fix: pin the runtime image by digest, not tag

.github/workflows/commitlint.yml

@@ -39,8 +39,24 @@ jobs:
           RESULTS: ${{ toJSON(steps.run_commitlint.outputs.results) }}
         run: echo "$RESULTS"
 
-  # Upstream also had a `commitlint-pulling-from-docker-hub` job that ran the
-  # action without rewriting action.yml, so it pulled whichever tag action.yml
-  # named. That can only pass once the image for that version is published, so
-  # it fails on every PR that bumps the version. The published image is smoke
-  # tested in publish-image.yml instead, where it exists.
+  # Runs the action as consumers do: no rewrite of action.yml, so this pulls
+  # the pinned digest from ghcr.io. Upstream's equivalent job pulled a version
+  # tag and so failed on every PR that bumped the version, before the image for
+  # it existed. A digest always refers to an image already published, so this
+  # is safe to run on every push and proves the digest reference resolves.
+  commitlint-from-published-image:
+    permissions:
+      contents: read
+      pull-requests: read
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '24.19.0'
+      - run: npm ci --ignore-scripts
+      - uses: ./
+        env:
+          NODE_PATH: ${{ github.workspace }}/node_modules

.github/workflows/publish-image.yml

@@ -62,3 +62,22 @@ jobs:
           echo "published image runs node $node_version"
           docker run --rm --entrypoint node "$IMAGE:$VERSION" \
             -e 'console.log("commitlint " + require("/node_modules/@commitlint/lint/package.json").version)'
+
+      # action.yml pins the image by digest, so every release has to report the
+      # digest it just published for action.yml to be updated to.
+      - name: Report digest for action.yml
+        env:
+          IMAGE: ghcr.io/${{ github.repository_owner }}/commitlint-github-action
+        run: |
+          set -euo pipefail
+          digest=$(docker image inspect --format '{{index .RepoDigests 0}}' "$IMAGE:$VERSION" | cut -d@ -f2)
+          echo "published digest: $digest"
+          {
+            echo "### Image published"
+            echo
+            echo '```'
+            echo "image: docker://$IMAGE@$digest"
+            echo '```'
+            echo
+            echo "Update \`action.yml\` to this digest if it is not already."
+          } >> "$GITHUB_STEP_SUMMARY"

action.yml

@@ -36,7 +36,10 @@ outputs:
     description: The error and warning messages for each one of the analyzed commits
 runs:
   using: docker
-  image: docker://ghcr.io/yo61/commitlint-github-action:6.3.0
+  # Pinned by digest, not tag: a tag is mutable, so pinning this action by
+  # commit SHA downstream would still leave the image swappable. This digest
+  # is the image published for v6.3.0.
+  image: docker://ghcr.io/yo61/commitlint-github-action@sha256:78d47699285290a64b68853ca36a6b3554955bda1d4d6c430a843817b0e1940a
 branding:
   icon: check-square
   color: blue