From 3fb6b4b3556a4cd8c1811009957e90722109f9d3 Mon Sep 17 00:00:00 2001
From: Brian Gordon Davis <96969185+bgdnext64@users.noreply.github.com>
Date: Wed, 15 Jul 2026 13:15:31 -0400
Subject: [PATCH 1/3] Pin actionlint and markdownlint-cli2 to specific versions
 in Taskfiles

---
 .taskfiles/github.Taskfile.yml   | 2 +-
 .taskfiles/markdown.Taskfile.yml | 2 +-
 .taskfiles/runtime.Taskfile.yml  | 2 ++
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.taskfiles/github.Taskfile.yml b/.taskfiles/github.Taskfile.yml
index 91c26e5..2a8afa2 100644
--- a/.taskfiles/github.Taskfile.yml
+++ b/.taskfiles/github.Taskfile.yml
@@ -6,7 +6,7 @@ version: "3"
 vars:
   GITHUB_VERSION:
     map:
-      actionlint: latest
+      actionlint: 1.7.12
       act: 0.2.88
       pinact: 4.0.0
       ghalint: 1.5.6
diff --git a/.taskfiles/markdown.Taskfile.yml b/.taskfiles/markdown.Taskfile.yml
index 5f44f47..00bf769 100644
--- a/.taskfiles/markdown.Taskfile.yml
+++ b/.taskfiles/markdown.Taskfile.yml
@@ -6,7 +6,7 @@ version: "3"
 vars:
   MARKDOWN_VERSION:
     map:
-      markdownlintCli2: latest
+      markdownlintCli2: 0.23.0
       markdownTableFormatter: 1.7.0
 
 tasks:
diff --git a/.taskfiles/runtime.Taskfile.yml b/.taskfiles/runtime.Taskfile.yml
index 9a7caf6..97c9f00 100644
--- a/.taskfiles/runtime.Taskfile.yml
+++ b/.taskfiles/runtime.Taskfile.yml
@@ -8,6 +8,8 @@ vars:
     map:
       uv: 0.11.16
       fnm: 1.39.0
+      # pwsh stays "latest": its installers use the Microsoft package repo /
+      # Homebrew, which only provide the latest release and reject version pins.
       pwsh: latest
       golang: 1.26.5
   RUNTIME_INSTALLER_SHA:

From 6320a4aaec1b85c6571b578e2cb7b428e8eced41 Mon Sep 17 00:00:00 2001
From: Brian Gordon Davis <96969185+bgdnext64@users.noreply.github.com>
Date: Wed, 15 Jul 2026 13:17:39 -0400
Subject: [PATCH 2/3] Fix actionlint installer to pass bare version to the
 download script

---
 .taskfiles/scripts/install_actionlint.sh | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.taskfiles/scripts/install_actionlint.sh b/.taskfiles/scripts/install_actionlint.sh
index ea72dc7..9eb2bd3 100755
--- a/.taskfiles/scripts/install_actionlint.sh
+++ b/.taskfiles/scripts/install_actionlint.sh
@@ -69,11 +69,13 @@ if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
   exit 0
 fi
 
-# Normalize VERSION: empty/whitespace -> "latest", numeric -> add "v" prefix
+# Normalize VERSION: empty/whitespace -> "latest". The pinned
+# download-actionlint.bash expects a bare semantic version (e.g. 1.7.12) or
+# "latest", so strip any leading "v" prefix from a specific version.
 if [[ -z "${VERSION//[[:space:]]/}" ]]; then
   VERSION="latest"
-elif [[ "${VERSION}" != "latest" && "${VERSION}" =~ ^[0-9] ]]; then
-  VERSION="v${VERSION}"
+elif [[ "${VERSION}" != "latest" ]]; then
+  VERSION="${VERSION#v}"
 fi
 
 # Determine install directory

From 2b44aa8e7519a4354f11478ca4c6214eee2cdff5 Mon Sep 17 00:00:00 2001
From: Brian Gordon Davis <96969185+bgdnext64@users.noreply.github.com>
Date: Wed, 15 Jul 2026 13:22:28 -0400
Subject: [PATCH 3/3] Make tool version check tolerant of non-zero exit from
 version commands

---
 .taskfiles/_internal.Taskfile.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.taskfiles/_internal.Taskfile.yml b/.taskfiles/_internal.Taskfile.yml
index 0f5ff8f..f641861 100644
--- a/.taskfiles/_internal.Taskfile.yml
+++ b/.taskfiles/_internal.Taskfile.yml
@@ -42,13 +42,13 @@ tasks:
     cmds:
       - cmd: |
           {{if ne .VER "latest"}}
-            {{.CMD}} | grep -F "{{.VER}}"
+            { {{.CMD}} 2>&1 || true; } | grep -F "{{.VER}}"
           {{end}}
         platforms: [linux, darwin]
       - cmd: |
           {{if ne .VER "latest"}}
             {{.PWSH}} '
-              $match = (& {{.CMD}}) | Select-String -Pattern "{{.VER}}" -SimpleMatch
+              $match = (& {{.CMD}} 2>&1) | Select-String -Pattern "{{.VER}}" -SimpleMatch
               if (-not $match) { exit 1 }
             '
           {{end}}