From 9569fe2185a230056b5a0c9589301c2c4787839b Mon Sep 17 00:00:00 2001 From: gaoruilin Date: Mon, 14 Sep 2026 07:31:27 +0800 Subject: [PATCH] ci(claims): reference the released tool by its tag, not a frozen commit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This repository pinned the claims action by commit SHA, which froze it at the older build. That version predates the change that makes a failing assertion print the command's actual output — the one thing you need when a gate goes red at 3am. Third-party actions stay SHA-pinned; our own tool is versioned, tested and released, so `@v0.1.1` is the honest reference and bumping it is a one-line diff. Every other repository that runs this gate is on `@v0.1.1` too, so `verify-claims index` reports one version in use instead of three. --- .github/workflows/claims.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/claims.yml b/.github/workflows/claims.yml index 4f764ae..f4e4dbf 100644 --- a/.github/workflows/claims.yml +++ b/.github/workflows/claims.yml @@ -28,4 +28,4 @@ jobs: with: node-version: '22' - run: npm ci - - uses: alloevil/verify-claims@v0.1.0 + - uses: alloevil/verify-claims@v0.1.1