v1.0.0

First tagged release. The actions here have built production images for eight repositories since November 2025; this is the point where that gets a version number.

Pin to this release

Reference the commit SHA, with the tag as a trailing comment:

uses: pubky/ci-workflows/.github/actions/docker/build_and_push@e6d3b38b5ebfa97b86595cb44f3a86695e473b09 # v1.0.0

Not @v1.0.0, and not @main. A tag is a name its owner can move; a SHA is not. The comment is what makes the line readable and what Dependabot reads to compute bumps.

@main continues to work and is unchanged in behaviour, but it means you receive every future change the moment it merges, without review.

What is in it

• The five docker/* actions are pinned to commit SHAs at their current major, so this release runs byte-identical upstream code to what @main ran before it
• build_and_push no longer references a sibling action at @main; get_head_commit_hash is inlined, so pinning this release pins the whole chain
• 11 shell interpolations of ${{ inputs.* }} moved into env: blocks
• zizmor runs on every pull request and blocks the merge; results upload to the Security tab
• Smoke tests build a real image through build_and_push on linux/amd64 and linux/amd64,linux/arm64 on every pull request
• Dependabot raises action bumps weekly, with a 7-day cooldown

Deprecated

docker/get_head_commit_hash — build_and_push now resolves the commit hash itself. The action still works and is still supported; it has three remaining callers in pubky-app and pubky-stack.

Refs pubky/pubky-stack#281