docs: record run-vociferate nested path fix

CHANGELOG.md

@@ -41,6 +41,7 @@ A `### Breaking` section is used in addition to Keep a Changelog's standard sect
 - Restored explicit gosec caching by storing a pinned `v2.22.4` binary under `${{ runner.temp }}/gosec-bin` with `actions/cache@v4`, so CI keeps fast security scans while still using the Go 1.26 toolchain from `setup-go`.
 - Replaced `securego/gosec` composite action with a direct `go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4 && gosec ./...` run step so gosec uses the Go 1.26 toolchain installed by `setup-go` rather than the action's bundled Go 1.24 binary which ignores `GOTOOLCHAIN=auto`.
 - Fixed nested local composite-action references to use repository-local `./run-vociferate` paths so strict runners do not misparse parent-directory (`../`) action references as malformed remote coordinates.
+- Fixed `run-vociferate` nested action calls to use explicit repo-root paths (`./run-vociferate/binary` and `./run-vociferate/code`) because strict runners resolve local action paths from repository root rather than from the current composite action directory.
 
 ## [1.0.2] - 2026-03-21
 

run-vociferate/action.yml

@@ -66,7 +66,7 @@ runs:
     - name: Run binary
       id: run-binary
       if: steps.resolve-runtime.outputs.use_binary == 'true'
-      uses: ./binary
+      uses: ./run-vociferate/binary
       with:
         root: ${{ inputs.root }}
         version-file: ${{ inputs.version-file }}
@@ -81,7 +81,7 @@ runs:
     - name: Run source
       id: run-code
       if: steps.resolve-runtime.outputs.use_binary != 'true'
-      uses: ./code
+      uses: ./run-vociferate/code
       with:
         root: ${{ inputs.root }}
         version-file: ${{ inputs.version-file }}