docs: add beta release and rollback guide

.github/workflows/ci.yml

@@ -29,6 +29,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Setup Node.js ${{ matrix.node-version }}
@@ -89,6 +90,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Setup Node.js

README.md

@@ -19,9 +19,10 @@ it cannot force external automation to stop working.
 **Status:** public pre-release. The npm package remains unpublished (`private: true`,
 `0.1.0-dev`). The current Action release is
 [`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5),
-and consumers should pin the immutable commit shown on that release page for
-**shadow** evaluation only. This is not production, not a `v0.1` claim, and
-not evidence of external pilots or adoption.
+and consumers should pin
+`34d998bbd59fa09dd9081e24f22abe812f97fbab` for **shadow** evaluation only.
+This is not production, not a `v0.1` claim, and not evidence of external
+pilots or adoption.
 
 > If PatchGate saved you one wasted review,
 > [star it](https://github.com/daichunghy/patchgate/stargazers). That is the
@@ -69,8 +70,8 @@ Longer walkthrough: [Getting started](docs/getting-started.md).
 
 The Action is bundled for the repository's local shadow workflow. The tagged
 pre-release [`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5)
-is the current release; pin its immutable commit SHA
-for shadow evaluation.
+is the current release; pin
+`34d998bbd59fa09dd9081e24f22abe812f97fbab` for shadow evaluation.
 Production consumers must still wait for a stable public release. Do not use
 the placeholder `patchgate/patchgate@v0.1.0-dev` as an installable public
 reference. Consumer setup, permissions and the shadow workflow are documented

docs/github-action-usage.md

@@ -4,9 +4,10 @@ PatchGate contains a local/shadow GitHub Action candidate. It is not yet a
 released Marketplace action or a proven public `v0.1` distribution.
 
 For a real external shadow installation, use the [G4 shadow-installation
-runbook](pilots/g4-shadow-installation-runbook.md). For beta publication and
-rollback, use the [beta release runbook](releases/beta-release-and-rollback.md)
-after the documented gates have been reviewed.
+runbook](pilots/g4-shadow-installation-runbook.md). For release validation,
+upgrade, downgrade and rollback, use the [beta release and rollback
+guide](releases/beta-release-and-rollback.md) after the documented gates have
+been reviewed.
 
 ---
 
@@ -16,8 +17,8 @@ In **Shadow Mode**, PatchGate observes only (`fail-on: never`). It evaluates
 the PR, writes the `ContributionReceipt`, and can post a Check Run without
 blocking merge. Pin
 [`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5)
-for this pre-release and pin commit
-the immutable commit SHA shown on that release page. This is not production and not a
+for discovery, but install the immutable source commit
+`34d998bbd59fa09dd9081e24f22abe812f97fbab`. This is not production and not a
 `v0.1` claim.
 
 The Action reads GitHub metadata through the API. Do **not** check out
@@ -57,10 +58,10 @@ jobs:
       # github.token cannot read Administration, so native Rulesets /
       # branch-protection snapshots fail closed (correct). A PAT/App token
       # with administration:read is required for a complete native-control
-      # snapshot. beta.2 posts a Check Run for successful evaluations;
-      # snapshot-rejection Check Runs are included in beta.5.
+      # beta.5 posts a Check Run for successful evaluations and snapshot
+      # rejections when create-check-run is true.
       - name: Run PatchGate Shadow Gate
-        uses: daichunghy/patchgate@v0.1.0-beta.5
+        uses: daichunghy/patchgate@34d998bbd59fa09dd9081e24f22abe812f97fbab # v0.1.0-beta.5
         with:
           fail-on: never
           create-check-run: true
@@ -76,7 +77,7 @@ workflow. It is still not production or a `v0.1` claim.
 
 ```yaml
       - name: Run PatchGate Enforcing Gate
-        uses: daichunghy/patchgate@v0.1.0-beta.5
+        uses: daichunghy/patchgate@34d998bbd59fa09dd9081e24f22abe812f97fbab # v0.1.0-beta.5
         with:
           fail-on: blocked
           create-check-run: true

docs/releases/2026-08-23-beta.5.md

@@ -3,10 +3,13 @@
 **Release date:** 23 August 2026  
 **Tag:** [`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5)
 
+**Annotated tag object:** `c6e5fdcb95862d6db3909e9621fcbd25cbfb0e11`
+**Action source commit:** `34d998bbd59fa09dd9081e24f22abe812f97fbab`
+
 Beta.5 is the current documentation-synchronized public Action pre-release.
 It carries the beta.4 Action behavior and makes the public README, usage guide,
 support/security pages, and release record point to one current release tag.
 
-Pin the immutable commit shown on the release page and keep `fail-on: never`.
+Consumers must pin the full Action source commit above and keep `fail-on: never`.
 This remains shadow-only: it is not a production release, Marketplace listing,
 stable `v0.1` claim, or external adoption evidence.