf/ci@e6a0901 in
 public-text.yml

---
 .github/workflows/public-text.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/public-text.yml b/.github/workflows/public-text.yml
index abba7a4..45aeb6f 100644
--- a/.github/workflows/public-text.yml
+++ b/.github/workflows/public-text.yml
@@ -18,6 +18,6 @@ concurrency:
 
 jobs:
   public-text:
-    uses: askalf/ci/.github/workflows/public-text.yml@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
+    uses: askalf/ci/.github/workflows/public-text.yml@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
     with:
-      redline-ref: 9e4fe74e2f24173da83d2e1b7002556a8e1eaa02
+      redline-ref: e6a0901235a1d880cf620d23eece2ba63bd042f9

From 95996608172bd7e97c62be26238ba76bf7f4521f Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:32:17 +0000
Subject: [PATCH 04/16] ci: bump action pins to askalf/ci@e6a0901 in
 auto-release.yml

---
 .github/workflows/auto-release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
index 6a08b12..b9cb37d 100644
--- a/.github/workflows/auto-release.yml
+++ b/.github/workflows/auto-release.yml
@@ -34,7 +34,7 @@ jobs:
       id-token: write # keyless Sigstore signing (attest-build-provenance)
       attestations: write # persist the attestation in GitHub's store
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
+      - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
         with:
           fetch-depth: 0
           persist-credentials: false # tag push below supplies the token explicitly

From 058aba3ed387ad8708f33c072897ef7981d0f3e3 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:32:20 +0000
Subject: [PATCH 05/16] ci: bump action pins to askalf/ci@e6a0901 in ci.yml

---
 .github/workflows/ci.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3fd3ec9..399385e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,7 +45,7 @@ jobs:
           - os: windows-latest
             node: 22
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
+      - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
         with:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
@@ -74,7 +74,7 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
+      - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
         with:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
@@ -139,7 +139,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
+      - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
         with:
           persist-credentials: false
       - name: actionlint

From d7e73bc2a2633f438dfd76b70eab9090e0a3b593 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:32:22 +0000
Subject: [PATCH 06/16] ci: bump action pins to askalf/ci@e6a0901 in codeql.yml

---
 .github/workflows/codeql.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c6f1395..8fe4492 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -36,7 +36,7 @@ jobs:
         # checkouts under pull_request_target, over-broad token permissions.
         language: [javascript-typescript, actions]
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
+      - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
         with:
           persist-credentials: false
       - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0

From f7c68e4f7a60f27f80e3f8e0ba5abbd957f2802c Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:32:24 +0000
Subject: [PATCH 07/16] ci: bump action pins to askalf/ci@e6a0901 in docker.yml

---
 .github/workflows/docker.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index c703d59..8797495 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
+      - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
         with:
           persist-credentials: false
 

From 1da60f756b2c11d5431d69df60b95f542231eae4 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:32:26 +0000
Subject: [PATCH 08/16] ci: bump action pins to askalf/ci@e6a0901 in
 fleet-status-backfill.yml

---
 .github/workflows/fleet-status-backfill.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/fleet-status-backfill.yml b/.github/workflows/fleet-status-backfill.yml
index a1c59b9..ab876d6 100644
--- a/.github/workflows/fleet-status-backfill.yml
+++ b/.github/workflows/fleet-status-backfill.yml
@@ -18,6 +18,6 @@ jobs:
       checks: read
       statuses: write
     steps:
-      - uses: askalf/ci/actions/fleet-status@587b0e7b20801797e60c069304dbcabb5c079ff6 # main 2026-10-25, askalf/ci#134
+      - uses: askalf/ci/actions/fleet-status@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
         with:
           all-open: 'true'

From 0d6b9d4ab1da471e259eda84ad869480663fc00d Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:32:28 +0000
Subject: [PATCH 09/16] ci: bump action pins to askalf/ci@e6a0901 in
 fleet-status-self-test.yml

---
 .github/workflows/fleet-status-self-test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/fleet-status-self-test.yml b/.github/workflows/fleet-status-self-test.yml
index a17de84..bb79f3e 100644
--- a/.github/workflows/fleet-status-self-test.yml
+++ b/.github/workflows/fleet-status-self-test.yml
@@ -26,10 +26,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
+      - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
         with:
           persist-credentials: false
 
-      - uses: askalf/ci/actions/fleet-status-check@587b0e7b20801797e60c069304dbcabb5c079ff6 # main 2026-10-25, askalf/ci#134
+      - uses: askalf/ci/actions/fleet-status-check@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
         with:
           min-own-exprs: '5'

From d87f04464b8d8657d44968606b4e3c1130908b65 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:32:30 +0000
Subject: [PATCH 10/16] ci: bump action pins to askalf/ci@e6a0901 in
 fleet-status.yml

---
 .github/workflows/fleet-status.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/fleet-status.yml b/.github/workflows/fleet-status.yml
index 6434bec..b872f82 100644
--- a/.github/workflows/fleet-status.yml
+++ b/.github/workflows/fleet-status.yml
@@ -68,7 +68,7 @@ jobs:
       checks: read
       statuses: write
     steps:
-      - uses: askalf/ci/actions/fleet-status@587b0e7b20801797e60c069304dbcabb5c079ff6 # main 2026-10-25, askalf/ci#134
+      - uses: askalf/ci/actions/fleet-status@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
         with:
           pr: ${{ github.event.pull_request.number || github.event.issue.number || github.event.workflow_run.pull_requests[0].number }}
           head-repo: ${{ github.event.workflow_run.head_repository.full_name }}

From 468a007b1ee7819195d39e82271e6566f12d48e7 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:32:32 +0000
Subject: [PATCH 11/16] ci: bump action pins to askalf/ci@e6a0901 in fuzz.yml

---
 .github/workflows/fuzz.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 8a1a3e0..28d37f6 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 40
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
+      - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
         with:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0

From 94850d8f811453e5d67c82071ca7e1efd3b89ef1 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:32:34 +0000
Subject: [PATCH 12/16] ci: bump action pins to askalf/ci@e6a0901 in
 marketplace-watch.yml

---
 .github/workflows/marketplace-watch.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/marketplace-watch.yml b/.github/workflows/marketplace-watch.yml
index 587af2e..90db818 100644
--- a/.github/workflows/marketplace-watch.yml
+++ b/.github/workflows/marketplace-watch.yml
@@ -44,7 +44,7 @@ jobs:
       contents: write # push the snapshot to the watch branch
       issues: write # open/close the per-skill triage issues
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
+      - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
         with:
           persist-credentials: false # the snapshot push supplies the token explicitly in its URL
 

From 0995d88ec19d29e2cc3aaae98fe63585ef87b235 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:32:36 +0000
Subject: [PATCH 13/16] ci: bump action pins to askalf/ci@e6a0901 in
 npm-drift-watch.yml

---
 .github/workflows/npm-drift-watch.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/npm-drift-watch.yml b/.github/workflows/npm-drift-watch.yml
index 66b6ecf..e237c8f 100644
--- a/.github/workflows/npm-drift-watch.yml
+++ b/.github/workflows/npm-drift-watch.yml
@@ -35,7 +35,7 @@ jobs:
       contents: read
       issues: write # open/close the drift issue
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
+      - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
         with:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0

From 10ea23dbcb9d02be2fd487dbddcdb8673f87d1cc Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:32:38 +0000
Subject: [PATCH 14/16] ci: bump action pins to askalf/ci@e6a0901 in
 publish.yml

---
 .github/workflows/publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e993965..cd046c9 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -29,7 +29,7 @@ jobs:
       id-token: write # OIDC trusted publishing (job-scoped)
       contents: read
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
+      - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
         with:
           persist-credentials: false
 

From edc41d6a5dcd13a70e24ca3cebaf992f8a81d1bf Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:32:40 +0000
Subject: [PATCH 15/16] ci: bump action pins to askalf/ci@e6a0901 in
 scorecard.yml

---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 07c4afd..ca88c27 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -24,7 +24,7 @@ jobs:
       id-token: write # required by publish_results (OIDC attestation)
     steps:
       - name: Checkout code
-        uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
+        uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
         with:
           persist-credentials: false
 

From f526443170da7ae2bdd2e5c1d6e9ec4224085db1 Mon Sep 17 00:00:00 2001
From: ALF <263217947+askalf@users.noreply.github.com>
Date: Sun, 25 Oct 2026 09:32:42 +0000
Subject: [PATCH 16/16] ci: bump action pins to askalf/ci@e6a0901 in
 truecopy-gate.yml

---
 .github/workflows/truecopy-gate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/truecopy-gate.yml b/.github/workflows/truecopy-gate.yml
index 2beb584..7d7a968 100644
--- a/.github/workflows/truecopy-gate.yml
+++ b/.github/workflows/truecopy-gate.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ${{ (github.repository != 'askalf/truecopy' || github.event.pull_request && (github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')) && 'ubuntu-latest' || fromJSON('["self-hosted","truecopy-exec"]') }}
     timeout-minutes: 10
     steps:
-      - uses: askalf/ci/actions/checkout-with-retry@9e4fe74e2f24173da83d2e1b7002556a8e1eaa02 # main 2026-10-25, askalf/ci#132
+      - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135
         with:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0