From 6ab1b8bbb59d500f33e89d3d7a9b5bd0a009c998 Mon Sep 17 00:00:00 2001
From: PabloCodes7 <pablocodes7@users.noreply.github.com>
Date: Tue, 14 Jul 2026 07:51:58 +0200
Subject: [PATCH] ci: keep the v1 tag on the latest tested commit

Everyone pins patchrail/ci-triage-action@v1, but CI only ever tested the
commit. The tag had fallen two commits behind main, so the guide-slug guard
added in #3 was validating code that no user actually runs.

Move v1 to each main commit that passes both jobs, and document in the README
that v1 floats within the v1 line (with SHA pinning as the alternative).
---
 .github/workflows/test.yml | 22 ++++++++++++++++++++++
 README.md                  | 11 +++++++++++
 2 files changed, 33 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5062e64..efcbdc5 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -51,3 +51,25 @@ jobs:
             https://getpatchrail.com/fix*) echo "OK" ;;
             *) echo "unexpected guide-url"; exit 1 ;;
           esac
+
+  # Everyone uses `patchrail/ci-triage-action@v1`, but the jobs above test the
+  # commit, not the tag. Without this the two drift apart in silence: a merged
+  # fix stays invisible to every user while CI keeps reporting green. Move the
+  # floating tag to each main commit that passed both jobs, so `@v1` is always
+  # the newest tested code.
+  sync-v1:
+    needs: [fix-guide-slugs, smoke]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Fast-forward the v1 tag to the tested commit
+        shell: bash
+        run: |
+          set -euo pipefail
+          git tag -f v1 "${GITHUB_SHA}"
+          git push --force origin refs/tags/v1
+          echo "v1 -> ${GITHUB_SHA}"
diff --git a/README.md b/README.md
index 2fd11fa..c22eeb9 100644
--- a/README.md
+++ b/README.md
@@ -34,6 +34,17 @@ step guarded by `if: failure()`. On a red run you get an annotation like
 `python-test-failure (confidence 0.89) — guide: getpatchrail.com/fix/...` plus a
 job summary block.
 
+### Which ref to pin
+
+`@v1` is a moving tag: it points at the latest commit on `main` that passed the
+test suite, and it will keep moving within the v1 line (no breaking changes to
+inputs or outputs). If you would rather review every change yourself, pin the
+full commit SHA instead:
+
+```yaml
+uses: patchrail/ci-triage-action@<commit-sha>
+```
+
 ## Inputs
 
 | Input | Default | Description |