Proof Check Action v0.1.1

Repair release. v0.1.0 failed when consumed from another repository: the Action read its own commit reference through runner-owned GITHUB_* variables, which a composite action cannot set. This release passes the reference through application-owned variables (PROOF_CHECK_ACTION_REF, PROOF_CHECK_ACTION_REPOSITORY) and keeps the same validation: the reference must be a full 40-character commit, and a repository-local uses: ./ is accepted only when the action directory is the workflow workspace.

Verified from a separate consumer workflow at this commit: PASS, receipt bound to the exact consumer head, offline proof-check verify VERIFIED, exit 0.

Usage (pin by full commit; a tag such as @v0.1.1 is refused by design):

- uses: deedseal/proof-check@363aad91142a01df6e5d72a87495d2f09be28823
  with:
    policy: proof-check-policy.json
    receipt: proof-check-receipt.json

Permissions: contents: read, pull-requests: read, checks: read, statuses: read. The Action creates no workflow, check, comment, label, review, or merge. Verdicts, reason codes and the receipt schema are unchanged from v0.1.0; see docs/contract/.

Do not use v0.1.0 from another repository; it fails before invoking the CLI.

Proof Check Action v0.1.0

Superseded by v0.1.1: this version fails when used from another repository. Use v0.1.1 or later.

Known defect: the Action read its own commit reference through runner-owned GITHUB_* variables, which a composite action cannot set, so when consumed from a different repository it stopped before invoking the CLI. Fixed in PR #9; released as v0.1.1 at commit 363aad9.

Kept for the record. Verdicts, reason codes, receipt schema and the CLI itself are unchanged between v0.1.0 and v0.1.1; only the Action wrapper differs.

Original notes:

First tagged release of the Proof Check GitHub Action and CLI. For one pull request at one exact commit, checks whether the changed paths stay inside the scope the change declared, and whether the evidence is complete enough to say so. The answer is one of three words: PASS, FAIL, or INDETERMINATE. Every run writes a JSON receipt (proof-check-receipt/v1) that can be verified offline with proof-check verify. Rules in v0: exactly one FAIL rule, SCOPE_ESCAPE. Missing, incomplete, or ambiguous evidence returns INDETERMINATE and fails the job rather than guessing green. Contract: docs/contract/. Schemas: schemas/. Public fixture plan: fixtures/README.md.