mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-12 01:27:32 +00:00
Johnathan Corgan
b3ecc1de4e
The pinning sweep was authored on the maintenance branch, so it only ever saw that branch's workflow files. This line carries package-freebsd.yml, which does not exist there, and a ci.yml job block that does not either, so nine references came through the merge still on mutable tags. The guard that landed with the sweep then did exactly what it is for and failed the branch. Those nine are now pinned in the same form, including the third-party FreeBSD VM action that executes the whole build inside an image it controls. Each SHA was resolved from the upstream peeled tag and checked back against it. The lesson is worth keeping with the guard rather than in a commit message: a checker authored on the earliest branch is only as complete as that branch's file set, and merging it upward gates files it has never swept.