Repair release. v0.1.0 failed when consumed from another repository: the Action read its own commit reference through runner-owned GITHUB_* variables, which a composite action cannot set. This release passes the reference through application-owned variables (PROOF_CHECK_ACTION_REF, PROOF_CHECK_ACTION_REPOSITORY) and keeps the same validation: the reference must be a full 40-character commit, and a repository-local uses: ./ is accepted only when the action directory is the workflow workspace.
Verified from a separate consumer workflow at this commit: PASS, receipt bound to the exact consumer head, offline proof-check verify VERIFIED, exit 0.
Usage (pin by full commit; a tag such as @v0.1.1 is refused by design):
- uses: deedseal/proof-check@363aad91142a01df6e5d72a87495d2f09be28823
with:
policy: proof-check-policy.json
receipt: proof-check-receipt.json
Permissions: contents: read, pull-requests: read, checks: read, statuses: read. The Action creates no workflow, check, comment, label, review, or merge. Verdicts, reason codes and the receipt schema are unchanged from v0.1.0; see docs/contract/.
Do not use v0.1.0 from another repository; it fails before invoking the CLI.