Apply code-review fixes; drop the unworkable @v0 floating tag

claude · claude · commit 246a88c6de18 · 2026-06-14T22:26:11.000Z
/code-review (xhigh) surfaced: - marketplace-major-tag.yml never fires: a GITHUB_TOKEN-published release does not trigger workflows (GitHub anti-recursion), so @v0 never moved. Drop the @v0 floating tag and delete the workflow; recommend commit-SHA (strongest) or immutable release-tag pinning, which need no automation. The release job's publish step is what updates the Marketplace listing, so job: release / credential: GITHUB_TOKEN are now accurate. - action.yml checksum: the `-z "$expected"` guard was dead under set -euo pipefail (the grep | head pipeline tripped pipefail before the empty check), so a missing asset aborted with no diagnostic. Switch to an awk match that exits 0 on no match, also tolerating binary-mode (*) checksums and dropping the SIGPIPE-prone head. - action.yml: multiline-safe GITHUB_OUTPUT write; correct the args comment (the shell also glob-expands, not only whitespace-splits). - action-smoke: assert the version output contains the pinned version rather than only checking it is non-empty. mdsmith check clean, channels.yaml drift-free, zizmor clean. https://claude.ai/code/session_01TKgJTS4UcFPqtdwkxYzTUC
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
@@ -54,7 +54,7 @@ row: "- [{summary}](../{filename})"
 - [Rebase, CI monitoring, and review comment resolution.](../docs/development/pr-fixup-workflow.md)
 - [The `jeduden/asdf-mdsmith` plugin installs the checksum-verified prebuilt binary; the short form awaits the asdf-plugins registry entry.](../docs/development/release-channels/asdf.md)
 - [A single-file `.flatpak` bundle built in CI from the x86_64 Linux release binary and attached to each GitHub release, installed by file with host filesystem access for the linter.](../docs/development/release-channels/flatpak.md)
-- [A composite action at the repository root downloads the checksum-verified release binary for the runner's OS and architecture and puts `mdsmith` on `PATH`; published to the GitHub Marketplace and referenced as `uses: jeduden/mdsmith@v0`.](../docs/development/release-channels/github-actions.md)
+- [A composite action at the repository root downloads the checksum-verified release binary for the runner's OS and architecture and puts `mdsmith` on `PATH`; published to the GitHub Marketplace and pinned by commit SHA or release tag.](../docs/development/release-channels/github-actions.md)
 - [Per-platform mdsmith binaries plus the .vsix, the checksum file, and a Sigstore signature, attached to a tag-named release.](../docs/development/release-channels/github-releases.md)
 - [`go install` compiles mdsmith from the tagged module source with the host Go 1.25+ toolchain; no prebuilt binary is downloaded.](../docs/development/release-channels/go.md)
 - [The `jeduden/homebrew-mdsmith` tap installs the checksum-verified prebuilt binary for macOS or Linux on Intel or arm64.](../docs/development/release-channels/homebrew.md)
diff --git a/.github/workflows/action-smoke.yml b/.github/workflows/action-smoke.yml
@@ -40,10 +40,13 @@ jobs:
           version: v0.41.0
           args: version
 
-      - name: Verify mdsmith stayed on PATH and reported a version
+      - name: Verify mdsmith stayed on PATH and reported the pinned version
         shell: bash
         env:
           GOT_VERSION: ${{ steps.mdsmith.outputs.version }}
         run: |
           mdsmith version
-          test -n "$GOT_VERSION"
+          case "$GOT_VERSION" in
+            *0.41.0*) echo "version output OK: $GOT_VERSION" ;;
+            *) echo "::error::unexpected version output: $GOT_VERSION"; exit 1 ;;
+          esac
diff --git a/.github/workflows/marketplace-major-tag.yml b/.github/workflows/marketplace-major-tag.yml
diff --git a/AGENTS.md b/AGENTS.md
@@ -60,7 +60,7 @@ row: "- [{summary}]({filename})"
 - [Rebase, CI monitoring, and review comment resolution.](docs/development/pr-fixup-workflow.md)
 - [The `jeduden/asdf-mdsmith` plugin installs the checksum-verified prebuilt binary; the short form awaits the asdf-plugins registry entry.](docs/development/release-channels/asdf.md)
 - [A single-file `.flatpak` bundle built in CI from the x86_64 Linux release binary and attached to each GitHub release, installed by file with host filesystem access for the linter.](docs/development/release-channels/flatpak.md)
-- [A composite action at the repository root downloads the checksum-verified release binary for the runner's OS and architecture and puts `mdsmith` on `PATH`; published to the GitHub Marketplace and referenced as `uses: jeduden/mdsmith@v0`.](docs/development/release-channels/github-actions.md)
+- [A composite action at the repository root downloads the checksum-verified release binary for the runner's OS and architecture and puts `mdsmith` on `PATH`; published to the GitHub Marketplace and pinned by commit SHA or release tag.](docs/development/release-channels/github-actions.md)
 - [Per-platform mdsmith binaries plus the .vsix, the checksum file, and a Sigstore signature, attached to a tag-named release.](docs/development/release-channels/github-releases.md)
 - [`go install` compiles mdsmith from the tagged module source with the host Go 1.25+ toolchain; no prebuilt binary is downloaded.](docs/development/release-channels/go.md)
 - [The `jeduden/homebrew-mdsmith` tap installs the checksum-verified prebuilt binary for macOS or Linux on Intel or arm64.](docs/development/release-channels/homebrew.md)
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -46,7 +46,7 @@ row: "- [{summary}]({filename})"
 - [Rebase, CI monitoring, and review comment resolution.](docs/development/pr-fixup-workflow.md)
 - [The `jeduden/asdf-mdsmith` plugin installs the checksum-verified prebuilt binary; the short form awaits the asdf-plugins registry entry.](docs/development/release-channels/asdf.md)
 - [A single-file `.flatpak` bundle built in CI from the x86_64 Linux release binary and attached to each GitHub release, installed by file with host filesystem access for the linter.](docs/development/release-channels/flatpak.md)
-- [A composite action at the repository root downloads the checksum-verified release binary for the runner's OS and architecture and puts `mdsmith` on `PATH`; published to the GitHub Marketplace and referenced as `uses: jeduden/mdsmith@v0`.](docs/development/release-channels/github-actions.md)
+- [A composite action at the repository root downloads the checksum-verified release binary for the runner's OS and architecture and puts `mdsmith` on `PATH`; published to the GitHub Marketplace and pinned by commit SHA or release tag.](docs/development/release-channels/github-actions.md)
 - [Per-platform mdsmith binaries plus the .vsix, the checksum file, and a Sigstore signature, attached to a tag-named release.](docs/development/release-channels/github-releases.md)
 - [`go install` compiles mdsmith from the tagged module source with the host Go 1.25+ toolchain; no prebuilt binary is downloaded.](docs/development/release-channels/go.md)
 - [The `jeduden/homebrew-mdsmith` tap installs the checksum-verified prebuilt binary for macOS or Linux on Intel or arm64.](docs/development/release-channels/homebrew.md)
diff --git a/action.yml b/action.yml
@@ -82,7 +82,12 @@ runs:
 
         # Verify the download against the release checksums file. macOS runners
         # have shasum but not GNU sha256sum, so fall back to it.
-        expected="$(grep " ${asset}\$" "${dest}/checksums.txt" | awk '{print $1}' | head -n1)"
+        # Pull the expected hash for our asset. Match the filename as the last
+        # field, tolerating the binary-mode "*" prefix, and stop at the first
+        # match. awk exits 0 even on no match, so the empty check below still
+        # runs — a grep | head pipeline would trip pipefail + set -e first and
+        # skip the friendly error.
+        expected="$(awk -v a="$asset" '{n = $NF; sub(/^\*/, "", n); if (n == a) {print $1; exit}}' "${dest}/checksums.txt")"
         if [ -z "$expected" ]; then
           echo "::error::${asset} not listed in checksums.txt"
           exit 1
@@ -101,13 +106,19 @@ runs:
         mv "${dest}/${asset}" "${dest}/${bin}"
         chmod +x "${dest}/${bin}"
         echo "$dest" >> "$GITHUB_PATH"
-        echo "version=$("${dest}/${bin}" version)" >> "$GITHUB_OUTPUT"
+        # Multiline-safe write, in case `mdsmith version` ever prints more
+        # than the single line it prints today.
+        {
+          echo "version<<__MDS_EOF__"
+          "${dest}/${bin}" version
+          echo "__MDS_EOF__"
+        } >> "$GITHUB_OUTPUT"
 
     - if: ${{ inputs.args != '' }}
       shell: bash
       working-directory: ${{ inputs.working-directory }}
       env:
         MDSMITH_ARGS: ${{ inputs.args }}
-      # MDSMITH_ARGS is intentionally unquoted so "check ." splits into
-      # separate arguments.
+      # MDSMITH_ARGS is intentionally unquoted so the shell word-splits it
+      # into separate arguments (and expands any globs), e.g. "check .".
       run: mdsmith $MDSMITH_ARGS
diff --git a/docs/development/release-channels/github-actions.md b/docs/development/release-channels/github-actions.md
@@ -4,11 +4,11 @@ summary: >-
   A composite action at the repository root downloads the
   checksum-verified release binary for the runner's OS and
   architecture and puts `mdsmith` on `PATH`; published to
-  the GitHub Marketplace and referenced as
-  `uses: jeduden/mdsmith@v0`.
+  the GitHub Marketplace and pinned by commit SHA or
+  release tag.
 mechanism: push
 artifact: cli
-command: "uses: jeduden/mdsmith@v0"
+command: "uses: jeduden/mdsmith@v0.41.0"
 audience: Linting Markdown inside GitHub Actions CI
 platforms: [linux, macos, windows]
 registry: github.com/marketplace
@@ -56,11 +56,10 @@ one output, `version`, the string `mdsmith version` prints.
 Pin `uses:` to a full-length commit SHA for the strongest
 guarantee: a SHA can never move. mdsmith publishes
 immutable releases, so a release-tag pin like `@v0.41.0`
-is a safe, reproducible alternative. Only the floating
-`@v0` tag moves by design. GitHub recommends the SHA form,
-and this repository uses it for every third-party action.
-Keep the version in a trailing comment, as `# v0.41.0`
-above.
+is a safe, reproducible alternative. GitHub recommends the
+SHA form, and this repository uses it for every
+third-party action. Keep the version in a trailing
+comment, as `# v0.41.0` above.
 
 The action still verifies the downloaded binary's SHA-256
 against the release `checksums.txt`. So the action and the
@@ -77,12 +76,9 @@ maintainer accepts the Marketplace Developer Agreement and
 enables it on a release. A unique action `name` and
 `branding` are required; `action.yml` sets both.
 
-A `marketplace-major-tag` workflow runs on each published
-release. It moves the `@v0` major tag onto that release, so
-`uses: jeduden/mdsmith@v0` tracks the latest 0.x build. The
-first release that ships this `action.yml` makes the listing
-and `@v0` resolve. Until then, pin to a commit SHA on
-`main`.
+The first release that ships this `action.yml` makes the
+Marketplace listing and its release tags resolve. Until
+then, pin to a commit SHA on `main`.
 
 You can also skip the action entirely. Run the release
 binary in a `run:` step. That repeats by hand the download
