The v4.0.0 tag was changed after release

[sethmlarson]

The original v4.0.0 tag pointed to 3df4ab1. Later the v4.0.0 tag was changed to point to 1e31de5, which isn't a part of any branch on the actions/checkout repository so gives the same scary warning that GitHub gives for commits which aren't a part of a parent repository (ie, security issue):

Warning
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

I know this is true because we pin commit SHAs of our GitHub Actions along with the Dependabot version comment and are now seeing that the commit SHAs don't match their earlier values.

Due to the widespread usage of this action, it's concerning to me to see tags getting rewritten. It's not clear to me if these rewritten tags were on purpose or on accident. Obviously users should be pinning actions to commit SHAs instead of tags but it is likely that many users aren't pinning to commit SHAs.

Even when pinning to a commit SHA, this tag rewrite means users will be receiving concerning pull requests like this one: urllib3/urllib3#3243 and version information in the action won't be updated properly (arguably a bug in Dependabot).

In the future, instead of updating an existing tag can a new tag be created with whatever is the desired fix?

[cory-miller]

I'm sorry, this one is on me.

The original change to v4.0.0 did not include documentation updates which led to some questions. I updated the docs and tags so that the marketplace would reflect the new usage instructions. Because of how the marketplace works, creating a new tag does not fix the doc, so anyone using v4.0.0 would still have the old instructions. I think I should have left this as-is, and fielded the questions as they came in. I'm sorry for this mistake.

The next part I'm unsure what happened. The updated commit was part of this repo, but somehow the branch was deleted. I pushed a new branch and added extra branch protection rules so that the warning goes away.

In the future I'm going to update the release instructions so that the step to update the readme is not missed.

Again, I'm sorry for the confusion.

[sethmlarson]

@cory-miller Thank you for clarifying, I'm happy to hear that there will be some process improvements as a part of this. I think this issue can be closed now.