Skip to content

v1.0.3

Latest
Marketplace
Latest
Marketplace

Choose a tag to compare

View all tags
@nerdalytics nerdalytics released this 20 Apr 22:49
v1.0.3
This tag was signed with the committer’s verified signature.
nerdalytics
SSH Key Fingerprint: SMO3d7ktK6TMcFg3Mt7ELtxpAm+y3yJ3rwy8Aco9Xx0
Verified
Learn about vigilant mode.
11a5116
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Docs

Full README overhaul. No behavior changes.

  • Quickstart now SHA-pins the action itself, matching the form this action writes for every other entry in consumer workflow files and satisfying any repo or organization enforcing SHA-pinning on uses: references.
  • Updating the pin: new dedicated section explaining how to resolve the commit SHA for the latest release (GitHub UI and gh CLI one-liner).
  • GPG setup: complete caller-side YAML example. Notes that the GPG path is implemented but not yet validated end-to-end in production.
  • Troubleshooting: headings now match real log output. New entry for the org-policy error ("Actions must be pinned to a full-length commit SHA").
  • Versioning: simplified to exact semver releases. The floating v1 tag has been retired; consumers should pin by commit SHA as described in Quickstart.
  • Removed the "Security design notes" section (the framing was confusing; the useful content is implicit elsewhere).
  • Brand-voice pass throughout: shorter sentences, fewer em dashes, less marketing cadence.

Consumer impact

For repos already pinned to v1.0.2's SHA: the next scheduled run of this action opens a PR rewriting the pin to v1.0.3's SHA and comment. No manual action needed.

For new consumers: see Quickstart in the new README.

Assets 2
Loading