Skip to content

Strengthen guidelines for action version checking #365

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
knoepfel merged 1 commit into from
Feb 25, 2026
Merged

Strengthen guidelines for action version checking #365

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions .amazonq/rules/memory-bank/guidelines.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,11 +310,13 @@
**CRITICAL: Always Verify Against Official Sources:**

- When specifying external software versions or commit hashes (e.g., GitHub Actions, dependencies), ALWAYS verify against the official release source
- First, check what the LATEST version is from the project's releases page (e.g., `https://github.com/owner/repo/releases`)
- Then verify the hash for that latest version at the specific release tag page (e.g., `https://github.com/owner/repo/releases/tag/vX.Y.Z`)
- **FIRST: Check existing workflows in `.github/workflows/` for the current version used in the repository**
- **SECOND: Verify if a newer version exists at the official releases page** (e.g., `https://github.com/owner/repo/releases`)
- Then verify the hash for that version at the specific release tag page (e.g., `https://github.com/owner/repo/releases/tag/vX.Y.Z`)
- The authoritative source ALWAYS takes precedence over training data
- Training data may be outdated or incorrect - never trust it for version/hash information without verification
- Example: For `actions/setup-node`, first check `https://github.com/actions/setup-node/releases` for latest version, then verify hash at the specific tag page
- **When creating new workflows, use the LATEST version from existing workflows unless there's a specific reason to upgrade**
- Example: For `actions/setup-node`, check existing workflows first, then verify at `https://github.com/actions/setup-node/releases` if considering an upgrade

### Comment Guidelines

Expand Down
Loading