From cfa6469d38983634c342e26617c768748265b7a8 Mon Sep 17 00:00:00 2001 From: Steve Dudenhoeffer Date: Sun, 28 Jun 2026 00:04:36 -0400 Subject: [PATCH] ci: track gadfly's v1 release tag instead of a pinned sha MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Switch uses: steve/gadfly/.gitea/workflows/review-reusable.yml from a sha pin (@b02b11d) to the moving @v1 release tag, so central swarm tuning propagates without re-pinning this file each time. Tradeoff: v1 is mutable (re-moved on deliberate releases), vs a sha which is immutable — accepted to cut re-pin churn. Co-Authored-By: Claude Opus 4.8 (1M context) --- .gitea/workflows/adversarial-review.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/adversarial-review.yml b/.gitea/workflows/adversarial-review.yml index 4d78060..f3b87ec 100644 --- a/.gitea/workflows/adversarial-review.yml +++ b/.gitea/workflows/adversarial-review.yml @@ -38,9 +38,10 @@ jobs: && (github.actor == 'steve' || github.actor == 'fizi' || github.actor == 'dazed')) - # Pinned to an immutable gadfly commit (not @main): a push to gadfly can't - # silently change the code that runs with our forwarded secrets. - uses: steve/gadfly/.gitea/workflows/review-reusable.yml@b02b11d69139843665da4cdbf776bc0b3583490d + # Tracks gadfly's v1 release tag — a curated pointer re-moved on each release + # (unlike @main, which moves on every push). Central swarm tuning propagates + # here automatically; the tradeoff vs a full sha pin is that v1 is mutable. + uses: steve/gadfly/.gitea/workflows/review-reusable.yml@v1 # Least privilege: forward only the review secrets (not `secrets: inherit`, # which would expose every repo secret). GITEA_TOKEN is the automatic token. secrets: -- 2.52.0