From 58ccf3a6401774a3920c59cb883d67e2667bf84e Mon Sep 17 00:00:00 2001
From: royalpinto007 <royalpinto007@gmail.com>
Date: Fri, 7 Aug 2026 08:56:08 +0530
Subject: [PATCH 1/2] fix(action): reference a tag that exists

Both the README and the example workflow told consumers to use
AgentPostmortem/evalgate@v1. No v1 tag has ever existed, so the job
failed at 'Set up job' before running anything, and the workflow in this
repo has never once succeeded. Anyone copying the README snippet, which
explicitly invites them to, got the same broken run.

Points at @v0 instead. A moving major tag is the Actions convention, and
v0 is the honest one to publish while the package is 0.1.x: cutting v1
would advertise a stability guarantee this does not have yet.

Also tags v0.1.1 to match the version already on npm, which shipped
without a git tag.
---
 .github/workflows/evalgate.yml | 2 +-
 README.md                      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/evalgate.yml b/.github/workflows/evalgate.yml
index 185bfe5..3e3e42c 100644
--- a/.github/workflows/evalgate.yml
+++ b/.github/workflows/evalgate.yml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Gate on eval regressions
-        uses: AgentPostmortem/evalgate@v1
+        uses: AgentPostmortem/evalgate@v0
         with:
           suite: examples/support-agent.eval.yaml
           baseline: examples/support-agent.baseline.json
diff --git a/README.md b/README.md
index 4788820..6507b1a 100644
--- a/README.md
+++ b/README.md
@@ -171,7 +171,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: AgentPostmortem/evalgate@v1
+      - uses: AgentPostmortem/evalgate@v0
         with:
           suite: examples/support-agent.eval.yaml
           baseline: examples/support-agent.baseline.json

From 4f616ba07fbc11eea9f60b2ead62eb7f6060c14c Mon Sep 17 00:00:00 2001
From: royalpinto007 <royalpinto007@gmail.com>
Date: Fri, 7 Aug 2026 08:59:24 +0530
Subject: [PATCH 2/2] fix(action): install our own package, not a stranger's

action.yml ran 'npx --yes evalgate@latest'. Our package is published as
@royalpinto007/evalgate, so the unscoped name resolves to an unrelated
package owned by someone else, currently evalgate@3.2.0.

That is why the gate failed even once the tag resolved: the other
package requires Node >=22 and imports node:sqlite, so it crashed with
ERR_UNKNOWN_BUILTIN_MODULE on the Node 20 runner.

The more serious half is supply chain. This action is documented as
something to drop into any consuming repo, so every consumer's CI was
downloading and executing a third party package we do not control, under
their GITHUB_TOKEN.

The README already uses the scoped name everywhere. Only action.yml was
wrong.
---
 action.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/action.yml b/action.yml
index 9d24cfa..f08042a 100644
--- a/action.yml
+++ b/action.yml
@@ -57,7 +57,7 @@ runs:
         if [ "${{ inputs.comment }}" = "true" ]; then COMMENT_FLAG="--comment"; fi
 
         if [ -f "${{ inputs.baseline }}" ]; then
-          npx --yes evalgate@${{ inputs.version }} compare "${{ inputs.suite }}" \
+          npx --yes @royalpinto007/evalgate@${{ inputs.version }} compare "${{ inputs.suite }}" \
             --base "${{ inputs.baseline }}" \
             --provider "${{ inputs.provider }}" \
             --tolerance "${{ inputs.tolerance }}" \
@@ -65,7 +65,7 @@ runs:
             $MODEL_FLAG $COMMENT_FLAG
         else
           echo "No baseline at ${{ inputs.baseline }}; running the suite without a comparison."
-          npx --yes evalgate@${{ inputs.version }} run "${{ inputs.suite }}" \
+          npx --yes @royalpinto007/evalgate@${{ inputs.version }} run "${{ inputs.suite }}" \
             --provider "${{ inputs.provider }}" \
             --md evalgate-report.md \
             $MODEL_FLAG