ci(prose-body): repin to the release that has it

[michen00]

Both prose-body workflows have failed on every run since they landed in #85 — six consecutive failures — because v0.4.0 does not contain the reusable workflows they call.

What went wrong

I read unwrap-pr-body-check.yml and unwrap-pr-body.yml from the default branch (gh api contents/... with no ?ref=), then pinned @v0.4.0 because that was the newest release, and never checked the files were in it. They are not:

ref	unwrap-pr-body-check.yml
v0.4.0 (then-latest release)	absent
v0.3.0	absent
main	present

The upstream README makes that easy to walk into: its PR-body section uses @v0.4.0 in every example, but the v0.4.0 README does not mention those workflows at all — 0 occurrences there against 3 on main. They were unreleased, documented as released.

Why nothing caught it

A reusable workflow that cannot be resolved fails the run before any job starts. A run with no jobs contributes no check run, so the failures never appeared on any pull request — including #85, the one that added them, which went through full review convergence with two bot reviewers. They were visible only in the Actions tab.

That is the part worth recording, and both files now carry it: jobs=0 is the signature, and "the workflow stopped failing" is not the same evidence as "the workflow ran".

The fix

v0.5.0 is the first release carrying them. Verified at the tag rather than inferred from it being newest:

• both files present at v0.5.0;
• neither declares a required input, so the input-less calls here stay valid;
• unwrap-pr-body-check.yml still accepts pull_request_target, which prose-body.yml relies on for fork coverage;
• unwrap-pr-body.yml still requires pull_request_target, which prose-body-write.yml uses;
• neither contains actions/checkout — the property that makes handing pull_request_target a writable token safe here. That was verified against main when the trigger was chosen; it has now been re-verified at the ref that actually runs.

Test plan

actionlint clean, yamllint clean, make check green.

The real check is post-merge and is deliberately not "no longer red": prose-body.yml triggers on pull_request_target for synchronize and edited, so the next push to an open PR should produce a run reaching jobs≥1. A run that merely stops failing while still reporting jobs=0 would mean the pin is still unresolvable.

prose-body-write.yml takes effect only from main, since pull_request_target reads the workflow from the default branch — so it cannot be exercised by this PR.

Not included

The .pre-commit-config.yaml hook pin (markdown-prose-hooks-py, currently v0.4.0) is left alone. The v0.5.0 mirror tag exists, but pre-commit.ci autoupdate maintains that pin on its own schedule and bumping it here would collide with its next PR. That hook has been working throughout — it is a separate mechanism from the reusable workflows.

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.57%. Comparing base (c08c96c) to head (1159e88).

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #89      +/-   ##
==========================================
+ Coverage   51.52%   51.57%   +0.04%     
==========================================
  Files          31       31              
  Lines        2092     2092              
==========================================
+ Hits         1078     1079       +1     
+ Misses       1014     1013       -1     

Flag	Coverage Δ
integration	0.97% <ø> (ø)
unit	50.98% <ø> (+0.04%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

PR Summary by Qodo

Repin prose-body workflows to available v0.5.0 definitions

🐞 Bug fix ⚙️ Configuration changes 📝 Documentation 🕐 Less than 10 minutes

AI Description

• Repins both prose-body workflows to the first release containing their definitions.
• Documents why workflow refs require file verification and how zero-job failures evade PR checks.

Diagram

graph TD
  E["PR Events"] --> C["Prose Check"] --> R["Check Workflow v0.5.0"] --> P["PR Comment"]
  E --> W["Prose Rewrite"] --> U["Rewrite Workflow v0.5.0"] --> B["PR Body"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Pin immutable commit SHAs

• ➕ Prevents a moved release tag from changing executed workflow code
• ➕ Provides stronger supply-chain guarantees for privileged pull_request_target workflows
• ➖ Obscures the upstream release version without an accompanying comment
• ➖ Requires separate tooling or manual work to discover and apply upgrades

Recommendation: The verified v0.5.0 release pin is the best scoped repair because it restores both workflows while preserving readable release-based dependency management. An immutable SHA pin would strengthen supply-chain integrity, but should be adopted consistently across GitHub Actions dependencies rather than introduced only for these two calls.

Files changed (2) +13 / -2

Bug fix (2) +13 / -2

prose-body-write.ymlRepin the prose-body rewrite workflow to v0.5.0 +4/-1

Repin the prose-body rewrite workflow to v0.5.0

• Changes the reusable rewrite workflow reference from v0.4.0, where the workflow is absent, to v0.5.0. Adds context identifying v0.5.0 as the first release containing the definition.

.github/workflows/prose-body-write.yml

prose-body.ymlRepin the prose-body check workflow to v0.5.0 +9/-1

Repin the prose-body check workflow to v0.5.0

• Changes the reusable reporting workflow reference from v0.4.0 to the verified v0.5.0 release. Documents how unresolved reusable workflows fail before creating jobs and therefore remain invisible on pull requests.

.github/workflows/prose-body.yml

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.57%. Comparing base (c08c96c) to head (1c16c11).

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #89      +/-   ##
==========================================
+ Coverage   51.52%   51.57%   +0.04%     
==========================================
  Files          31       31              
  Lines        2092     2092              
==========================================
+ Hits         1078     1079       +1     
+ Misses       1014     1013       -1     

Flag	Coverage Δ
integration	0.97% <ø> (ø)
unit	50.98% <ø> (+0.04%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.