Co-authored-by: felix-renovate[bot] <143542247+felix-renovate[bot]@users.noreply.github.com>

Co-authored-by: felix-renovate[bot] <143542247+felix-renovate[bot]@users.noreply.github.com>

Co-authored-by: felix-renovate[bot] <143542247+felix-renovate[bot]@users.noreply.github.com>

Replace the deprecated `git.io/autotag-install` one-liner with a direct
download of `autotag_linux_amd64` from a pinned release, verified against a
hardcoded SHA-256.

Why:
- The installer is generated by godownloader (also deprecated upstream) and,
  while it does check the checksum file published with each GitHub release,
  those checksums are mutable — anyone who can publish a release can publish
  matching checksums. There's no way to pin an out-of-band expected SHA.
- autotag's maintainers are me and a couple of trusted ex-coworkers
  (incl. @will.milton) and I trust the code, but a compromise of the
  `autotag-dev` org or a maintainer account would silently flow into every
  pipeline that runs the installer. Hardcoding the SHA in our workflow makes
  that class of supply-chain attack fail loudly.
- autotag rarely changes and we only use its most basic functionality, so we
  don't upgrade often. Grabbing the new binary's SHA from `checksums.txt`
  on bump is a cheap one-time step for meaningful hardening.

See: https://github.com/autotag-dev/autotag/blob/main/README.md (CI install
section) for the recommended pattern.

ci: pin autotag binary by version + sha256

…#134)

Add an optional `repository` input that points to a relative path under
$GITHUB_WORKSPACE for the git repository to operate on. Defaults to `.`
(the workspace root). The entrypoint adds the resolved path to
safe.directory and cd's into it before running git status / ghcommit.

This mirrors the behaviour of stefanzweifel/git-auto-commit-action and
enables using the action on repositories checked out into a subdirectory
of the workflow workspace.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

feat: add optional repository input