From 7e2bcf1b60b488a7ccf11f03ea8c53d7c79e311e Mon Sep 17 00:00:00 2001
From: lex00 <albert.a.artigues@gmail.com>
Date: Fri, 19 Jun 2026 08:22:03 -0600
Subject: [PATCH] fix(pipeline): version comment v1 -> v0.1.0 (warden is
 pre-1.0)

---
 src/emit/pipeline.test.ts | 6 +++---
 src/emit/pipeline.ts      | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/emit/pipeline.test.ts b/src/emit/pipeline.test.ts
index 7871435..c38227a 100644
--- a/src/emit/pipeline.test.ts
+++ b/src/emit/pipeline.test.ts
@@ -97,7 +97,7 @@ describe("governancePipeline", () => {
     const yaml = buildYaml();
     // Every `uses:` line must pin to a 40-char commit SHA.
     // The serializer wraps values with special chars in single quotes, and
-    // SHA-pinned warden steps include a `# v1` inline comment, so we strip
+    // SHA-pinned warden steps include a `# v0.1.0` inline comment, so we strip
     // trailing quote, whitespace, and any `# …` comment before matching.
     const SHA_RE = /^[a-f0-9]{40}$/;
     const usesLines = yaml
@@ -164,13 +164,13 @@ describe("governancePipeline", () => {
 
   // ── Dogfood: github-warden Action reference ────────────────────
 
-  test("warden steps use intentius/github-warden SHA-pinned with # v1 comment", () => {
+  test("warden steps use intentius/github-warden SHA-pinned with # v0.1.0 comment", () => {
     const yaml = buildYaml();
     // Both jobs should use the warden action pinned to the v1 commit SHA.
     // The serializer quotes the value (special chars), so look for the SHA
     // followed by the inline comment inside single quotes.
     expect(yaml).toContain(
-      "50db522e57c4ccdb36af932062ee38839bc1b88e # v1"
+      "50db522e57c4ccdb36af932062ee38839bc1b88e # v0.1.0"
     );
     // Two warden steps (dry-run + apply), each appear once.
     const count = (
diff --git a/src/emit/pipeline.ts b/src/emit/pipeline.ts
index 57d57ac..a2aac4f 100644
--- a/src/emit/pipeline.ts
+++ b/src/emit/pipeline.ts
@@ -40,7 +40,7 @@ const CHECKOUT_SHA = "11bd71901bbe5b1630ceea73d27597364c9af683";
  * intentius/github-warden v1
  * https://github.com/intentius/github-warden/releases/tag/v1
  *
- * SHA-pinned to satisfy GHA029. The `# v1` comment preserves human readability
+ * SHA-pinned to satisfy GHA029. The `# v0.1.0` comment preserves human readability
  * while preventing silent tag-repoint attacks. Warden's own audit (GHA021/029)
  * enforces this pattern — the emitted pipeline dogfoods it.
  */
@@ -165,7 +165,7 @@ export function governancePipeline(opts: GovernancePipelineOptions = {}) {
 
   const dryRunWardenStep = new Step({
     name: "Dry-run reconcile",
-    uses: `intentius/github-warden@${GITHUB_WARDEN_SHA} # v1`,
+    uses: `intentius/github-warden@${GITHUB_WARDEN_SHA} # v0.1.0`,
     with: {
       command: "reconcile",
       config: configPath,
@@ -212,7 +212,7 @@ export function governancePipeline(opts: GovernancePipelineOptions = {}) {
 
   const applyWardenStep = new Step({
     name: "Apply reconcile",
-    uses: `intentius/github-warden@${GITHUB_WARDEN_SHA} # v1`,
+    uses: `intentius/github-warden@${GITHUB_WARDEN_SHA} # v0.1.0`,
     with: {
       command: "reconcile",
       config: configPath,