test: Fork CI run for #346 (do not merge)

.agents/skills/fix-security-vulnerability/SKILL.md

@@ -56,14 +56,14 @@ make                  # installs yarn deps AND runs 'pre-commit install'
 pre-commit install
 ```
 
-The pre-commit config (`.pre-commit-config.yaml`) runs formatters, linters, and a `set-docker-tag-from-branch` hook that rewrites `action.yml` so the Docker tag matches the current branch name. **This is not optional.** CI's `prepare-docker` job rejects any PR whose `action.yml` Docker tag still matches a semver like `3.6.0`. The pre-commit hook is what keeps the tag in sync on feature branches; CI does **not** install or run pre-commit itself.
+The pre-commit config (`.pre-commit-config.yaml`) runs formatters and linters. CI does **not** install or run pre-commit itself.
 
 ### Hook-modified files: re-stage, re-commit (never `--amend`)
 
-On the first `git commit`, the `set-docker-tag-from-branch` hook will usually modify `action.yml`. The commit fails, and the hook's changes are left unstaged. Recover by:
+If a hook modifies files, the commit fails and the hook's changes are left unstaged. Recover by:
 
 ```bash
-git add action.yml
+git add <modified files>
 git commit -m "<same message>"    # a NEW commit; do not use --amend
 ```
 
@@ -123,10 +123,9 @@ Co-Authored-By: <agent model name> <noreply@anthropic.com>
 EOF
 )"
 
-# 4. If the 'set-docker-tag-from-branch' hook rewrote action.yml (it usually
-#    does on the first commit of a branch), the commit above fails. Re-stage
-#    and re-commit — DO NOT use --amend.
-git add action.yml
+# 4. If a pre-commit hook modified files, the commit above fails. Re-stage
+#    and re-commit. DO NOT use --amend.
+git add <modified files>
 git commit -m "<same message as above>"
 ```
 

.agents/skills/verify-dist/SKILL.md

@@ -61,15 +61,13 @@ Regenerates dist/index.js.
 
 Whoever runs the follow-up commit needs the repo's pre-commit hooks installed. Verify with `ls .git/hooks/pre-commit`; if missing, run `make` (installs yarn deps + `pre-commit install`) or `pre-commit install`.
 
-The `set-docker-tag-from-branch` hook will rewrite `action.yml` on the first commit of a branch and fail the commit. Recover by staging `action.yml` and committing again (**never `--amend`** — the hook-failed commit never landed):
+If a hook modifies files, the commit fails. Recover by staging the modified files and committing again (**never `--amend`**, because the hook-failed commit never landed):
 
 ```bash
-git add action.yml
+git add <modified files>
 git commit -m "<same message>"
 ```
 
-CI does **not** run pre-commit. CI's `prepare-docker` job rejects PRs where `action.yml`'s Docker tag still matches a semver like `3.6.0`, so keeping the tag in sync via the local hook is what prevents the CI failure.
-
 ## Notes
 
 - The CI check runs `git diff --ignore-space-at-eol dist/` — whitespace-only diffs pass, anything else fails. Match that locally.

.github/actions/use-local-image/action.yml

@@ -0,0 +1,57 @@
+name: 'Use local action image'
+description: |-
+  Loads the action image built in this workflow run into a local registry
+  and points the checked-out action.yml to it. The e2e tests use this, so
+  they can run before any image goes to ghcr.io (and on fork PRs, which get
+  a read-only token).
+
+inputs:
+  path:
+    description: Directory of the checked-out action that the tests run.
+    default: '.'
+    required: false
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Download image
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      with:
+        name: action-release-image-${{ runner.arch == 'ARM64' && 'arm64' || 'amd64' }}
+        # Relative path, because `runner.temp` is a host path in container jobs.
+        path: .action-release-image
+
+    # Container jobs have the host docker socket mounted but usually no docker CLI.
+    - name: Install docker CLI
+      shell: bash
+      run: |
+        if command -v docker &> /dev/null; then
+          exit 0
+        fi
+        curl -fsSL "https://download.docker.com/linux/static/stable/$(uname -m)/docker-29.9.1.tgz" \
+          | tar -xz -C /usr/local/bin --strip-components=1 docker/docker
+
+    # The runner always pulls `docker://` images, so a local copy is not enough.
+    # The daemon trusts registries on localhost without TLS.
+    - name: Push image to local registry
+      shell: bash
+      run: |
+        docker run -d --rm -p 5000:5000 --name action-release-registry \
+          registry:3.1.2@sha256:d4032d4cc323c1731c707931ecada07a53076eac38e3b61ae57533f170f2c6c3
+        docker load -i .action-release-image/image.tar
+        rm -rf .action-release-image
+        # Retry until the registry is ready. A curl check does not work in
+        # container jobs, because there localhost is the job container.
+        for i in $(seq 1 10); do
+          docker push localhost:5000/action-release-image:pr && exit 0
+          sleep 2
+        done
+        exit 1
+
+    - name: Point action.yml to local image
+      shell: bash
+      working-directory: ${{ inputs.path }}
+      run: |
+        sed -i -e 's|docker://ghcr.io/getsentry/action-release-image:.*|docker://localhost:5000/action-release-image:pr|' action.yml
+        # Make sure the replacement worked
+        grep -q 'docker://localhost:5000/action-release-image:pr' action.yml