v1.3.2

The reusable workflow's guard no longer asks the runner anything. On a cross-repository call, a step of the called workflow sees neither github.job_workflow_ref nor github.job_workflow_sha, which is why v1.3.0 and v1.3.1 failed before either script ran. The workflow now declares its own release in a workflow-level CONVENTIONS_RELEASE, set at release time like the version in the block's first line, and the guard compares that with the tag in conventions.json. A test in the source fails when the two declarations disagree, so a release cannot ship with the wrong one. It cannot see how the caller spelled the ref: a member calls it at the tag conventions.json names, and a call at a branch gets whatever that branch declares.

Nothing vendored changed apart from the version in the block's first line. A member on v1.3.1 or v1.3.0 moves the tag in conventions.json and in uses: to v1.3.2 and runs sync once; a member still on v1.2.0 runs sync twice this once, as the v1.3.0 notes say.

To take it, from a repository's root, then add the workflow the README shows and require conventions / conventions in the ruleset:

printf '{ "repo": "robertblust/conventions", "tag": "v1.3.2" }\n' > conventions.json
curl -fsSL https://raw.githubusercontent.com/robertblust/conventions/v1.3.2/conventions/conventions-sync -o /tmp/conventions-sync
sh /tmp/conventions-sync sync