From 0fbd7641c0a66bd34dcbacb9087e5399cc8190e6 Mon Sep 17 00:00:00 2001 From: Micheal Wilkinson Date: Sat, 21 Mar 2026 15:29:37 +0000 Subject: [PATCH] docs: record run-vociferate nested path fix --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a8ab18b..62d9d71 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -41,6 +41,7 @@ A `### Breaking` section is used in addition to Keep a Changelog's standard sect - Restored explicit gosec caching by storing a pinned `v2.22.4` binary under `${{ runner.temp }}/gosec-bin` with `actions/cache@v4`, so CI keeps fast security scans while still using the Go 1.26 toolchain from `setup-go`. - Replaced `securego/gosec` composite action with a direct `go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4 && gosec ./...` run step so gosec uses the Go 1.26 toolchain installed by `setup-go` rather than the action's bundled Go 1.24 binary which ignores `GOTOOLCHAIN=auto`. - Fixed nested local composite-action references to use repository-local `./run-vociferate` paths so strict runners do not misparse parent-directory (`../`) action references as malformed remote coordinates. +- Fixed `run-vociferate` nested action calls to use explicit repo-root paths (`./run-vociferate/binary` and `./run-vociferate/code`) because strict runners resolve local action paths from repository root rather than from the current composite action directory. ## [1.0.2] - 2026-03-21