From 12354c3d98308de6f49acd7d69b478e073102c94 Mon Sep 17 00:00:00 2001
From: Chad Bentz <1760475+felickz@users.noreply.github.com>
Date: Fri, 10 Jul 2026 16:02:17 -0400
Subject: [PATCH] fix(release): repin patch-release-me to 0.6.5 - 0.6.6's GHCR
 image was never published

42ByteLabs/patch-release-me's 0.6.6 git tag/release exists (published
2026-05-25), but its container image was never pushed to ghcr.io -
confirmed via anonymous registry query (ghcr.io/v2/42bytelabs/patch-release-me/tags/list)
showing only 0.6.5 and earlier tags actually exist. This broke both
update-release.yml and the new release_bump step in
update-codeql-version.yml, both of which pinned the 0.6.6 commit SHA -
every run failed at 'Build 42ByteLabs/patch-release-me@...' with
'ghcr.io/42bytelabs/patch-release-me:0.6.6: not found'.

Repinned both workflows to 0.6.5's commit SHA. action.yml is byte-identical
between 0.6.5 and 0.6.6 (confirmed via GitHub API blob SHA comparison), so
this is a safe, no-behavior-change repin.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/update-codeql-version.yml | 2 +-
 .github/workflows/update-release.yml        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/update-codeql-version.yml b/.github/workflows/update-codeql-version.yml
index 45890b9d..7c8612af 100644
--- a/.github/workflows/update-codeql-version.yml
+++ b/.github/workflows/update-codeql-version.yml
@@ -109,7 +109,7 @@ jobs:
 
       - name: Bump release version (optional)
         if: steps.release_bump.outputs.bump != ''
-        uses: 42ByteLabs/patch-release-me@04ea0a696abfc3cfbdfadb279bd9c9dd0b1652a2 # 0.6.6
+        uses: 42ByteLabs/patch-release-me@431a82795eda94d09b3821da9391c53ab287e84d # 0.6.5 (0.6.6's ghcr.io image was never published; action.yml is byte-identical between the two)
         with:
           mode: ${{ steps.release_bump.outputs.bump }}
 
diff --git a/.github/workflows/update-release.yml b/.github/workflows/update-release.yml
index 4c87e269..4358008c 100644
--- a/.github/workflows/update-release.yml
+++ b/.github/workflows/update-release.yml
@@ -31,7 +31,7 @@ jobs:
           private-key: ${{ secrets.SECLABS_APP_KEY }}
 
       - name: "Patch Release Me"
-        uses: 42ByteLabs/patch-release-me@04ea0a696abfc3cfbdfadb279bd9c9dd0b1652a2 # 0.6.6
+        uses: 42ByteLabs/patch-release-me@431a82795eda94d09b3821da9391c53ab287e84d # 0.6.5 (0.6.6's ghcr.io image was never published; see https://github.com/42ByteLabs/patch-release-me/issues - action.yml is byte-identical between the two)
         with:
           # Bump (patch)
           mode: ${{ inputs.mode }}