From 253afe646e2d090eb3b12f2929d602828632ef1b Mon Sep 17 00:00:00 2001 From: Jason Jackson Date: Fri, 10 Jul 2026 11:30:02 -0400 Subject: [PATCH] chore: pin action.yml to an image digest instead of :latest Previously action.yml always pulled ghcr.io/tvlsi/issueservice:latest regardless of which git ref/tag a consumer used, so @v1 was not an actual pin - any push to main (or the monthly rebuild) changed what every consumer ran, with no gate. Pins to the digest built from bb7f6fc (current main) so v1 becomes a real, immutable reference. Also updates the publish-image.yml usage recommendation from @main to @v1, with a note that future releases need a new digest bump. --- .github/workflows/publish-image.yml | 5 ++++- action.yml | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml index 7d19d6a..4c347bc 100644 --- a/.github/workflows/publish-image.yml +++ b/.github/workflows/publish-image.yml @@ -67,5 +67,8 @@ jobs: echo "" >> $GITHUB_STEP_SUMMARY echo "**Usage in workflows:**" >> $GITHUB_STEP_SUMMARY echo '```yaml' >> $GITHUB_STEP_SUMMARY - echo "- uses: TVLSI/IssueService@main" >> $GITHUB_STEP_SUMMARY + echo "- uses: TVLSI/IssueService@v1" >> $GITHUB_STEP_SUMMARY echo '```' >> $GITHUB_STEP_SUMMARY + echo "" >> $GITHUB_STEP_SUMMARY + echo "Note: action.yml on the v1 tag pins to an image digest, not :latest." >> $GITHUB_STEP_SUMMARY + echo "This build alone does not change what @v1 consumers run — cut a new release and update action.yml's digest to ship it." >> $GITHUB_STEP_SUMMARY diff --git a/action.yml b/action.yml index 241b10b..e3c9a76 100644 --- a/action.yml +++ b/action.yml @@ -17,6 +17,6 @@ outputs: runs: using: 'docker' - image: 'docker://ghcr.io/tvlsi/issueservice:latest' + image: 'docker://ghcr.io/tvlsi/issueservice@sha256:6e3e67b00cf996abf36109c934b376fd0b85955d0fa62bafc456f2b6dc9674fc' args: - ${{ inputs.issues_file }} \ No newline at end of file