CI: pre-release claims gate and weekly README-pin check

.claims-latest.json

@@ -0,0 +1,5 @@
+{
+  "claims": [
+    {"id": "action pins in the README equal the newest release", "file": "README.md", "regex": "node24-ready@v([0-9.]+)", "expect": {"latest_tag": "https://github.com/cosmichackerx/node24-ready"}}
+  ]
+}

.claims-release.json

@@ -0,0 +1,6 @@
+{
+  "claims": [
+    {"id": "action pins in the README equal the tag being released", "file": "README.md", "regex": "node24-ready@v([0-9.]+)", "expect": {"env": "RELEASE_TAG", "regex": "^v([0-9.]+)$"}},
+    {"id": "package version equals the tag being released", "file": "package.json", "regex": "\"version\": \"([0-9.]+)\"", "expect": {"env": "RELEASE_TAG", "regex": "^v([0-9.]+)$"}}
+  ]
+}

.github/workflows/ci.yml

@@ -11,7 +11,7 @@
 jobs:
   test:
     name: test (${{ matrix.os }}, node ${{ matrix.node }})
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
@@ -23,7 +23,7 @@
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
           cache: npm
       - run: npm ci
       - run: npm run typecheck
@@ -31,7 +31,7 @@
 
   claims:
     name: README claims (claims-check)
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
@@ -44,11 +44,11 @@
           cache: npm
       - run: npm ci
       - run: npm run build
-      - uses: cosmichackerx/claims-check@v0.1.0
+      - uses: cosmichackerx/claims-check@v0.2.0
 
   bundle:
     name: bundle is up to date
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -63,7 +63,7 @@
         run: git diff --exit-code -- action/index.mjs
 
   package:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -86,7 +86,7 @@
 
   dogfood:
     name: dogfood (this repo's workflows, live API)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -104,7 +104,7 @@
 
   action-selftest:
     name: action-selftest (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
@@ -141,7 +141,7 @@
 
   dependabot-gaps:
     name: dependabot-gaps (released action, consumer test)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/claims-latest.yml

@@ -0,0 +1,22 @@
+# Weekly: the README must pin the newest release of this repository (a stale pin tells readers to install an old version).
+name: README pins vs newest tag
+
+on:
+  schedule:
+    - cron: "17 5 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  pins:
+    name: README pins equal the newest tag
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: cosmichackerx/claims-check@v0.2.0
+        with:
+          config: .claims-latest.json

.github/workflows/release-gate.yml

@@ -0,0 +1,42 @@
+# Pre-release claims gate: the README, the package version and the tag being released must agree.
+# Run it by hand BEFORE tagging (Actions > Release gate > Run workflow, tag = v1.2.3), and it runs again on the tag.
+name: Release gate
+
+on:
+  workflow_call:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag you are about to create, for example v1.2.3 "
+        required: true
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  claims:
+    name: claims-check against the tag
+    runs-on: ubuntu-latest
+    env:
+      RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      - name: Tag looks like a version
+        run: |
+          case "$RELEASE_TAG" in v[0-9]*) ;; *) echo "RELEASE_TAG=$RELEASE_TAG is not a version tag (use v1.2.3 in the tag input)"; exit 1;; esac
+      - name: README numbers and pins hold
+        uses: cosmichackerx/claims-check@v0.2.0
+      - name: README pins and package version equal the tag being released
+        uses: cosmichackerx/claims-check@v0.2.0
+        with:
+          config: .claims-release.json

CONTRIBUTING.md

@@ -10,3 +10,4 @@ npm run bundle    # regenerate action/index.mjs; commit it with your change (CI
 * New findings need a rule id in `src/types.ts`, an entry in the README table and a test.
 * If you report a false positive or false negative, include the `uses:` line and the `runs.using` you see in that action's `action.yml`.
 * Keep the action free of other actions (`test/action-metadata.test.ts` enforces it).
+* Releasing: bump the version and the README pins in a PR, merge when green, then run **Actions > Release gate** with the new tag (for example `v1.2.3`) *before* you create the tag. The same check runs again on the tag, and a weekly job (`claims-latest.yml`) fails when the README pins an older release than the newest tag.