From a63765a4bae6d4b61cc54e31dbfb51f2decd1b2a Mon Sep 17 00:00:00 2001 From: melbinjp Date: Tue, 1 Sep 2026 15:47:47 +0530 Subject: [PATCH] Pin docproof by commit, which is what its own README tells adopters to do Dependabot opened #44 to move this from v0.1.1 to v0.2.2. Two things are wrong with taking it. It is already stale, because docproof is on v0.2.4. And moving between tags is the practice docproof's README argues against, in its own words: a tag is movable, so whoever controls that repository can change what @v0.2.4 means without a diff for anyone to review. Azul's maintainer raised exactly that against docproof itself, and it was fixed there. This repository was still on a tag while the tool it runs tells everyone else not to be. That is the shape of defect docproof exists to find, in the repository that runs it. Pinned to 5798f6a, which is what v0.2.4 resolves to today, with the tag in a trailing comment so a reader can see which release it is. Measured before bumping, not assumed: docproof v0.2.4 on this tree reports 126 claims checked and nothing contradicted, judging 15 of 17 documentation files. --- .github/workflows/docs-check.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docs-check.yml b/.github/workflows/docs-check.yml index 5f66d44..5bdd1f1 100644 --- a/.github/workflows/docs-check.yml +++ b/.github/workflows/docs-check.yml @@ -49,6 +49,15 @@ jobs: # each report 112 claims checked and nothing contradicted on this tree. The seven # commits between them are precision work on other corpora plus the name fix, so this # is hygiene rather than a fix, and saying otherwise would be inventing a win. - - uses: melbinjp/docproof@v0.1.1 + # + # **Pinned to a commit rather than a tag, 2026-09-01.** docproof's own README tells + # adopters to do this, and gives the reason: a tag is movable, so whoever controls the + # repository can change what `@v0.2.4` means without a diff for anyone to review. That + # is the same supply-chain hole azul's maintainer raised against docproof itself. This + # repository was still on a tag, and Dependabot's habit of moving between tags is the + # thing the advice exists to stop. The SHA below is what `v0.2.4` resolved to: + # + # git ls-remote https://github.com/melbinjp/docproof refs/tags/v0.2.4 + - uses: melbinjp/docproof@5798f6ac3c0b0aec739c4da135cc6b6c45c96fe5 # v0.2.4 with: show-skips: 'true'