From a3a8f85a363d7f5cb15ba2cb0cb6423bf8f55d60 Mon Sep 17 00:00:00 2001 From: Joris Wouter Jonkers Date: Thu, 20 Aug 2026 23:26:04 +0200 Subject: [PATCH] ci: pin github-workflows at v0.16.0, where the pin takes effect Until v0.15.2 the reusable workflows checked out their own action code with ref: ${{ github.job_workflow_sha }}, which is empty inside a reusable workflow, so actions/checkout fell back to the default branch. Every pin here selected a workflow file while the scripts it ran always came from main. From v0.15.2 the checkout uses a literal that release-please keeps in step with the tag, so a pin finally determines the code that runs. All pins move to v0.16.0 together. They had drifted to three different versions, which mattered little while everything ran main and matters now. Every reusable workflow interface involved is unchanged across the versions being crossed -- same inputs, same required flags, same secrets -- so no caller change is needed. --- .github/workflows/deploy-preview.yml | 2 +- .github/workflows/publish.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy-preview.yml b/.github/workflows/deploy-preview.yml index d921599..026d0dc 100644 --- a/.github/workflows/deploy-preview.yml +++ b/.github/workflows/deploy-preview.yml @@ -13,7 +13,7 @@ permissions: {} jobs: deploy-preview: - uses: JorisJonkers-dev/github-workflows/.github/workflows/deploy-validate.yml@5b5e93dc81846cac4e13118e7280fd81a143685e # v0.15.1 + uses: JorisJonkers-dev/github-workflows/.github/workflows/deploy-validate.yml@bbcfef9e7127e5d8a6215a7142a0fa9cc2ad5055 # v0.16.0 with: deploy-dir: platform schema-version: 0.20.0 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 73a4b95..f8ddca2 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -171,7 +171,7 @@ jobs: # -- 3. Render and publish the deploy artifact ---------------------------- publish-deploy-artifact: needs: [resolve-image-lock] - uses: JorisJonkers-dev/github-workflows/.github/workflows/deploy-artifact.yml@5b5e93dc81846cac4e13118e7280fd81a143685e # v0.15.1 + uses: JorisJonkers-dev/github-workflows/.github/workflows/deploy-artifact.yml@bbcfef9e7127e5d8a6215a7142a0fa9cc2ad5055 # v0.16.0 with: ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/{0}', inputs.tag) || github.ref }} artifact-name: agent-runtime