From 3aecd9f841021e8835115beefbd25284bb78353b Mon Sep 17 00:00:00 2001
From: Chad Bentz <1760475+felickz@users.noreply.github.com>
Date: Fri, 28 Aug 2026 19:03:19 -0400
Subject: [PATCH] ci: use digest-pinned Patch Release Me 0.6.7

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/update-codeql-version.yml | 28 ++++-----------------
 .github/workflows/update-release.yml        | 27 ++++----------------
 2 files changed, 10 insertions(+), 45 deletions(-)

diff --git a/.github/workflows/update-codeql-version.yml b/.github/workflows/update-codeql-version.yml
index e9da474b..2602f94b 100644
--- a/.github/workflows/update-codeql-version.yml
+++ b/.github/workflows/update-codeql-version.yml
@@ -136,29 +136,11 @@ jobs:
 
       - name: Bump release version (optional)
         if: steps.release_bump.outputs.bump != ''
-        run: |
-          set -euo pipefail
-          # Invoke the pinned patch-release-me image directly via `docker run`
-          # instead of `uses: 42ByteLabs/patch-release-me@...`. That action's own
-          # action.yml builds its Docker CMD as a single YAML list item
-          # (`-m "${{ inputs.mode }}"`); Docker container actions don't go
-          # through a shell, so the literal quote characters end up baked into
-          # ONE argv token (`-m "minor"`). clap can't match that against
-          # "patch"/"minor"/"major" and silently falls back to its own default
-          # (Patch) - meaning `minor`/`major` have always quietly produced a
-          # patch bump instead (confirmed via a local repro: see PR history).
-          # Running the same pinned image ourselves via a normal shell `run:`
-          # step naturally splits `-m` and the mode value into separate argv
-          # entries, avoiding the bug entirely.
-          #
-          # Pinned by digest (not just tag) so the exact image content can't
-          # change out from under us - digest corresponds to the 0.6.5 tag.
-          docker run --rm \
-            --user "$(id -u):$(id -g)" \
-            -v "${{ github.workspace }}:/repo" \
-            -w /repo \
-            ghcr.io/42bytelabs/patch-release-me@sha256:d9d7abe7051855d0c395fec99d931acc002fb6b299ca16b8123e2c8ef0c7e750 \
-            --disable-banner bump -m ${{ steps.release_bump.outputs.bump }}
+        # TODO: Return to the upstream action after its runtime image is digest-pinned:
+        # https://github.com/42ByteLabs/patch-release-me/issues/169
+        uses: docker://ghcr.io/42bytelabs/patch-release-me:0.6.7@sha256:b9624359ce08707dfb4d22bcbf9d1a75f7f4718ccec610ddaa62280ffea98958
+        with:
+          args: --disable-banner bump -m ${{ steps.release_bump.outputs.bump }}
 
       - name: Set release prerelease flag (optional)
         if: steps.release_bump.outputs.bump != ''
diff --git a/.github/workflows/update-release.yml b/.github/workflows/update-release.yml
index be8affda..2f8df454 100644
--- a/.github/workflows/update-release.yml
+++ b/.github/workflows/update-release.yml
@@ -36,28 +36,11 @@ jobs:
           private-key: ${{ secrets.SECLABS_APP_KEY }}
 
       - name: "Patch Release Me"
-        run: |
-          set -euo pipefail
-          # Invoke the pinned patch-release-me image directly via `docker run`
-          # instead of `uses: 42ByteLabs/patch-release-me@...`. That action's own
-          # action.yml builds its Docker CMD as a single YAML list item
-          # (`-m "${{ inputs.mode }}"`); Docker container actions don't go
-          # through a shell, so the literal quote characters end up baked into
-          # ONE argv token (`-m "minor"`). clap can't match that against
-          # "patch"/"minor"/"major" and silently falls back to its own default
-          # (Patch) - meaning `minor`/`major` have always quietly produced a
-          # patch bump instead (confirmed via a local repro: see PR history).
-          # Running the same pinned image ourselves via a normal shell `run:`
-          # step naturally splits `-m` and the mode value into separate argv
-          # entries, avoiding the bug entirely.
-          # Pinned by digest (not just tag) so the exact image content can't
-          # change out from under us - digest corresponds to the 0.6.5 tag.
-          docker run --rm \
-            --user "$(id -u):$(id -g)" \
-            -v "${{ github.workspace }}:/repo" \
-            -w /repo \
-            ghcr.io/42bytelabs/patch-release-me@sha256:d9d7abe7051855d0c395fec99d931acc002fb6b299ca16b8123e2c8ef0c7e750 \
-            --disable-banner bump -m ${{ inputs.mode }}
+        # TODO: Return to the upstream action after its runtime image is digest-pinned:
+        # https://github.com/42ByteLabs/patch-release-me/issues/169
+        uses: docker://ghcr.io/42bytelabs/patch-release-me:0.6.7@sha256:b9624359ce08707dfb4d22bcbf9d1a75f7f4718ccec610ddaa62280ffea98958
+        with:
+          args: --disable-banner bump -m ${{ inputs.mode }}
 
       - name: Determine new release version
         id: release_version