fix: repair SHA-pinned Action resolution and Code Scanning

.github/workflows/action-smoke.yml

@@ -32,7 +32,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          test "$(./target/release/agentcontext --version)" = "agentcontext 0.2.2"
+          test "$(./target/release/agentcontext --version)" = "agentcontext 0.2.3"
 
       - name: Create instruction fixture
         shell: bash

.github/workflows/code-scanning.yml

@@ -21,9 +21,17 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
+        with:
+          toolchain: stable
+
+      - name: Build current AgentContextMap
+        run: cargo build --release --locked
+
       - name: Generate AgentContextMap SARIF
         id: agentcontext
-        uses: BLCCoreStudio/AgentContextMap@866757c427415040f9697d582c10e17b060e3415 # v0.2.0
+        uses: ./
         with:
           path: .
           sarif: agentcontext.sarif

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "agentcontextmap"
-version = "0.2.2"
+version = "0.2.3"
 edition = "2021"
 rust-version = "1.74"
 description = "Map repository instructions that can affect coding agents."

action-entrypoint.sh

@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-readonly AGENTCONTEXT_FALLBACK_TAG="v0.1.0"
 readonly AGENTCONTEXT_ASSET="agentcontext-linux-x86_64"
 
 action_ref="${AGENTCONTEXT_ACTION_REF:-}"
@@ -18,7 +17,13 @@ if [[ -z "$action_ref" ]]; then
 elif [[ "$action_ref" =~ ^v[0-9]+(\.[0-9]+){0,2}(-[0-9A-Za-z.-]+)?$ ]]; then
   AGENTCONTEXT_TAG="$action_ref"
 else
-  AGENTCONTEXT_TAG="$AGENTCONTEXT_FALLBACK_TAG"
+  [[ -n "${GITHUB_ACTION_PATH:-}" ]] \
+    || { printf 'AgentContextMap Action: cannot resolve a non-tag Action ref without GITHUB_ACTION_PATH.\n' >&2; exit 1; }
+  action_version="$(sed -n 's/^version = "\([0-9][0-9.]*\)"/\1/p' "${GITHUB_ACTION_PATH}/Cargo.toml" | head -n1)"
+  [[ "$action_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] \
+    || { printf 'AgentContextMap Action: could not resolve the release version from Cargo.toml.\n' >&2; exit 1; }
+  AGENTCONTEXT_TAG="v${action_version}"
+  printf 'AgentContextMap Action: resolved ref %s to release %s.\n' "$action_ref" "$AGENTCONTEXT_TAG"
 fi
 
 fail() {