Run the quality checks from a script file of this repository

Task: MIL-003#3

guides/quality-checks.md

@@ -32,12 +32,18 @@ jobs:
 | `mypy-version` | `1.11.2` | Version of mypy |
 | `shellcheck-py-version` | `0.10.0.1` | Version of the shellcheck-py package (ShellCheck 0.10.0) |
 | `shfmt-py-version` | `3.11.0.2` | Version of the shfmt-py package (shfmt 3.11.0) |
+| `tools-ref` | `v1` | Tag or branch of `TirSystem/github-action` from which the script `tools/quality-checks.sh` is fetched |
 
 Reference the workflow at the major tag (`@v1`) or at an exact tag
 (`@v1.0.0`), never at `main` and never at the branch of a pull request: that
 branch is deleted when the pull request is merged and the reference stops
 working. See the upgrade guide for what each choice receives.
 
+The workflow file calls a script of this repository, fetched at `tools-ref`. A
+call at an exact tag is pinned completely only when `tools-ref` names the same
+tag, for example `@v1.0.1` with `tools-ref: v1.0.1`; with the default the
+script follows `v1`.
+
 ## What is checked
 
 | Language | Files | Tools |

guides/upgrading.md

@@ -16,6 +16,10 @@ repository, tags `vMAJOR.MINOR.PATCH` and a moving major tag `vMAJOR`.
 A breaking release gets a new major version (`v2`), so a pipeline on `@v1`
 never receives it until you change the line yourself.
 
+The quality-checks workflow fetches its script at its input `tools-ref`, which
+defaults to `v1`. To pin it completely, call it at an exact tag and set
+`tools-ref` to the same tag; otherwise the script follows the major tag.
+
 The two scoped workflows (**Sync GitHub mirror metadata** and **Publish
 wiki**) are delivered by the instance and are not in your `uses:` lines; you
 cannot pin them, but they fetch their scripts at the major tag.