Pin Action 1.14.0 in CLI docs

README.md

@@ -51,7 +51,7 @@ echo "$BORINGCACHE_RESTORE_TOKEN" | docker login registry.boringcache.com \
 docker pull registry.boringcache.com/my-org/my-workspace/web:latest
 ```
 
-If you are wiring GitHub Actions, use [`boringcache/one@9721d419d2c78c0780963d297eb3f81f24641a27`](https://github.com/boringcache/one) after onboard so CI can reuse the same repo config and trust model.
+If you are wiring GitHub Actions, use [`boringcache/one@6b7033721b37075b2138fd0c769bf088e0836ce6`](https://github.com/boringcache/one) after onboard so CI can reuse the same repo config and trust model.
 
 ## Docs
 

docs/github-actions.md

@@ -5,14 +5,14 @@ The preferred path is:
 1. install the CLI locally
 2. run `boringcache onboard`
 3. commit `.boringcache.toml` when it helps
-4. use [`boringcache/one@9721d419d2c78c0780963d297eb3f81f24641a27`](https://github.com/boringcache/one) in GitHub Actions
+4. use [`boringcache/one@6b7033721b37075b2138fd0c769bf088e0836ce6`](https://github.com/boringcache/one) in GitHub Actions
 
 That keeps CI and local runs on the same workspace, entries, and cache profiles.
 
 Example:
 
 ```yaml
-- uses: boringcache/one@9721d419d2c78c0780963d297eb3f81f24641a27 # v1.13.106
+- uses: boringcache/one@6b7033721b37075b2138fd0c769bf088e0836ce6 # v1.14.0
   with:
     setup: none
     mode: archive
@@ -22,10 +22,10 @@ Example:
     BORINGCACHE_SAVE_TOKEN: ${{ github.event_name != 'pull_request' && secrets.BORINGCACHE_SAVE_TOKEN || '' }}
 ```
 
-For proxy-backed modes, `boringcache/one@9721d419d2c78c0780963d297eb3f81f24641a27` also accepts first-class `metadata-hints` so sessions and misses stay grouped by stable labels instead of per-run noise:
+For proxy-backed modes, `boringcache/one@6b7033721b37075b2138fd0c769bf088e0836ce6` also accepts first-class `metadata-hints` so sessions and misses stay grouped by stable labels instead of per-run noise:
 
 ```yaml
-- uses: boringcache/one@9721d419d2c78c0780963d297eb3f81f24641a27 # v1.13.106
+- uses: boringcache/one@6b7033721b37075b2138fd0c769bf088e0836ce6 # v1.14.0
   with:
     setup: none
     mode: bazel
@@ -40,7 +40,7 @@ For proxy-backed modes, `boringcache/one@9721d419d2c78c0780963d297eb3f81f24641a2
 
 Keep those hints low-cardinality. Good values are `project=web`, `benchmark=grpc-bazel`, `tool=gradle`, `lane=ci`, or `workflow=build`. Avoid commit SHAs, run ids, timestamps, and cold/warm labels for normal sessions; BoringCache classifies new and recurring misses from cache target and lifecycle data.
 
-If the repo already defines `[proxy]` or adapter `metadata-hints` in `.boringcache.toml`, `boringcache/one@9721d419d2c78c0780963d297eb3f81f24641a27` inherits them through the CLI dry-run plan. Prefer repo config for durable defaults and use the action input only when the workflow needs an explicit override.
+If the repo already defines `[proxy]` or adapter `metadata-hints` in `.boringcache.toml`, `boringcache/one@6b7033721b37075b2138fd0c769bf088e0836ce6` inherits them through the CLI dry-run plan. Prefer repo config for durable defaults and use the action input only when the workflow needs an explicit override.
 The canonical repo-config starting points in [Tool guides](tool-guides.md) are
 meant to be shared between local CLI runs and GitHub Actions for exactly this
 reason.
@@ -88,7 +88,7 @@ You can still override a configured adapter from the workflow when needed:
     BORINGCACHE_SAVE_TOKEN: ${{ github.event_name != 'pull_request' && secrets.BORINGCACHE_SAVE_TOKEN || '' }}
 ```
 
-Use `boringcache/one@9721d419d2c78c0780963d297eb3f81f24641a27` when you want the action to keep owning tool setup such as Bazel rc files, Maven or Gradle cache config, buildx setup, or container networking.
+Use `boringcache/one@6b7033721b37075b2138fd0c769bf088e0836ce6` when you want the action to keep owning tool setup such as Bazel rc files, Maven or Gradle cache config, buildx setup, or container networking.
 When you run `boringcache docker` directly in GitHub Actions, the CLI derives the same branch/default/PR human tags from GitHub metadata that archive and proxy flows use. The action path passes provider-neutral metadata so Docker cache artifacts report the resolved human import/export tags and CI context.
 For Dockerfile `RUN` steps that invoke native remote-cache tools, use the
 Docker-specific action input with inline tags such as

docs/quick-start.md

@@ -53,7 +53,7 @@ boringcache docker
 
 The next docs to read are usually [Adapter commands](adapter-commands.md) and [Tool guides](tool-guides.md).
 
-If the repo uses GitHub Actions, the next step is usually [`boringcache/one@9721d419d2c78c0780963d297eb3f81f24641a27`](https://github.com/boringcache/one).
+If the repo uses GitHub Actions, the next step is usually [`boringcache/one@6b7033721b37075b2138fd0c769bf088e0836ce6`](https://github.com/boringcache/one).
 See [GitHub Actions](github-actions.md).
 
 ## Security defaults

docs/tool-guides.md

@@ -9,7 +9,7 @@ The pattern is simple:
 3. use `boringcache <tool>`
 
 The snippets below are intended to be copy-pasteable `.boringcache.toml`
-starting points. They work for local CLI runs and for `boringcache/one@9721d419d2c78c0780963d297eb3f81f24641a27`
+starting points. They work for local CLI runs and for `boringcache/one@6b7033721b37075b2138fd0c769bf088e0836ce6`
 because the action asks the CLI for the same repo plan.
 
 Shared defaults for the examples:

install-web/index.html

@@ -188,7 +188,7 @@ <h3>🎯 Next Steps</h3>
                 <li><strong>Move into your repo:</strong> <code>cd your-project</code></li>
                 <li><strong>Connect the CLI:</strong> <code>boringcache onboard</code></li>
                 <li><strong>Wrap one repeated step:</strong> <code>boringcache run -- bundle install</code></li>
-                <li><strong>Wire CI when ready:</strong> <code>boringcache/one@9721d419d2c78c0780963d297eb3f81f24641a27</code> (v1.13.106)</li>
+                <li><strong>Wire CI when ready:</strong> <code>boringcache/one@6b7033721b37075b2138fd0c769bf088e0836ce6</code> (v1.14.0)</li>
             </ol>
             <p>📖 <strong>Documentation:</strong> Visit <a href="https://boringcache.com/docs">boringcache.com/docs</a> for setup paths and CLI docs.</p>
         </div>