diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index b9cb37d..c617094 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -34,7 +34,7 @@ jobs: id-token: write # keyless Sigstore signing (attest-build-provenance) attestations: write # persist the attestation in GitHub's store steps: - - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: fetch-depth: 0 persist-credentials: false # tag push below supplies the token explicitly diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 399385e..a69d101 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -45,7 +45,7 @@ jobs: - os: windows-latest node: 22 steps: - - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 @@ -74,7 +74,7 @@ jobs: run: shell: bash steps: - - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 @@ -139,7 +139,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: persist-credentials: false - name: actionlint diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1f064f1..d79999c 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -36,7 +36,7 @@ jobs: # checkouts under pull_request_target, over-broad token permissions. language: [javascript-typescript, actions] steps: - - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: persist-credentials: false - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 8797495..1474716 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -37,7 +37,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: persist-credentials: false diff --git a/.github/workflows/fleet-status-backfill.yml b/.github/workflows/fleet-status-backfill.yml index ab876d6..16e395e 100644 --- a/.github/workflows/fleet-status-backfill.yml +++ b/.github/workflows/fleet-status-backfill.yml @@ -18,6 +18,6 @@ jobs: checks: read statuses: write steps: - - uses: askalf/ci/actions/fleet-status@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + - uses: askalf/ci/actions/fleet-status@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: all-open: 'true' diff --git a/.github/workflows/fleet-status-self-test.yml b/.github/workflows/fleet-status-self-test.yml index bb79f3e..fb32797 100644 --- a/.github/workflows/fleet-status-self-test.yml +++ b/.github/workflows/fleet-status-self-test.yml @@ -26,10 +26,10 @@ jobs: permissions: contents: read steps: - - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: persist-credentials: false - - uses: askalf/ci/actions/fleet-status-check@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + - uses: askalf/ci/actions/fleet-status-check@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: min-own-exprs: '5' diff --git a/.github/workflows/fleet-status.yml b/.github/workflows/fleet-status.yml index b872f82..4576aa1 100644 --- a/.github/workflows/fleet-status.yml +++ b/.github/workflows/fleet-status.yml @@ -68,7 +68,7 @@ jobs: checks: read statuses: write steps: - - uses: askalf/ci/actions/fleet-status@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + - uses: askalf/ci/actions/fleet-status@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: pr: ${{ github.event.pull_request.number || github.event.issue.number || github.event.workflow_run.pull_requests[0].number }} head-repo: ${{ github.event.workflow_run.head_repository.full_name }} diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 28d37f6..445a661 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -40,7 +40,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 40 steps: - - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 diff --git a/.github/workflows/marketplace-watch.yml b/.github/workflows/marketplace-watch.yml index 90db818..431e82f 100644 --- a/.github/workflows/marketplace-watch.yml +++ b/.github/workflows/marketplace-watch.yml @@ -44,7 +44,7 @@ jobs: contents: write # push the snapshot to the watch branch issues: write # open/close the per-skill triage issues steps: - - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: persist-credentials: false # the snapshot push supplies the token explicitly in its URL diff --git a/.github/workflows/npm-drift-watch.yml b/.github/workflows/npm-drift-watch.yml index e237c8f..23b54c0 100644 --- a/.github/workflows/npm-drift-watch.yml +++ b/.github/workflows/npm-drift-watch.yml @@ -35,7 +35,7 @@ jobs: contents: read issues: write # open/close the drift issue steps: - - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 diff --git a/.github/workflows/public-text.yml b/.github/workflows/public-text.yml index 45aeb6f..825f6e1 100644 --- a/.github/workflows/public-text.yml +++ b/.github/workflows/public-text.yml @@ -18,6 +18,6 @@ concurrency: jobs: public-text: - uses: askalf/ci/.github/workflows/public-text.yml@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + uses: askalf/ci/.github/workflows/public-text.yml@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: - redline-ref: e6a0901235a1d880cf620d23eece2ba63bd042f9 + redline-ref: 083d15618782a9884ab24da3afd3ddfed1a0187a diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index cd046c9..63ce905 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -29,7 +29,7 @@ jobs: id-token: write # OIDC trusted publishing (job-scoped) contents: read steps: - - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: persist-credentials: false diff --git a/.github/workflows/redline-fix.yml b/.github/workflows/redline-fix.yml index 8c89c50..79fb196 100644 --- a/.github/workflows/redline-fix.yml +++ b/.github/workflows/redline-fix.yml @@ -43,9 +43,9 @@ concurrency: jobs: fix: # Pinned so a change to the fix workflow reaches this repo only through a reviewed bump here. - uses: askalf/ci/.github/workflows/redline-fix-run.yml@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + uses: askalf/ci/.github/workflows/redline-fix-run.yml@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: - redline-ref: e6a0901235a1d880cf620d23eece2ba63bd042f9 + redline-ref: 083d15618782a9884ab24da3afd3ddfed1a0187a # truecopy-fix is this repository's fix-lane runner: its own non-root account, one job # per registration. Only this workflow targets that label. runner-label: truecopy-fix diff --git a/.github/workflows/redline.yml b/.github/workflows/redline.yml index 22cff55..1ef3895 100644 --- a/.github/workflows/redline.yml +++ b/.github/workflows/redline.yml @@ -47,9 +47,9 @@ jobs: # checked by the called workflow (open, not a draft, head in this repo) before anything is fetched. if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository) # Pinned so a change to the review workflow reaches this repo only through a reviewed bump here. - uses: askalf/ci/.github/workflows/redline-review.yml@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + uses: askalf/ci/.github/workflows/redline-review.yml@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: - redline-ref: e6a0901235a1d880cf620d23eece2ba63bd042f9 + redline-ref: 083d15618782a9884ab24da3afd3ddfed1a0187a runner-label: redline pr: ${{ inputs.pr }} head: ${{ inputs.head }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 23e32d7..4b791ed 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -24,7 +24,7 @@ jobs: id-token: write # required by publish_results (OIDC attestation) steps: - name: Checkout code - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: persist-credentials: false diff --git a/.github/workflows/truecopy-gate.yml b/.github/workflows/truecopy-gate.yml index 7d7a968..0c07e49 100644 --- a/.github/workflows/truecopy-gate.yml +++ b/.github/workflows/truecopy-gate.yml @@ -23,7 +23,7 @@ jobs: runs-on: ${{ (github.repository != 'askalf/truecopy' || github.event.pull_request && (github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')) && 'ubuntu-latest' || fromJSON('["self-hosted","truecopy-exec"]') }} timeout-minutes: 10 steps: - - uses: askalf/ci/actions/checkout-with-retry@e6a0901235a1d880cf620d23eece2ba63bd042f9 # main 2026-10-25, askalf/ci#135 + - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0