Pin the Homebrew Releaser action to a commit

[joe4dev]

Motivation

Justintime50/homebrew-releaser@v3 does not pin anything. The v3 tag's own action.yml is:

runs:
  using: docker
  image: docker://justintime50/homebrew-releaser:4.0.0

So this workflow already runs 4.0.0 while the reference claims v3. A tag can be moved at any time, and this one has been — which makes the version in the workflow misleading rather than merely imprecise. Since the action publishes the tap on every release, whatever it runs is what ships to users.

Noticed while fixing the formula's lint problems in #57.

Solution

Pin to the commit the v4.0.0 tag points at, with the version as a trailing comment:

uses: Justintime50/homebrew-releaser@454cc0d45a99949c9ea0bd9f03e6309df1617628 # v4.0.0

A commit cannot be re-pointed, and the comment keeps the version readable.

Dependabot keeps it current. .github/dependabot.yml already covers github-actions weekly in the grouped update, and it has bumped this action before (#30, 1 → 2). For a SHA reference with a version comment, Dependabot rewrites both the SHA and the comment, so this stays on the same automatic cadence as the tags.

Why this is safe

The v3 and v4.0.0 tags declare the identical input set and the identical image:

	v3 tag	v4.0.0 tag
image	docker://justintime50/homebrew-releaser:4.0.0	docker://justintime50/homebrew-releaser:4.0.0
inputs	homebrew_owner … ignore_warnings (21)	same 21

So nothing about what runs changes. This only makes the reference honest and immutable.

Note

This becomes the only SHA-pinned action in the repo; build.yml uses major tags (actions/checkout@v7, softprops/action-gh-release@v3, and so on). I have left those alone to keep this PR to one thing. Pinning them too would be a reasonable follow-up — they carry the same "a tag can move" property, just without the current mismatch.

Review

Human review advised: it touches the release path, which cannot be exercised without publishing a release.

🤖 Generated with Claude Code