v1.3.1

The reusable workflow's pin guard works. v1.3.0's guard read github.job_workflow_ref, which a step never sees, so the first real call failed before either script ran. The guard now compares github.job_workflow_sha, the commit the workflow executes at, with the commit the member's pinned tag resolves to on this repository; it fails with its own message on a mismatch, on a tag that does not exist and on a runner that exposes no commit. It proves the workflow's commit is the pinned release's commit; it cannot see how the caller spelled the ref, so a member calls it at the tag conventions.json names.

Nothing vendored changed apart from the version in the block's first line, so a member on v1.3.0 moves the tag in conventions.json and in uses: to v1.3.1 and runs sync once. A member still on v1.2.0 runs sync twice this once, as the v1.3.0 notes say.

To take it, from a repository's root, then add the workflow the README shows and require conventions / conventions in the ruleset:

printf '{ "repo": "robertblust/conventions", "tag": "v1.3.1" }\n' > conventions.json
curl -fsSL https://raw.githubusercontent.com/robertblust/conventions/v1.3.1/conventions/conventions-sync -o /tmp/conventions-sync
sh /tmp/conventions-sync sync