From b90cdd451f198c61b47c5facb286cd79c1b06371 Mon Sep 17 00:00:00 2001
From: Coysh <tim@timcoysh.co.uk>
Date: Sun, 9 Aug 2026 08:57:58 +0100
Subject: [PATCH] ci: pin workflow actions to commits rather than tags

actions/checkout@v4 and shivammathur/setup-php@v2 are moving references.
Whoever controls those repositories can point them at different code
without the tag changing, and this package is the signing contract two
other packages resolve against - so the job deciding whether a change to
it is sound is a job worth knowing the contents of.

platform and manager-restore already pin these same two commits. This
brings the last one into line.

The run reaches little - contents: read, no secrets beyond GITHUB_TOKEN,
no pull_request_target, nothing published - which bounds the exposure
rather than excusing it.

No wire change: no schema, canonical string, signature or fixture moved,
and the committed signing fixtures still verify. Version moves because
1.8.0 is tagged.
---
 .github/workflows/ci.yml |  4 ++--
 CHANGELOG.md             | 17 +++++++++++++++++
 composer.json            |  2 +-
 src/Protocol.php         |  2 +-
 4 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9dd08c8..1570e65 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,9 +28,9 @@ jobs:
         php: ['8.2', '8.3', '8.4']
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: ${{ matrix.php }}
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 82382b3..c650399 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,23 @@ This package is the wire contract between the Manager platform and the connector
 A change here is a change to what a site may send, so every entry says what was added and - more
 usefully - what was deliberately left out of it.
 
+## 1.8.1 - 2026-08-09
+
+No wire change. No schema, canonical string, signature or fixture moved, so this is interchangeable
+with 1.8.0 on either side of the protocol.
+
+### Build
+
+- **CI pins its actions to commits rather than to tags.** `actions/checkout@v4` and
+  `shivammathur/setup-php@v2` are moving references - whoever controls those repositories can point
+  them at different code without the tag changing. This package is the signing contract two other
+  packages resolve against, so the job that decides whether a change to it is sound is a job worth
+  knowing the contents of. `platform` and `manager-restore` already pin these same two commits; this
+  brings the last one into line.
+
+  The run reaches little - `contents: read`, no secrets beyond `GITHUB_TOKEN`, no
+  `pull_request_target`, nothing published - which bounds it rather than excusing it.
+
 ## 1.8.0 - 2026-08-07
 
 Add-only. No existing schema, canonical string, signature or fixture moved, so a 1.7.1 platform and a
diff --git a/composer.json b/composer.json
index 79b6fb0..a6b78d6 100644
--- a/composer.json
+++ b/composer.json
@@ -1,7 +1,7 @@
 {
     "name": "coysh-digital/manager-protocol",
     "description": "Wire contract shared by the Manager platform and the Manager Connector for Craft CMS.",
-    "version": "1.8.0",
+    "version": "1.8.1",
     "type": "library",
     "license": "MIT",
     "keywords": [
diff --git a/src/Protocol.php b/src/Protocol.php
index f4729a8..4042cb9 100644
--- a/src/Protocol.php
+++ b/src/Protocol.php
@@ -22,7 +22,7 @@ final class Protocol
     /**
      * @var string Package version. Independent of the platform and connector versions.
      */
-    public const VERSION = '1.8.0';
+    public const VERSION = '1.8.1';
 
     /**
      * @var string Prefix on the canonical string a connector signs.