Tags starting with `v` are not valid semantic versions

[justinmchase]

Your documentation says:

The associated tag must follow semantic versioning - this tag value will be used to create a package version.

Consumers of your action will then be able to specify that version to consume your action from the package, e.g.

• uses: your-name/your-action@v1.2.3
• uses: your-name/your-action@v1

But v1.2.3 and v1 are not valid semantic versions, 1.2.3 is however.

This may seem like pedantry and also I am aware of the limitation of github being unable to resolve the tag 1 and therefore you need something like v1 for it to be a valid tag, however I'd just like to say it seems like a mistake to support partial versions and invalid semantic versions and instead you should support only valid semantic versions.

Also, instead of v1 you should support semver ranges.

examples

- uses: your-name/your-action@1.2.3
- uses: your-name/your-action@^1.2.3

---

• Related to Are versions like v1 immutable? #223

[dev-bio]

Version ranges is a very bad idea, especially with the lack of a lockfile concept in the ecosystem. While immutable action are fundamentally flawed due to this fact, version ranges would go a gainst the whole point of implementing immutable actions in the first place.

[justinmchase]

@dev-bio

...version ranges would go a gainst the whole point of implementing immutable actions...

No it wouldn't, in fact its completely orthogonal. The point of immutable actions is that a tag I have already pinned to cannot be retroactively changed.

This is a completely different problem from not trusting new versions being published. If I do not want to trust future then I will simply not use version ranges. However, without immutable actions there is no way for me to have guarantees that already existing actions can't be compromised. Two different problems.