From 928fd785d6344aedd8bff39e60731fcdcf1c52f3 Mon Sep 17 00:00:00 2001
From: "John C. Bland II" <johncblandii@gmail.com>
Date: Thu, 13 Aug 2026 12:04:00 -0500
Subject: [PATCH 1/2] chore: upgrade actions to Node 24 runtime (SHA-pinned)

---
 .github/workflows/build.yml               | 6 +++---
 .github/workflows/validate-codeowners.yml | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2713b8b..2d7f4ae 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -30,13 +30,13 @@ jobs:
     steps:
       # Checkout the repo
       - name: 'Checkout'
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       # Setup Go
       - name: 'Setup Go'
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
 
@@ -46,7 +46,7 @@ jobs:
       # Trial build
       - name: Test build
         if: github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && github.ref_name != 'main')
-        uses: goreleaser/goreleaser-action@v5
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
           distribution: goreleaser
           version: latest
diff --git a/.github/workflows/validate-codeowners.yml b/.github/workflows/validate-codeowners.yml
index d97f0ce..70f5d21 100644
--- a/.github/workflows/validate-codeowners.yml
+++ b/.github/workflows/validate-codeowners.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: "Checkout source code at current commit"
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # Leave pinned at 0.7.1 until https://github.com/mszostok/codeowners-validator/issues/173 is resolved
     - uses: mszostok/codeowners-validator@v0.7.1
       if: github.event.pull_request.head.repo.full_name == github.repository

From dae3958d52babd43015cc133d9ab5da224880cf9 Mon Sep 17 00:00:00 2001
From: "John C. Bland II" <johncblandii@gmail.com>
Date: Thu, 13 Aug 2026 12:42:45 -0500
Subject: [PATCH 2/2] fix: migrate goreleaser config to v2 schema

goreleaser-action v7 installs GoReleaser v2 via 'version: latest',
which rejects v1-era configs (missing version key, changelog.skip).
---
 .goreleaser.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.goreleaser.yml b/.goreleaser.yml
index 0de5d4c..25de4df 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -1,3 +1,5 @@
+version: 2
+
 # Visit https://goreleaser.com for documentation on how to customize this behavior.
 
 #before:
@@ -29,7 +31,7 @@ builds:
       - '-s -w'
 
 archives:
-  - format: binary
+  - formats: [binary]
     name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}'
 
 checksum:
@@ -50,4 +52,4 @@ release:
 ## ----- DO NOT CHANGE ----- ##
 
 changelog:
-  skip: true
+  disable: true