From e439e867672d66bd52ea42e441754a613c8b7b2a Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Fri, 13 Nov 2026 16:39:23 -0500 Subject: [PATCH] Pin the shared Go release workflow to v1.0.0 release.yml calls simtabi/.github's go-release.yml at 767e0c0, its v1.0.0 release (simtabi/.github#31), written as @ # v1.0.0 so Dependabot can advance the commit and the tag comment together. v1.0.0 changes only the shared repository's docs and tests since the previous pin. --- .github/workflows/release.yml | 2 +- CHANGELOG.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0503b18..56524a8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -39,7 +39,7 @@ jobs: contents: write id-token: write attestations: write - uses: simtabi/.github/.github/workflows/go-release.yml@d648d8998f95a351001979f9c4527badca588bf1 # simtabi/.github#30 + uses: simtabi/.github/.github/workflows/go-release.yml@767e0c01251dbbfc695d03dfdd73db48733e852e # v1.0.0 with: tag: ${{ inputs.tag || github.ref_name }} go-version-file: .go-version diff --git a/CHANGELOG.md b/CHANGELOG.md index ed32aba..aadfa2e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,7 +8,7 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ### Changed -- `release.yml` calls simtabi/.github's shared `go-release.yml` at `d648d89` (simtabi/.github#30), its latest commit, which adds an optional `node-version` input and changes nothing a caller passes. +- `release.yml` calls simtabi/.github's shared `go-release.yml` at its `v1.0.0` release (`767e0c0`), pinned as `@ # v1.0.0` so Dependabot can advance the commit and the tag comment together. The release adds optional inputs only (`node-version` among them) and changes nothing a caller passes. - `make check-build` asserts how many files it inspected in `build/`, not only that nothing is out of place: `make build` passes a floor of 2 (`targets.txt` and the binary) and `make cross` and `make dist` one per target plus `targets.txt` and `checksums.txt`, through `BUILD_LAYOUT_MIN`, so a check that reads an empty or wrong directory fails instead of passing. - Building probaci needs Go 1.26, and CI runs on it. Go 1.25 has ten standard-library vulnerabilities fixed only in 1.26, which the web UI's `net/http` server reaches; `golang.org/x/net`