docs: note the macOS 13 minimum in the README - #31
Merged
Merged
Conversation
Package.swift declares platforms: [.macOS(.v13)] but the README never said so, leaving the requirement discoverable only by reading the manifest or hitting a build failure. This change is also the vehicle for verifying the v3 float (smartwatermelon/github-workflows v3 -> v3.3.0, e6e2643): this repo calls both bumped reusable workflows on @V3, so opening a PR exercises claude-code-action 1.0.219 on a real run before ~24 repos rely on it. Claude-Session: https://claude.ai/code/session_014Xei4nFGe48rE4vryi64Yx
twistedmelonman
pushed a commit
to nightowlstudiollc/.github
that referenced
this pull request
Sep 18, 2026
Replaces immutable pins on smartwatermelon/github-workflows reusable workflows with the floating tags they already correspond to: @v3.2.1 / @v3.1.1 / @688e0288... -> @V3 @054f2f7f... -> @dependabot-auto-merge-v2 No behaviour change at merge time for auto-merge: @dependabot-auto-merge-v2 points at 054f2f7f today, so that ref is byte-equivalent. Refs moving to @V3 go from 688e0288 to e6e2643, which is two claude-code-action SHA bumps (1.0.193 -> 1.0.219) with no logic change; both bumped steps already carry continue-on-error: true. That move was exercised green on smartwatermelon/swift-progress-indicator#31 and again on nightowlstudiollc/financial-agent#187, both through claude-blocking-review.yml. claude-assistant.yml takes the same bump but only fires on @claude mentions, so it is unexercised -- same action, same bump, low risk, but not verified. Why this matters: an immutable ref cannot carry a fix published after it was cut. When GHSA-8q5r-mmjf-575q was patched upstream, the fix reached consumers by repointing one tag, and the repos pinned to an exact version silently received nothing. Floating first-party refs is sanctioned policy -- github-workflows/zizmor.yml:45-54 grants smartwatermelon/github-workflows/*: ref-pin while keeping "*": hash-pin for third-party actions. Any stale trailing comment is dropped with the pin it annotated. A comment is not a pin, and several had already drifted from the SHA beside them. Verified: zizmor clean on every changed file against the fleet policy. Claude-Session: https://claude.ai/code/session_01PTUKVrdfDTU3ZH149e9pTY
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Package.swift:6declaresplatforms: [.macOS(.v13)], but the README never stated the requirement — discoverable only by reading the manifest or hitting a build failure.Also: verifying the
v3floatThis PR doubles as the verification step for floating
smartwatermelon/github-workflows'sv3tag from688e0288(2026-08-20) toe6e2643, cut asv3.3.0. That move bringsanthropics/claude-code-actionfrom 1.0.193 to 1.0.219 for every caller on@v3.This repo was chosen because it calls both bumped reusable workflows on
@v3:.github/workflows/claude.yml→claude-assistant.yml@v3.github/workflows/claude-blocking-review.yml→claude-blocking-review.yml@v3~24 repos resolve
@v3, so a break would hit all of them at once. The point is to prove 1.0.219 runs green on one low-stakes repo before anything relies on it.Rollback if this run fails:
v3.2.1still points at688e0288.https://claude.ai/code/session_014Xei4nFGe48rE4vryi64Yx