From 21b542faa99d35d1b962966e9c270fa656c0547b Mon Sep 17 00:00:00 2001
From: ci <ci@gitea.512.dev>
Date: Sat, 5 Sep 2026 16:41:29 +0000
Subject: [PATCH] Published from yuki-talos action/pin-digest

---
 action.yml | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 action.yml

diff --git a/action.yml b/action.yml
new file mode 100644
index 0000000..625cb84
--- /dev/null
+++ b/action.yml
@@ -0,0 +1,25 @@
+# ══════════════════════════════════════════════════════════════════
+#  BREAKING CHANGE? BUMP THE MAJOR IN cue/cluster/cluster.cue
+# ══════════════════════════════════════════════════════════════════
+# Everything pinning `@v1` gets this the moment it publishes. A change
+# a consumer cannot absorb needs a new major, or it breaks them.
+# ══════════════════════════════════════════════════════════════════
+
+name: pin-digest
+description: Open a pull request moving every action's pinned toolbox digest to a newly built image.
+
+inputs:
+  image:
+    description: The image to pin, as name@sha256:digest. Pass build-image's `image` output.
+    required: true
+
+runs:
+  using: docker
+
+  # By digest, like every other action. This one runs in the image it is about
+  # to replace, which is what makes it work at all.
+  image: docker://gitea.512.dev/ci/toolbox@sha256:b854a995771816ba81a49656d246aab6c2688fe4a3490be6edc81487baa5f1cb
+
+  entrypoint: /usr/local/lib/actions/pin-digest.sh
+  env:
+    PLUGIN_IMAGE: ${{ inputs.image }}