ci: pin the platform harness to the released Core v0.2.5

Integration still fetched Core at PR #92's head (5e9433d): the right pin while that PR was in review, but it predates #94 (display credential renewal) and #93 (the registry move), both in v0.2.5. Signage now proves itself against the release it will run on. The pin contract also accepts a release tag (refs/tags/vX.Y.Z) alongside a pull request head or main, and the fetch compares the ref's commit (^{commit}) so an annotated tag pins the same way a lightweight one does. v0.2.5 is lightweight; that should not be a hidden requirement. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-14 00:05:15 -05:00
parent ba4821ec63
commit c1213dad08
4 changed files with 9 additions and 8 deletions
@@ -3,7 +3,7 @@ name: CI
 # Signage is a standalone repository: every job installs it with --frozen-lockfile from its own
 # pnpm-lock.yaml and takes Ekklesia's module-development packages (@ekklesia/*) from Ekklesia's
 # public package registry (.npmrc; platform ADRs 0053 and 0054). Only the integration job fetches
-# Core source: one immutable commit through the pinned Gitea pull ref in ci/platform.env, used as the
+# Core source: one immutable commit through the pinned Gitea ref in ci/platform.env, used as the
 # generic deployment harness and image source, never as a workspace dependency.
 #
 # The same trust rules as the platform's own CI (docs/development/security.md there):