[felickz]

Summary

• Replace the unusable Patch Release Me 0.6.6 action reference with the published 0.6.7 container image.
• Pin the OCI image-index digest and pass the bump mode through the Docker action args input.
• Document returning to the repository action after [Security]: Docker action SHA does not pin runtime image digest 42ByteLabs/patch-release-me#169 is resolved.

Why

The 0.6.6 container image was never published. Version 0.6.7 restores the image and fixes mode argument handling.

Using docker://...:0.6.7@sha256:... also pins the executed container bytes. The repository action is not used yet because its Dockerfile still references a mutable image tag.

Validation

• Parsed the updated workflow as YAML.
• Ran git diff --check.
• Resolved the 0.6.7 OCI image-index digest with docker buildx imagetools inspect.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 0c8ebfe.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

• .github/workflows/release.yml

[Copilot]

Copilot review overview

Review tier: Lite
Findings: None

What changed in this PR

This PR updates the release workflow to use a digest-pinned container image for Patch Release Me, avoiding an unusable action reference and ensuring the exact bytes executed are immutable.

Changes:

• Switch the “Patch Release Me” step from a repository action ref to docker://ghcr.io/...:0.6.7@sha256:... (digest-pinned).
• Pass the bump mode via the Docker action args input instead of the action mode input.
• Add a TODO + link documenting when it’s safe to switch back to the upstream repository action.

File	Description
.github/​workflows/​release.yml	Updates Patch Release Me invocation to a digest-pinned OCI image and routes bump mode via args.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[felickz]

The Build and Compile Extractor Pack workflow failed twice in extractor tests unrelated to this workflow-only change.

Both runs reported the same database-schema incompatibility while importing existing YAML test fixtures:

The DB scheme does not contain an entry for the relation yaml_comments

The failures are in the OpenAPI, Helm, and CloudFormation library tests. This PR changes only .github/workflows/release.yml; its CodeQL, dependency review, markdown, labeler, and license checks passed.