Pin KSPBT actions within reusable workflows

From now on, release with `just release {{args}}` with the usual yaclog version args like `--patch` or `--minor`. It will automatically run `yaclog release` alongside updating all reusable workflows to have the correct tags. Pinning workflows to a branch (or leaving them unpinned) should be avoided from here on, only pin to tags.

The pin updating can be done on its own with `just pin-workflows {{ref}}`

Makes #67 unnecessary

commit 82828e9
Author: Andrew Cassidy <[email protected]>
Date:   Tue Oct 28 17:49:32 2025 -0700

    Add note to the docs

commit f70929c
Author: Andrew Cassidy <[email protected]>
Date:   Tue Oct 28 17:41:19 2025 -0700

    Only run checks for tag events

commit 108d8b8
Author: Andrew Cassidy <[email protected]>
Date:   Tue Oct 28 17:39:05 2025 -0700

    Check for mismatches

    this CI run should fail, I'll later restrict this check to only on tag pushes

commit bf2a436
Author: Andrew Cassidy <[email protected]>
Date:   Tue Oct 28 17:37:59 2025 -0700

    Fix regex

commit adb4c77
Author: Andrew Cassidy <[email protected]>
Date:   Tue Oct 28 17:35:22 2025 -0700

    Fix line endings

commit 0c99c7f
Author: Andrew Cassidy <[email protected]>
Date:   Tue Oct 28 17:21:15 2025 -0700

    run yaclog via uv

    this allows us to pin the version

commit 814ba63
Author: Andrew Cassidy <[email protected]>
Date:   Tue Oct 28 17:14:56 2025 -0700

    Add tool to pin workflows while releasing a new version

(cherry picked from commit 09427ed)

Author: drewcassidy

.github/workflows/.gitignore

@@ -0,0 +1 @@
+*.backup

.github/workflows/create-release.yml

@@ -64,7 +64,7 @@ jobs:
           submodules: true
 
       - name: update-version
-        uses: KSPModdingLibs/KSPBuildTools/.github/actions/update-version@main
+        uses: KSPModdingLibs/KSPBuildTools/.github/actions/update-version@0.0.4
         with:
           version-string: ${{ inputs.version-string }}
           template-extension: ${{ inputs.version-template-extension }}

.github/workflows/internal-ci.yml

@@ -27,6 +27,11 @@ jobs:
         with:
           fetch-depth: 0 # get full history, not shallow clone
 
+      - name: Check for workflows with outdated action pins
+        if: startsWith(github.ref, 'refs/tags')
+        run: |
+          ! grep -P -i 'uses: KSPModdingLibs/KSPBuildTools/\.github/actions/.*@(?!${{ github.ref_name }}$)' .github/workflows/*.yml
+
       - name: Setup .NET
         uses: actions/setup-dotnet@v4
         with:

.github/workflows/publish-to-spacedock.yml

@@ -1,47 +1,47 @@
-name: publish-to-spacedock
-
-on:
-  workflow_call:
-    inputs:
-      spacedock-username:
-        type: string
-        required: true
-        description: Spacedock login username
-      mod-id:
-        type: string
-        required: true
-        description: ID of the mod we are deploying. Get this from the end of your mod's spacedock URL
-      release-tag:
-        type: string
-        required: false
-        description: The tag of the release.  Will be the same as `inputs.release-tag` unless it was blank.
-      game-id:
-        type: string
-        required: false
-        default: '3102' # hardcoded to KSP1 gameid.  retrieve from https://spacedock.info/api/games
-        description: ID of the game we are deploying for. This should probably be left as-is for KSP 1.
-    secrets:
-      spacedock-password:
-        required: true
-        description: Spacedock login password. Store this as a secret!
-
-jobs:
-  publish-to-spacedock:
-    runs-on: ubuntu-22.04
-    steps:
-      - name: get-release-info
-        id: get-release-info
-        uses: KSPModdingLibs/KSPBuildTools/.github/actions/[email protected]
-        with:
-          release-tag: ${{ inputs.release-tag }}
-
-      - name: upload-to-spacedock
-        uses: KSP2Community/[email protected]
-        with:
-          username: ${{ inputs.spacedock-username }}
-          password: ${{ secrets.spacedock-password }}
-          game_id: ${{ inputs.game-id }}
-          mod_id: ${{ inputs.mod-id }}
-          version: ${{ steps.get-release-info.outputs.version-string }}
-          zipball: ${{ steps.get-release-info.outputs.artifact-file }}
-          changelog: ${{ steps.get-release-info.outputs.changelog-file }}
+name: publish-to-spacedock
+
+on:
+  workflow_call:
+    inputs:
+      spacedock-username:
+        type: string
+        required: true
+        description: Spacedock login username
+      mod-id:
+        type: string
+        required: true
+        description: ID of the mod we are deploying. Get this from the end of your mod's spacedock URL
+      release-tag:
+        type: string
+        required: false
+        description: The tag of the release.  Will be the same as `inputs.release-tag` unless it was blank.
+      game-id:
+        type: string
+        required: false
+        default: '3102' # hardcoded to KSP1 gameid.  retrieve from https://spacedock.info/api/games
+        description: ID of the game we are deploying for. This should probably be left as-is for KSP 1.
+    secrets:
+      spacedock-password:
+        required: true
+        description: Spacedock login password. Store this as a secret!
+
+jobs:
+  publish-to-spacedock:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: get-release-info
+        id: get-release-info
+        uses: KSPModdingLibs/KSPBuildTools/.github/actions/[email protected]
+        with:
+          release-tag: ${{ inputs.release-tag }}
+
+      - name: upload-to-spacedock
+        uses: KSP2Community/[email protected]
+        with:
+          username: ${{ inputs.spacedock-username }}
+          password: ${{ secrets.spacedock-password }}
+          game_id: ${{ inputs.game-id }}
+          mod_id: ${{ inputs.mod-id }}
+          version: ${{ steps.get-release-info.outputs.version-string }}
+          zipball: ${{ steps.get-release-info.outputs.artifact-file }}
+          changelog: ${{ steps.get-release-info.outputs.changelog-file }}

.gitignore

@@ -5,3 +5,9 @@ obj
 
 # docs
 docs/_build
+
+# misc
+.DS_Store
+.idea
+*.user
+*.backup

docs/workflows/index.md

@@ -4,6 +4,10 @@ KSPBuildTools provides several reusable workflows for use with Github Actions. T
 
 For usage, see [Reusing Workflows](https://docs.github.com/en/actions/sharing-automations/reusing-workflows) in the Github docs.
 
+```{warning}
+Due to a limitation of Github actions, only *tagged releases* have reusable workflows with the correct action version. If you pin a workflow to a branch, or leave your workflow usage unpinned, it may run action versions incompatible with the workflow
+```
+
 ```{toctree}
 ---
 caption: Contents

justfile

@@ -0,0 +1,15 @@
+set shell:= ['bash', '-c']
+yaclog:= "uv tool run [email protected]"
+
+pin-workflows tag:
+   sed -E -H -i ".backup" "s|(uses: KSPModdingLibs/KSPBuildTools/\.github/actions/\S+@)\S+|\1{{tag}}|g" .github/workflows/*.yml
+
+release *args:
+  {{yaclog}} release {{args}}
+  @just pin-workflows $({{yaclog}} show --version)
+  git add .github/workflows/*.yml
+  {{yaclog}} release -c
+
+docs:
+  uv run --with-requirements docs/requirements.txt --no-project -m sphinx docs/ docs/_build
+