Repository navigation
fix(ci): avoid artifact download deprecation - #5
Merged
Merged
Conversation
myagentdojo
added a commit
that referenced
this pull request
Aug 10, 2026
* docs(ce-work): checkpoint selected implementation plan * feat(hooks): add dependency-free lifecycle hook sidecar (U1) * feat(plugin): package capability tour, hook declarations, and branded identity (U2) * feat(proofs): bind package and release proofs to exact candidate sidecars (U3) * docs(qualification): document capability tour and bind evidence envelope to candidate lineage (U4) * refactor(proofs): share hook declaration contract and clean-commit resolution * fix(review): apply findings #1 #5 #6 #7 #10 from capability tour review * fix(review): resolve capability tour bot findings * fix(review): close final capability findings * fix(review): preserve encoded display names * test(review): bound hostile payload suite * fix(hooks): fail open on escaped Stop guards * fix(review): resolve current-head feedback (#34) * fix(packaging): make USTAR bytes platform-independent * fix(hooks): reject invalid UTF-8 Stop input --------- Co-authored-by: Nathan Vale <hi@nathanvale.com>
myagentdojo
added a commit
that referenced
this pull request
Aug 14, 2026
#45) * docs(ce-work): checkpoint selected implementation plan * refactor(release): add release-workflow parity ledger and fail-closed parse coverage * refactor(release): navigate release workflow structurally via parsed YAML * refactor(release): migrate workflow assertions to ledger-backed structural tiers * test(release): guard mutation anchors against silent no-op mutations * refactor(release): restore scoped publish-mutation diagnostic and drop unused navigation helper * fix(review): apply findings #2 #5 #6 #3 - pin job-level uses, restore scoped diagnostics, prove comparators * fix(review): apply finding #1 - extract release-workflow parity subsystem into its own module * Address PR review feedback (#45) - Restrict the action-pin SHA requirement to external references so repository-local `uses: ./...` actions stay valid, matching the base validator's regex scope - Require every actions/checkout step to carry the pinned ref and persist-credentials, not only the first match - Pin the parity ledger test to the three valid tier values * Address PR review feedback (#45) - Isolate the duplicate-checkout mutation to the pinned ref by adding persist-credentials, and assert the specific checkout-ref message so the test proves why the workflow is rejected --------- Co-authored-by: Nathan Vale <hi@nathanvale.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The latest Node 24 download-artifact action still emits DEP0005 while unpacking the attestation input.
Replace that action with the GitHub CLI already present on hosted runners. The attestation job still downloads the exact artifact produced by the package job.
Proof: