From ff5119d4fcb9064fc7a08b985deaa75ad8b5aa6f Mon Sep 17 00:00:00 2001
From: Jimisola Laursen <jimisola@jimisola.com>
Date: Sun, 23 Aug 2026 23:29:02 +0200
Subject: [PATCH] chore(github-actions): pin reqstool/.github references to
 1.0.0

Replaces a mix of @main and @<sha> # main <date> with a single shape:
@<sha> # 1.0.0, against reqstool/.github's first tag.

@main is mutable, so CodeQL's actions/unpinned-tag flags it and any
change to the shared workflows reaches this repo with no review -- which
bit twice this week while the PyPI publish path was being fixed. A bare
tag would still be mutable; the sha-with-version-comment form satisfies
the pinning audits while letting Renovate track the digest and rewrite
the comment, so the pin does not rot.

Implements reqstool/.github#25.

Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>
---
 .github/workflows/build-docs.yml        | 2 +-
 .github/workflows/build.yml             | 8 ++++----
 .github/workflows/check-semantic-pr.yml | 2 +-
 .github/workflows/release.yml           | 8 ++++----
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml
index 675a55b..9bcdaea 100644
--- a/.github/workflows/build-docs.yml
+++ b/.github/workflows/build-docs.yml
@@ -15,4 +15,4 @@ permissions:
 
 jobs:
   build:
-    uses: reqstool/.github/.github/workflows/common-build-docs.yml@main
+    uses: reqstool/.github/.github/workflows/common-build-docs.yml@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 398c2df..cd85bdd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -62,17 +62,17 @@ jobs:
             -Dreqstool.datasetPath=docs/reqstool \
             -Dreqstool.outputDirectory=target/reqstool
       - name: Install reqstool
-        uses: reqstool/.github/.github/actions/install-reqstool@9c6feaab046f4782f430dd2527fdb82c2a5cd926 # main 2026-06-22
+        uses: reqstool/.github/.github/actions/install-reqstool@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0
         with:
           reqstool-source: ${{ matrix.reqstool-source }}
       - name: Validate reqstool spec completeness
         # not yet available in the latest PyPI release
         if: matrix.reqstool-source == 'main'
-        uses: reqstool/.github/.github/actions/validate-reqstool@9c6feaab046f4782f430dd2527fdb82c2a5cd926 # main 2026-06-22
+        uses: reqstool/.github/.github/actions/validate-reqstool@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0
       - name: Run reqstool status
-        uses: reqstool/.github/.github/actions/reqstool-status@9c6feaab046f4782f430dd2527fdb82c2a5cd926 # main 2026-06-22
+        uses: reqstool/.github/.github/actions/reqstool-status@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0
         with:
           fail-if-incomplete: "true"
 
   validate-openspec:
-    uses: reqstool/.github/.github/workflows/common-validate-openspec.yml@9c6feaab046f4782f430dd2527fdb82c2a5cd926 # main 2026-06-22
+    uses: reqstool/.github/.github/workflows/common-validate-openspec.yml@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0
diff --git a/.github/workflows/check-semantic-pr.yml b/.github/workflows/check-semantic-pr.yml
index d2bd380..cbfc98d 100644
--- a/.github/workflows/check-semantic-pr.yml
+++ b/.github/workflows/check-semantic-pr.yml
@@ -12,4 +12,4 @@ permissions:
 
 jobs:
   check:
-    uses: reqstool/.github/.github/workflows/common-check-semantic-pr.yml@main
+    uses: reqstool/.github/.github/workflows/common-check-semantic-pr.yml@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 83c765d..ec6636d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -41,7 +41,7 @@ permissions:
 
 jobs:
   prepare:
-    uses: reqstool/.github/.github/workflows/common-release-prepare.yml@main
+    uses: reqstool/.github/.github/workflows/common-release-prepare.yml@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0
     permissions:
       contents: read
     with:
@@ -67,7 +67,7 @@ jobs:
   tag:
     needs: [prepare, checks]
     if: ${{ !inputs.dry-run }}
-    uses: reqstool/.github/.github/workflows/common-release-tag.yml@main
+    uses: reqstool/.github/.github/workflows/common-release-tag.yml@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0
     permissions:
       contents: write
     with:
@@ -80,7 +80,7 @@ jobs:
   # `version` makes a disagreement a hard stop before anything reaches Central.
   publish-to-maven-central:
     needs: [prepare, tag]
-    uses: reqstool/.github/.github/workflows/java-publish-to-maven.yml@main
+    uses: reqstool/.github/.github/workflows/java-publish-to-maven.yml@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0
     permissions:
       contents: read
       packages: write
@@ -106,7 +106,7 @@ jobs:
   promote:
     needs: [prepare, publish-to-maven-central]
     if: ${{ !inputs.dry-run && !cancelled() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }}
-    uses: reqstool/.github/.github/workflows/common-release-promote.yml@main
+    uses: reqstool/.github/.github/workflows/common-release-promote.yml@ef815eae0bca7160cdc714126cac73f76d638b39 # 1.0.0
     permissions:
       contents: write
     with: