Version the shared Go release workflow by tag

go-release/README.md

@@ -7,13 +7,22 @@ nowhere else. The standard it implements is `~/.claude/rules/go.md`, *Go release
 ## Using it
 
 Copy [`templates/go/release.yml`](../templates/go/release.yml) to the repository's
-`.github/workflows/release.yml` and pin the `uses:` line to a commit of this repository. It runs on:
+`.github/workflows/release.yml` and pin the `uses:` line to the commit of this repository's latest
+`vX.Y.Z` tag, with the version as the comment: `go-release.yml@<commit>  # vX.Y.Z`. It runs on:
 
 - a pushed `vX.Y.Z` or `vX.Y.Z-pre` tag: `git push origin vX.Y.Z`;
 - a request naming a tag already on GitHub: `gh workflow run release.yml --repo OWNER/REPO -f tag=vX.Y.Z`.
 
 Push a version tag only for final code: tags are final, and a pushed tag publishes.
 
+## Versions
+
+This repository tags each change to the shared workflow as a release (`v1.0.0` on 2026-11-13 is the
+first), and tags are final: a fix gets the next version. A caller pins
+the tag's commit with a `# vX.Y.Z` comment, which is the form Dependabot's github-actions updater
+recognises: it opens a pull request moving the commit and the comment together when a new tag appears.
+A pin to a bare commit, or a comment that names a pull request, is never updated by Dependabot.
+
 ## Inputs
 
 | Input | Default | What it is |

go-release/tests/test_go_release.py

@@ -112,6 +112,9 @@ def test_it_runs_on_a_version_tag_or_on_request(self):
     def test_a_dispatch_names_the_tag(self):
         self.assertRegex(self.text, r"workflow_dispatch:\n    inputs:\n      tag:")
 
+    def test_it_says_how_to_pin_a_version(self):
+        self.assertRegex(self.text, r"# replace with @<commit>  # vX\.Y\.Z when copying")
+
     def test_it_calls_the_shared_workflow(self):
         self.assertIn("uses: simtabi/.github/.github/workflows/go-release.yml@", self.text)
         for perm in ("contents: write", "id-token: write", "attestations: write"):

templates/go/release.yml

@@ -35,6 +35,8 @@ jobs:
       contents: write
       id-token: write
       attestations: write
-    uses: simtabi/.github/.github/workflows/go-release.yml@main  # pin to a commit when copying
+    # Pin to the commit of the latest vX.Y.Z tag of simtabi/.github, with that version as the comment
+    # (`@<commit>  # vX.Y.Z`): Dependabot's github-actions updater then moves both together.
+    uses: simtabi/.github/.github/workflows/go-release.yml@main  # replace with @<commit>  # vX.Y.Z when copying
     with:
       tag: ${{ inputs.tag || github.ref_name }}