@@ -35,7 +35,7 @@ runs:
     - name: Cache Vite+
       id: vp_cache
       if: steps.vp.outputs.version != ''
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.vite-plus
         key: vite-plus-home-v2-${{ runner.os }}-${{ runner.arch }}-${{ steps.vp.outputs.version }}-node${{ steps.vp.outputs.node }}-${{ steps.vp.outputs.pnpm }}
@@ -56,7 +56,7 @@ runs:
     # partial bytes, so a shorter limit costs a slow download only a retry.
     - name: Setup Vite+
       if: steps.vp_cache.outputs.cache-hit != 'true'
-      uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
+      uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1.15.0
       env:
         VP_DOWNLOAD_TIMEOUT: "120"
       with:
@@ -92,7 +92,7 @@ runs:
     - name: Restore pnpm store
       id: pnpm_cache
       if: inputs.install == 'true'
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm_store.outputs.path }}
         key: pnpm-${{ steps.pnpm_store.outputs.namespace }}-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json') }}
@@ -106,7 +106,7 @@ runs:
     - name: Restore lockfile verification
       id: pnpm_verified
       if: inputs.install == 'true'
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm_store.outputs.verified }}
         key: pnpm-verified-v1-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json') }}
@@ -121,7 +121,7 @@ runs:
 
     - name: Save lockfile verification
       if: inputs.install == 'true' && steps.pnpm_verified.outputs.cache-hit != 'true'
-      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm_store.outputs.verified }}
         key: ${{ steps.pnpm_verified.outputs.cache-primary-key }}
@@ -138,7 +138,7 @@ runs:
         steps.pnpm_cache.outputs.cache-hit != 'true' &&
         (steps.pnpm_store.outputs.namespace == 'full' ||
           steps.pnpm_cache.outputs.cache-matched-key != format('pnpm-full-v1-{0}-{1}-{2}', runner.os, runner.arch, hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json')))
-      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.pnpm_store.outputs.path }}
         key: ${{ steps.pnpm_cache.outputs.cache-primary-key }}
 
@@ -121,9 +121,54 @@ async function resolveLatestNightlyCommit({ github, context, core }) {
   return { tag, sha: commit.sha, version };
 }
 
+// The two places a nightly install looks for an update: the `update-feed` pointer, and
+// releases.atom, which holds the 10 newest git tags of any kind. Older installs take the first
+// nightly in the feed. Reports what each names beside the newest published nightly.
+async function readNightlyUpdateFeed({ github, context, fetch = globalThis.fetch }) {
+  const latest = await findLatestNightly({ github, context });
+  if (!latest) return {};
+
+  const base = `https://github.com/${context.repo.owner}/${context.repo.repo}`;
+  // Only a missing or malformed pointer is stale. Rewriting deletes the old file first, so a
+  // GitHub outage must not look like one.
+  // Node waits five minutes for a stalled response, which is this job's whole time limit.
+  const signal = () => AbortSignal.timeout(30_000);
+  const pointer = await fetch(`${base}/releases/download/update-feed/nightly.json`, {
+    signal: signal(),
+  });
+  if (!pointer.ok && pointer.status !== 404) {
+    throw new Error(`The update-feed pointer answered HTTP ${pointer.status}.`);
+  }
+  let pointerTag;
+  if (pointer.ok) {
+    // A body that fails to arrive throws here; only one that is not JSON counts as malformed.
+    const body = await pointer.text();
+    try {
+      pointerTag = JSON.parse(body)?.tag_name;
+    } catch {}
+  }
+
+  // An unreadable feed leaves `feedTags` unset, so the pointer is still repaired. An error page
+  // can answer HTTP 200, so only an Atom document counts as read.
+  let feedTags;
+  try {
+    const feed = await fetch(`${base}/releases.atom`, { signal: signal() });
+    const body = feed.ok ? await feed.text() : "";
+    if (/<feed[\s>]/.test(body)) {
+      feedTags = Array.from(body.matchAll(/href="[^"]*\/releases\/tag\/([^"]+)"/g), (match) =>
+        decodeURIComponent(match[1]),
+      );
+    }
+  } catch {}
+  const feedNightly = feedTags?.find((tag) => /^v?\d+\.\d+\.\d+-nightly\./.test(tag));
+
+  return { tag: latest.tagName, pointerTag, feedNightly, feedTags };
+}
+
 module.exports = {
   assertCommitOnDefaultBranch,
   assertReleaseSource,
   shouldReleaseNightly,
   resolveLatestNightlyCommit,
+  readNightlyUpdateFeed,
 };
@@ -237,3 +237,81 @@ test("stable releases fail when no nightly is published", async () => {
   const { options } = nightlyCommitFixture({ releases: [nightly(1, { tagName: "v1.0.0" })] });
   await assert.rejects(resolveLatestNightlyCommit(options), /No published nightly found/);
 });
+
+const { readNightlyUpdateFeed } = require("./check-nightly-release.cjs");
+
+// GitHub percent-encodes tag names in the feed, and any tag in the repository takes a slot.
+const atomEntry = (tag) =>
+  `<entry><link rel="alternate" type="text/html" href="https://github.com/example/app/releases/tag/${encodeURIComponent(tag)}"/></entry>`;
+const atomFeed = (tags) => new Response(`<feed>${tags.map(atomEntry).join("")}</feed>`);
+const NEWEST = "v1.0.1-nightly.20260905.123";
+const OLDER = "v1.0.1-nightly.20260905.100";
+
+function updateFeedFixture({ feed, pointer }) {
+  const { options } = fixture({
+    releases: [nightly(1), nightly(0, { tagName: "v1.0.2-preview.1" })],
+  });
+  options.fetch = async (url) =>
+    url === "https://github.com/example/app/releases.atom"
+      ? feed
+      : url === "https://github.com/example/app/releases/download/update-feed/nightly.json"
+        ? pointer
+        : assert.fail(`unexpected fetch ${url}`);
+  return options;
+}
+
+const missing = () => new Response("Not Found", { status: 404 });
+// HTTP 200, then the connection drops before the body arrives.
+const brokenBody = () =>
+  new Response(new ReadableStream({ start: (controller) => controller.error(new Error("reset")) }));
+for (const [name, { feed, pointer }, expected] of [
+  [
+    "a nightly crowded out of the feed and a missing pointer",
+    { feed: atomFeed(["v1.0.2-preview.1", "mobile-android-build/2.3.0/abc"]), pointer: missing() },
+    { pointerTag: undefined, feedNightly: undefined },
+  ],
+  [
+    "the first nightly in the feed, which is the one older installs take",
+    { feed: atomFeed(["update-feed", OLDER, NEWEST]), pointer: Response.json({ tag_name: OLDER }) },
+    { pointerTag: OLDER, feedNightly: OLDER },
+  ],
+  [
+    "a malformed pointer as stale and an unreadable feed as naming nothing",
+    { feed: new Response("", { status: 503 }), pointer: Response.json(null) },
+    { pointerTag: undefined, feedNightly: undefined, unreadable: true },
+  ],
+  [
+    "an HTML page with release links as an unreadable feed",
+    {
+      feed: new Response(
+        `<html><feedback-form></feedback-form><a href="/example/app/releases/tag/${OLDER}">x</a></html>`,
+      ),
+      pointer: Response.json({ tag_name: NEWEST }),
+    },
+    { pointerTag: NEWEST, feedNightly: undefined, unreadable: true },
+  ],
+  [
+    "the pointer when the feed's body fails to arrive",
+    { feed: brokenBody(), pointer: Response.json({ tag_name: NEWEST }) },
+    { pointerTag: NEWEST, feedNightly: undefined, unreadable: true },
+  ],
+]) {
+  test(`update feed check reports ${name}`, async () => {
+    const { tag, pointerTag, feedNightly, feedTags } = await readNightlyUpdateFeed(
+      updateFeedFixture({ feed, pointer }),
+    );
+    const { unreadable = false, ...named } = expected;
+    assert.deepEqual({ tag, pointerTag, feedNightly }, { tag: NEWEST, ...named });
+    assert.equal(feedTags === undefined, unreadable);
+  });
+}
+
+for (const [name, pointer, error] of [
+  ["answers with an error", () => new Response("", { status: 503 }), /pointer answered HTTP 503/],
+  ["drops the connection", brokenBody, /reset/],
+]) {
+  test(`update feed check does not call a pointer stale when GitHub ${name}`, async () => {
+    const options = updateFeedFixture({ feed: atomFeed([NEWEST]), pointer: pointer() });
+    await assert.rejects(readNightlyUpdateFeed(options), error);
+  });
+}
@@ -24,7 +24,7 @@ jobs:
       ALLOW_INCREASE: ${{ contains(github.event.pull_request.labels.*.name, 'agent-context-increase') }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           sparse-checkout: apps/server/src/provider/agentContextBudget.json
           sparse-checkout-cone-mode: false