chore(ci): track quantecon/actions at the floating @v0

[mmcky]

Moves all six quantecon/actions call sites from @v0.8.0 to the floating @v0, which is the reference CONTRIBUTING recommends for consumers.

Why

This repo is the reason QuantEcon/actions#83 exists: its weekly cache build failed for roughly two months and filed no issue, because failure alerting had never worked in container mode. That was fixed in v0.10.0, and the remaining gap — a run that aborts before the builds skipping every guard, including the alert — in v0.11.0, released today.

Neither fix reached this repo, because the pin never moved. That is the argument for the change: a pin that must be bumped by hand in order to deliver an alerting fix has the same failure mode as the missing alert — nobody notices until something has already gone unreported for months. Three releases of drift accumulated here with no signal.

The usual counter-argument is that 0.x minors may break. That risk is real but covered: test-actions-lecture-intro runs the same full chain against @v0 on the same weekly cadence, so it meets a bad release first, and breaking changes are marked ⚠️ BREAKING in the changelog with migration notes.

What changes in behaviour

Bumping across v0.9.0 picks up one deliberate behaviour change: restore-jupyter-cache dropped its bare build- restore-key fallback, which had made the build cache impossible to miss — an environment.yml change silently restored a _build produced by the old environment. The narrower fallbacks remain, so warm starts within one environment still hit. Cost here is one slower build after each environment.yml change, which is the correct trade.

From v0.10.0, a job using build-jupyter-cache with create-issue-on-failure: true must grant issues: write or the job now fails loudly rather than silently skipping the alert. cache.yml already grants it, so no config change is needed in this PR.

Verifying it worked

The next scheduled Build Cache run (Mondays 02:00 UTC) is the real check. If it fails for any reason, it should now open an issue in this repo rather than going quietly red — that is the whole point of the two fixes this bump collects.

Supersedes

Dependabot PR #50 (0.8.0 → 0.9.0) — stale on arrival, and unnecessary once the reference floats.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates the repository’s GitHub Actions workflows to consume quantecon/actions via the floating @v0 tag instead of a fixed @v0.8.0, aligning with the upstream recommendation and ensuring CI behavior fixes (notably failure alerting) reach this repo without manual pin bumps.

Changes:

• Switch restore-jupyter-cache, build-lectures, build-jupyter-cache, and publish-gh-pages usages from @v0.8.0 to @v0.
• Apply the update consistently across CI, cache-building, and publish workflows.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
.github/workflows/ci.yml	Updates restore/build lecture actions to quantecon/actions@v0 for PR builds.
.github/workflows/cache.yml	Updates the cache build workflow to use build-jupyter-cache@v0 (with issue-on-failure enabled).
.github/workflows/publish.yml	Updates restore/build/publish actions to quantecon/actions@v0 for tagged publishing.

Suppressed comments (3)

.github/workflows/ci.yml:25

• Using a floating GitHub Action tag (@v0) means this workflow can change without any PR in this repo (including potentially security-relevant changes or unexpected breaking behavior). GitHub generally recommends pinning third-party actions to a full commit SHA (or at least a specific release tag) to reduce supply-chain risk and improve reproducibility. Consider whether @v0 is acceptable for this repo’s security/release posture, or whether you’d prefer pinning to a specific v0.x.y (or SHA) and relying on automated update PRs for upgrades.

        uses: quantecon/actions/build-lectures@v0

.github/workflows/publish.yml:37

• Using a floating GitHub Action tag (@v0) means this workflow can change without any PR in this repo (including potentially security-relevant changes or unexpected breaking behavior). GitHub generally recommends pinning third-party actions to a full commit SHA (or at least a specific release tag) to reduce supply-chain risk and improve reproducibility. Consider whether @v0 is acceptable for this repo’s security/release posture, or whether you’d prefer pinning to a specific v0.x.y (or SHA) and relying on automated update PRs for upgrades.

        uses: quantecon/actions/build-lectures@v0

.github/workflows/publish.yml:69

• Using a floating GitHub Action tag (@v0) means this workflow can change without any PR in this repo (including potentially security-relevant changes or unexpected breaking behavior). GitHub generally recommends pinning third-party actions to a full commit SHA (or at least a specific release tag) to reduce supply-chain risk and improve reproducibility. Consider whether @v0 is acceptable for this repo’s security/release posture, or whether you’d prefer pinning to a specific v0.x.y (or SHA) and relying on automated update PRs for upgrades.

        uses: quantecon/actions/publish-gh-pages@v0

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.