From 5eb43ecf3dfaa1fcefcbb42e34e8baa812ec3886 Mon Sep 17 00:00:00 2001 From: ALF <263217947+askalf@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:32:01 +0000 Subject: [PATCH 01/17] ci: bump Redline to askalf/ci@9718a75 in redline.yml --- .github/workflows/redline.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/redline.yml b/.github/workflows/redline.yml index 1ef3895..1f0cafe 100644 --- a/.github/workflows/redline.yml +++ b/.github/workflows/redline.yml @@ -47,9 +47,9 @@ jobs: # checked by the called workflow (open, not a draft, head in this repo) before anything is fetched. if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository) # Pinned so a change to the review workflow reaches this repo only through a reviewed bump here. - uses: askalf/ci/.github/workflows/redline-review.yml@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + uses: askalf/ci/.github/workflows/redline-review.yml@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: - redline-ref: 083d15618782a9884ab24da3afd3ddfed1a0187a + redline-ref: 9718a75899ff8774d5f6b8135ffb067fabe9dc24 runner-label: redline pr: ${{ inputs.pr }} head: ${{ inputs.head }} From b04514a4faedf862e47317e99860dd9e88b41919 Mon Sep 17 00:00:00 2001 From: ALF <263217947+askalf@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:32:04 +0000 Subject: [PATCH 02/17] ci: bump Redline to askalf/ci@9718a75 in redline-fix.yml --- .github/workflows/redline-fix.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/redline-fix.yml b/.github/workflows/redline-fix.yml index 79fb196..747d77c 100644 --- a/.github/workflows/redline-fix.yml +++ b/.github/workflows/redline-fix.yml @@ -43,9 +43,9 @@ concurrency: jobs: fix: # Pinned so a change to the fix workflow reaches this repo only through a reviewed bump here. - uses: askalf/ci/.github/workflows/redline-fix-run.yml@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + uses: askalf/ci/.github/workflows/redline-fix-run.yml@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: - redline-ref: 083d15618782a9884ab24da3afd3ddfed1a0187a + redline-ref: 9718a75899ff8774d5f6b8135ffb067fabe9dc24 # truecopy-fix is this repository's fix-lane runner: its own non-root account, one job # per registration. Only this workflow targets that label. runner-label: truecopy-fix From a3c53aa4197b69909d7454bd653284fc164dfe3f Mon Sep 17 00:00:00 2001 From: ALF <263217947+askalf@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:32:06 +0000 Subject: [PATCH 03/17] ci: bump Redline to askalf/ci@9718a75 in public-text.yml --- .github/workflows/public-text.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/public-text.yml b/.github/workflows/public-text.yml index 825f6e1..a93e1a1 100644 --- a/.github/workflows/public-text.yml +++ b/.github/workflows/public-text.yml @@ -18,6 +18,6 @@ concurrency: jobs: public-text: - uses: askalf/ci/.github/workflows/public-text.yml@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + uses: askalf/ci/.github/workflows/public-text.yml@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: - redline-ref: 083d15618782a9884ab24da3afd3ddfed1a0187a + redline-ref: 9718a75899ff8774d5f6b8135ffb067fabe9dc24 From c99230e0c72c2d340353e9b44aea0284d089238e Mon Sep 17 00:00:00 2001 From: ALF <263217947+askalf@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:32:08 +0000 Subject: [PATCH 04/17] ci: bump action pins to askalf/ci@9718a75 in auto-release.yml --- .github/workflows/auto-release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index c617094..32c208f 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -34,7 +34,7 @@ jobs: id-token: write # keyless Sigstore signing (attest-build-provenance) attestations: write # persist the attestation in GitHub's store steps: - - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + - uses: askalf/ci/actions/checkout-with-retry@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: fetch-depth: 0 persist-credentials: false # tag push below supplies the token explicitly From aeff1a1e6c0fd9d7c965dfcb43c71a2ab93baa41 Mon Sep 17 00:00:00 2001 From: ALF <263217947+askalf@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:32:10 +0000 Subject: [PATCH 05/17] ci: bump action pins to askalf/ci@9718a75 in ci.yml --- .github/workflows/ci.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c97f077..d8dd24f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -45,7 +45,7 @@ jobs: - os: windows-latest node: 22 steps: - - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + - uses: askalf/ci/actions/checkout-with-retry@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 @@ -79,7 +79,7 @@ jobs: run: shell: bash steps: - - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + - uses: askalf/ci/actions/checkout-with-retry@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 @@ -144,7 +144,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + - uses: askalf/ci/actions/checkout-with-retry@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: persist-credentials: false - name: actionlint From 5d3f282924230eed5a3eb9b8ba1adb4e7ddf01db Mon Sep 17 00:00:00 2001 From: ALF <263217947+askalf@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:32:13 +0000 Subject: [PATCH 06/17] ci: bump action pins to askalf/ci@9718a75 in codeql.yml --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d79999c..f59acaf 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -36,7 +36,7 @@ jobs: # checkouts under pull_request_target, over-broad token permissions. language: [javascript-typescript, actions] steps: - - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + - uses: askalf/ci/actions/checkout-with-retry@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: persist-credentials: false - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 From 5ebfd051961fd7f4b76103b86d3529256bb2a02d Mon Sep 17 00:00:00 2001 From: ALF <263217947+askalf@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:32:15 +0000 Subject: [PATCH 07/17] ci: bump action pins to askalf/ci@9718a75 in docker.yml --- .github/workflows/docker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 1474716..50972dd 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -37,7 +37,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + - uses: askalf/ci/actions/checkout-with-retry@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: persist-credentials: false From 2208b0d4ca5b064f10a8317069197fcf4df0aae9 Mon Sep 17 00:00:00 2001 From: ALF <263217947+askalf@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:32:17 +0000 Subject: [PATCH 08/17] ci: bump action pins to askalf/ci@9718a75 in fleet-status-backfill.yml --- .github/workflows/fleet-status-backfill.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/fleet-status-backfill.yml b/.github/workflows/fleet-status-backfill.yml index ed8b80e..dc45033 100644 --- a/.github/workflows/fleet-status-backfill.yml +++ b/.github/workflows/fleet-status-backfill.yml @@ -18,6 +18,6 @@ jobs: checks: read statuses: write steps: - - uses: askalf/ci/actions/fleet-status@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + - uses: askalf/ci/actions/fleet-status@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: all-open: 'true' From f316b8110c0e9ef492f0844b15d9df3c6fb15b66 Mon Sep 17 00:00:00 2001 From: ALF <263217947+askalf@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:32:19 +0000 Subject: [PATCH 09/17] ci: bump action pins to askalf/ci@9718a75 in fleet-status-self-test.yml --- .github/workflows/fleet-status-self-test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/fleet-status-self-test.yml b/.github/workflows/fleet-status-self-test.yml index fb32797..60a7200 100644 --- a/.github/workflows/fleet-status-self-test.yml +++ b/.github/workflows/fleet-status-self-test.yml @@ -26,10 +26,10 @@ jobs: permissions: contents: read steps: - - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + - uses: askalf/ci/actions/checkout-with-retry@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: persist-credentials: false - - uses: askalf/ci/actions/fleet-status-check@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + - uses: askalf/ci/actions/fleet-status-check@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: min-own-exprs: '5' From ef6801b6f144a6b54965ea6ce6faf19570d7ef12 Mon Sep 17 00:00:00 2001 From: ALF <263217947+askalf@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:32:21 +0000 Subject: [PATCH 10/17] ci: bump action pins to askalf/ci@9718a75 in fleet-status.yml --- .github/workflows/fleet-status.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/fleet-status.yml b/.github/workflows/fleet-status.yml index 4576aa1..6e72483 100644 --- a/.github/workflows/fleet-status.yml +++ b/.github/workflows/fleet-status.yml @@ -68,7 +68,7 @@ jobs: checks: read statuses: write steps: - - uses: askalf/ci/actions/fleet-status@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + - uses: askalf/ci/actions/fleet-status@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: pr: ${{ github.event.pull_request.number || github.event.issue.number || github.event.workflow_run.pull_requests[0].number }} head-repo: ${{ github.event.workflow_run.head_repository.full_name }} From 866ebf7d3f25290bf623e745ddf7b9b3be0b4fa6 Mon Sep 17 00:00:00 2001 From: ALF <263217947+askalf@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:32:23 +0000 Subject: [PATCH 11/17] ci: bump action pins to askalf/ci@9718a75 in fuzz.yml --- .github/workflows/fuzz.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index b7bf1c3..69f4b49 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -40,7 +40,7 @@ jobs: runs-on: ${{ (github.repository != 'askalf/truecopy' || github.event.pull_request && (github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')) && 'ubuntu-latest' || fromJSON('["self-hosted","truecopy-exec"]') }} timeout-minutes: 40 steps: - - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + - uses: askalf/ci/actions/checkout-with-retry@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 From 390eb20400edbffeb23dc9cf1ffe017c2bb83170 Mon Sep 17 00:00:00 2001 From: ALF <263217947+askalf@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:32:25 +0000 Subject: [PATCH 12/17] ci: bump action pins to askalf/ci@9718a75 in marketplace-watch.yml --- .github/workflows/marketplace-watch.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/marketplace-watch.yml b/.github/workflows/marketplace-watch.yml index cec614c..c9a6cab 100644 --- a/.github/workflows/marketplace-watch.yml +++ b/.github/workflows/marketplace-watch.yml @@ -44,7 +44,7 @@ jobs: contents: write # push the snapshot to the watch branch issues: write # open/close the per-skill triage issues steps: - - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + - uses: askalf/ci/actions/checkout-with-retry@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: persist-credentials: false # the snapshot push supplies the token explicitly in its URL From 39a372391f01b615080874a6085b36420d13f5ab Mon Sep 17 00:00:00 2001 From: ALF <263217947+askalf@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:32:27 +0000 Subject: [PATCH 13/17] ci: bump action pins to askalf/ci@9718a75 in npm-drift-watch.yml --- .github/workflows/npm-drift-watch.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/npm-drift-watch.yml b/.github/workflows/npm-drift-watch.yml index 23b54c0..39dca95 100644 --- a/.github/workflows/npm-drift-watch.yml +++ b/.github/workflows/npm-drift-watch.yml @@ -35,7 +35,7 @@ jobs: contents: read issues: write # open/close the drift issue steps: - - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + - uses: askalf/ci/actions/checkout-with-retry@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 From 0c2b047fb080d152784c13595e60318f76676298 Mon Sep 17 00:00:00 2001 From: ALF <263217947+askalf@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:32:29 +0000 Subject: [PATCH 14/17] ci: bump action pins to askalf/ci@9718a75 in publish.yml --- .github/workflows/publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 63ce905..bd6d8bf 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -29,7 +29,7 @@ jobs: id-token: write # OIDC trusted publishing (job-scoped) contents: read steps: - - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + - uses: askalf/ci/actions/checkout-with-retry@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: persist-credentials: false From b24968f16b3549002eb6079209b423954c20147a Mon Sep 17 00:00:00 2001 From: ALF <263217947+askalf@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:32:32 +0000 Subject: [PATCH 15/17] ci: bump action pins to askalf/ci@9718a75 in scorecard.yml --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 4b791ed..3a7830a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -24,7 +24,7 @@ jobs: id-token: write # required by publish_results (OIDC attestation) steps: - name: Checkout code - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + uses: askalf/ci/actions/checkout-with-retry@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: persist-credentials: false From dfe8c962b89ddf6f26a24203830a21224d4f5d18 Mon Sep 17 00:00:00 2001 From: ALF <263217947+askalf@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:32:34 +0000 Subject: [PATCH 16/17] ci: bump action pins to askalf/ci@9718a75 in truecopy-gate.yml --- .github/workflows/truecopy-gate.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/truecopy-gate.yml b/.github/workflows/truecopy-gate.yml index 0c07e49..f297c79 100644 --- a/.github/workflows/truecopy-gate.yml +++ b/.github/workflows/truecopy-gate.yml @@ -23,7 +23,7 @@ jobs: runs-on: ${{ (github.repository != 'askalf/truecopy' || github.event.pull_request && (github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')) && 'ubuntu-latest' || fromJSON('["self-hosted","truecopy-exec"]') }} timeout-minutes: 10 steps: - - uses: askalf/ci/actions/checkout-with-retry@083d15618782a9884ab24da3afd3ddfed1a0187a # main 2026-10-27, askalf/ci#137 + - uses: askalf/ci/actions/checkout-with-retry@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: persist-credentials: false - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 From 93a1a1dacb76515e2c3b451520a3d9b1f8f8e02e Mon Sep 17 00:00:00 2001 From: ALF <263217947+askalf@users.noreply.github.com> Date: Fri, 30 Oct 2026 06:14:03 -0400 Subject: [PATCH 17/17] ci: allow marketplace-watch the repository-only runner expression --- .github/workflows/fleet-status-self-test.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/fleet-status-self-test.yml b/.github/workflows/fleet-status-self-test.yml index 60a7200..ddb6205 100644 --- a/.github/workflows/fleet-status-self-test.yml +++ b/.github/workflows/fleet-status-self-test.yml @@ -33,3 +33,4 @@ jobs: - uses: askalf/ci/actions/fleet-status-check@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139 with: min-own-exprs: '5' + repo-only: fleet-status.yml fleet-status-backfill.yml marketplace-watch.yml