The moving v0 Action tag has no documented rollback path

[mbeacom]

Context

Surfaced by the operator lens during the deep review of #134 (the fix for #107), and deferred there because it is pre-existing and org-level rather than introduced by that change.

The gap

packages/ci and packages/ci/queue reach adopters through mbeacom/adrkit/packages/ci@v0 — a moving major tag. scripts/update-action-tag.ts moves it forward on release. Nothing documents moving it back.

There is no staged rollout, no canary, and no kill switch: moving v0 deploys to every adopter pinned at @v0 simultaneously. Recovery depends on a maintainer knowing, unprompted, to run something like:

git tag -f v0 <previous-release-commit>
git push -f origin v0

with a contents: write token, and knowing which commit that was.

Why it is worth writing down

The Action's blast radius is asymmetric in a way that is easy to misjudge. It cannot corrupt a repository — it is read-only and comment-only, it never deletes, and it never approves. But it does write, and as of #134 it can now edit a comment on weaker author evidence than before (a bot author plus a leading marker, when the token's login is unknowable — see ADR-0026). That residual exposure is accepted and argued in the record, and it is small. It is also the first change that makes "how fast can we stop this" a question with a real answer rather than a hypothetical one.

Worth noting explicitly: a wrongly-edited comment is not recovered by moving the tag. Rolling back stops the bleeding; GitHub's comment edit history is what restores content. A runbook should say both, because someone reaching for it will assume the first did the second.

What would close this

Any one of:

• A short rollback section in docs/RELEASING.md naming the command, the token scope, and how to find the previous release commit (git rev-parse v0.6.0^{commit} — noting the v* tags are annotated, so the tag object's own SHA is not the commit).
• A workflow_dispatch job that moves v0 to a supplied tag, so the recovery path is the same shape as the release path.
• A deliberate, recorded decision that @v0 is best-effort and adopters wanting immutability should pin a commit SHA — which the docs already recommend, and which would make this a documentation clarification rather than an automation gap.

Related

• Deferred action item 10 on ADR-0026
• CI Action posts a new comment on every push instead of updating its own #107, fix(ci): update the governing-decisions comment instead of posting a new one #134