docs: add beta release and rollback guide

.github/workflows/ci.yml

@@ -29,6 +29,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Setup Node.js ${{ matrix.node-version }}
@@ -89,6 +90,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Setup Node.js

README.md

@@ -104,8 +104,8 @@ Longer walkthrough: [Getting started](docs/getting-started.md).
 
 The Action is bundled for the repository's local shadow workflow. The tagged
 pre-release [`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5)
-is the current release; pin its immutable commit SHA
-for shadow evaluation.
+is the current release; pin
+`34d998bbd59fa09dd9081e24f22abe812f97fbab` for shadow evaluation.
 Production consumers must still wait for a stable public release. Do not use
 the placeholder `patchgate/patchgate@v0.1.0-dev` as an installable public
 reference. Consumer setup, permissions and the shadow workflow are documented

docs/github-action-usage.md

@@ -4,9 +4,10 @@ PatchGate contains a local/shadow GitHub Action candidate. It is not yet a
 released Marketplace action or a proven public `v0.1` distribution.
 
 For a real external shadow installation, use the [G4 shadow-installation
-runbook](pilots/g4-shadow-installation-runbook.md). For beta publication and
-rollback, use the [beta release runbook](releases/beta-release-and-rollback.md)
-after the documented gates have been reviewed.
+runbook](pilots/g4-shadow-installation-runbook.md). For release validation,
+upgrade, downgrade and rollback, use the [beta release and rollback
+guide](releases/beta-release-and-rollback.md) after the documented gates have
+been reviewed.
 
 ---
 
@@ -16,8 +17,8 @@ In **Shadow Mode**, PatchGate observes only (`fail-on: never`). It evaluates
 the PR, writes the `ContributionReceipt`, and can post a Check Run without
 blocking merge. Pin
 [`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5)
-for this pre-release and pin commit
-the immutable commit SHA shown on that release page. This is not production and not a
+for discovery, but install the immutable source commit
+`34d998bbd59fa09dd9081e24f22abe812f97fbab`. This is not production and not a
 `v0.1` claim.
 
 The Action reads GitHub metadata through the API. Do **not** check out
@@ -60,8 +61,10 @@ jobs:
       # snapshot. The Check Run output shows the full tested SHA and its
       # binding to the PR head; a stale event is rejected before evaluation.
       # snapshot-rejection Check Runs are included in beta.5.
+      # Release identity before resolving the immutable commit:
+      # uses: daichunghy/patchgate@v0.1.0-beta.5
       - name: Run PatchGate Shadow Gate
-        uses: daichunghy/patchgate@v0.1.0-beta.5
+        uses: daichunghy/patchgate@34d998bbd59fa09dd9081e24f22abe812f97fbab # v0.1.0-beta.5
         with:
           fail-on: never
           create-check-run: true
@@ -77,7 +80,7 @@ workflow. It is still not production or a `v0.1` claim.
 
 ```yaml
       - name: Run PatchGate Enforcing Gate
-        uses: daichunghy/patchgate@v0.1.0-beta.5
+        uses: daichunghy/patchgate@34d998bbd59fa09dd9081e24f22abe812f97fbab # v0.1.0-beta.5
         with:
           fail-on: blocked
           create-check-run: true

docs/releases/2026-08-23-beta.5.md

@@ -3,10 +3,13 @@
 **Release date:** 23 August 2026  
 **Tag:** [`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5)
 
+**Annotated tag object:** `c6e5fdcb95862d6db3909e9621fcbd25cbfb0e11`
+**Action source commit:** `34d998bbd59fa09dd9081e24f22abe812f97fbab`
+
 Beta.5 is the current documentation-synchronized public Action pre-release.
 It carries the beta.4 Action behavior and makes the public README, usage guide,
 support/security pages, and release record point to one current release tag.
 
-Pin the immutable commit shown on the release page and keep `fail-on: never`.
+Consumers must pin the full Action source commit above and keep `fail-on: never`.
 This remains shadow-only: it is not a production release, Marketplace listing,
 stable `v0.1` claim, or external adoption evidence.