HugoRCD · Oct 4, 2026 · Oct 4, 2026
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -9,11 +9,6 @@ permissions:
   contents: read
   pull-requests: write
 
-env:
-  # `--format github` ships in @evlog/cli 0.8; until it is on npm the preview
-  # build of evloghq/evlog#767 stands in. Switch to `latest` with the release.
-  EVLOG_CLI: https://pkg.pr.new/@evlog/cli@767
-
 jobs:
   unit:
     runs-on: ubuntu-latest
@@ -29,7 +24,6 @@ jobs:
       - id: map
         uses: ./
         with:
-          version: ${{ env.EVLOG_CLI }}
           working-directory: test/fixtures/nuxt-app
           min-score: 40
           baseline: none
@@ -52,7 +46,6 @@ jobs:
       - id: map
         uses: ./
         with:
-          version: ${{ env.EVLOG_CLI }}
           packages: |
             test/fixtures/*
           limit: 3
@@ -74,7 +67,6 @@ jobs:
       - id: map
         uses: ./
         with:
-          version: ${{ env.EVLOG_CLI }}
           working-directory: test/fixtures/nuxt-app
           min-score: 100
           gate: false
@@ -97,7 +89,6 @@ jobs:
         continue-on-error: true
         uses: ./
         with:
-          version: ${{ env.EVLOG_CLI }}
           working-directory: test/fixtures/nuxt-app
           min-score: 100
           comment: false
@@ -119,7 +110,6 @@ jobs:
         continue-on-error: true
         uses: ./
         with:
-          version: ${{ env.EVLOG_CLI }}
           working-directory: test/fixtures/nuxt-app
           min-score: 150
       - name: A bad input fails before anything is scanned
@@ -139,7 +129,6 @@ jobs:
         continue-on-error: true
         uses: ./
         with:
-          version: ${{ env.EVLOG_CLI }}
           packages: |
             test/fixtures/*
           comment-key: baseline

diff --git a/AGENTS.md b/AGENTS.md
@@ -29,7 +29,7 @@ test/fixtures/        small apps the workflow scans: nuxt-app, express-app, hono
 
 ## Releasing
 
-Tag `vX.Y.Z` on `main`. `release.yml` moves `vX` to it. Users ride `@v1`; the CLI version is pinned by them via the `version` input and is not tied to this repository's releases.
+Tag `vX.Y.Z` on `main`. `release.yml` moves `vX` to it. Users ride `@v1`. The `version` default in `action.yml` is the `@evlog/cli` release the action was tested with: bumping it is a change to this repository, released with a tag, never implied by a CLI release.
 
 ## Git
 

diff --git a/README.md b/README.md
@@ -35,7 +35,7 @@ The judgment is the CLI's. The action adds no rule of its own, so `npx evlog map
 
 | Input | Default | What it does |
 | --- | --- | --- |
-| `version` | `latest` | `@evlog/cli` version to run, or a full spec. Pin it: a release can move a verdict on code nobody touched. |
+| `version` | `0.8.0` | `@evlog/cli` version to run, or a full spec. Defaults to the release this action was tested with; `latest` follows npm. |
 | `working-directory` | `.` | Project to scan, relative to the workspace. |
 | `packages` | | One directory or glob per line (`apps/*`), each scanned as its own package. |
 | `baseline` | `auto` | `auto` scans the pull request base and compares against it. A path or `git:<ref>` is passed to the CLI. `none` disables the comparison. |
@@ -84,16 +84,16 @@ Each package gets its own row in the report and its own annotations, with paths
 
 The step stays green; `passed` and `results` say what a gate would have done. Set `min-score` to today's score once the team has seen a few reports, then raise it as things get fixed.
 
-### Pin the CLI
+### Which CLI runs
+
+Each action release pins the `@evlog/cli` it was tested with, so `@v1` is deterministic: a CLI release on npm never moves a verdict under your gate. Upgrading the action upgrades the CLI, in a pull request where a moved score is the point. To run ahead of that:
 
 ```yaml
       - uses: evloghq/action@v1
         with:
-          version: 0.8.0
+          version: latest
 ```
 
-`@v1` follows how findings are delivered; the CLI version decides what the findings are. Keep the two apart: ride the action's major, pin the CLI, and upgrade it in its own pull request where a moved score is the point.
-
 ### Run on pushes too
 
 On a push there is no base to compare against, so `baseline: auto` turns the comparison off and the run reports. Pass `baseline: git:origin/main` to compare against a committed `evlog.map.json` instead.

diff --git a/action.yml b/action.yml
@@ -10,8 +10,10 @@ inputs:
     description: CLI command to run. Only `map` for now.
     default: map
   version:
-    description: '`@evlog/cli` version to run, or a full package spec (a pkg.pr.new URL). Pin it: a release can move a verdict on code nobody touched.'
-    default: latest
+    # The CLI release this action was tested against. A release of the action
+    # moves it; a CLI release on its own never changes what a user's gate sees.
+    description: '`@evlog/cli` version to run, or a full package spec (a pkg.pr.new URL). Defaults to the release this action was tested with; `latest` follows npm.'
+    default: 0.8.0
   working-directory:
     description: Directory of the project to scan, relative to the workspace.
     default: .
-Original file line number
+Diff line change
@@ Expand Up @@
     ## Releasing
-    Tag `vX.Y.Z` on `main`. `release.yml` moves `vX` to it. Users ride `@v1`; the CLI version is pinned by them via the `version` input and is not tied to this repository's releases.
+    Tag `vX.Y.Z` on `main`. `release.yml` moves `vX` to it. Users ride `@v1`. The `version` default in `action.yml` is the `@evlog/cli` release the action was tested with: bumping it is a change to this repository, released with a tag, never implied by a CLI release.
     ## Git
@@ Expand Down @@