Bump base-bash-libs CI pin to v1.4.0

.github/workflows/tests.yml

@@ -48,7 +48,7 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           repository: basefoundry/base-bash-libs
-          ref: 5e52e79a8d6f61f82e5e95a07c75da256642f92e
+          ref: 2c5ef2c3a9edfbe2cf68d0645be65b920255abff
           path: .dependencies/base-bash-libs
 
       - name: Set up Base
@@ -156,7 +156,7 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           repository: basefoundry/base-bash-libs
-          ref: 5e52e79a8d6f61f82e5e95a07c75da256642f92e
+          ref: 2c5ef2c3a9edfbe2cf68d0645be65b920255abff
           path: .dependencies/base-bash-libs
 
       - name: Set up Base on Ubuntu

CHANGELOG.md

@@ -74,6 +74,7 @@ and versions are tracked in the repo-root `VERSION` file.
 
 ### CI
 
+- Updated the pinned base-bash-libs checkout to the v1.4.0 release commit.
 - Updated Base-backed CI to exercise the explicit `project.languages` manifest
   contract from the Base v1.7.0 release with a compatible base-bash-libs pin.
 - Added read-only `basectl devcontainer` and `basectl devenv-report` JSON

docs/contracts.md

@@ -26,7 +26,7 @@ depend on.
 | `runtime-platform-env` | The `env` command prints `BASE_OS`, `BASE_PLATFORM`, `BASE_HOST_ENV`, and `BASE_HOST` with the other Base runtime values. | `src/env.sh` | `tests/validate.sh`, `tests/demo_test.bats`, `demo/demo.sh` | Learners cannot discover the current Base runtime platform and host-environment contract from base-demo. | Runtime |
 | `installer-checksum` | Downloaded Base installers are verified when `BASE_INSTALL_SHA256` is set and warn when it is empty. | `install.sh` | `tests/install_test.bats` | Pinned installer URLs can execute without checksum verification or a visible warning. | Security |
 | `service-log-permissions` | Process-backed service log files are created or corrected to mode `0600` before writes. | `bin/base-demo-services` | `tests/services_test.bats` | Service logs can expose local process output through permissive file modes. | Security |
-| `ci-pinned-dependencies` | CI uses a pinned Base v1.7.0 release checkout, a compatible SHA-pinned base-bash-libs checkout, and full SHA-pinned GitHub Actions. | `.github/workflows/tests.yml` | `tests/validate.sh` | CI can drift with Base `main` or mutable action tags instead of validating the intended capability contract. | CI |
+| `ci-pinned-dependencies` | CI uses a pinned Base v1.7.0 release checkout, the SHA-pinned base-bash-libs v1.4.0 release commit, and full SHA-pinned GitHub Actions. | `.github/workflows/tests.yml` | `tests/validate.sh` | CI can drift with Base `main`, an older base-bash-libs release, or mutable action tags instead of validating the intended capability contract. | CI |
 | `ubuntu-ci` | The repository has an Ubuntu job that runs `basectl setup base --yes --no-notify`, validates `basectl setup base --profile dev --yes --no-notify`, verifies `bats`/`gh`/`shellcheck`, and runs `basectl check --ci base-demo --format json` against the pinned Base checkout. | `.github/workflows/tests.yml` | `tests/validate.sh`, GitHub Actions `validate-ubuntu` | Ubuntu support can drift from the documented Base setup, dev-profile, and read-only project health boundary. | CI |
 | `platform-boundary` | README and CONTRIBUTING document macOS full-demo support plus Ubuntu/Debian and WSL2 support for Base setup, dev-profile prerequisites, read-only project health checks, repo-location guidance, and the native-Windows non-goal. | `README.md`, `CONTRIBUTING.md` | `tests/validate.sh` | Developers on Linux or WSL2 follow macOS-only project setup or demo steps without a documented boundary. | Docs |
 | `ci-json-check` | The demo shows `basectl check --ci base-demo --format json` and asserts JSON status output. | `demo/demo.sh`, `README.md` | `tests/validate.sh`, `tests/demo_test.bats`, `.github/workflows/tests.yml` | The reference project stops demonstrating Base's CI-safe machine-readable check path. | CI |

tests/validate.sh

@@ -216,10 +216,10 @@ if grep -Fq '591e34a8fed6ce9cbe27f483f852bec81153f3eb' .github/workflows/tests.y
 fi
 
 base_bash_libs_pin_count="$(
-  grep -Fc 'ref: 5e52e79a8d6f61f82e5e95a07c75da256642f92e' .github/workflows/tests.yml || true
+  grep -Fc 'ref: 2c5ef2c3a9edfbe2cf68d0645be65b920255abff' .github/workflows/tests.yml || true
 )"
 if [[ "$base_bash_libs_pin_count" -ne 2 ]]; then
-  printf '.github/workflows/tests.yml must pin both base-bash-libs checkouts to the Base v1.7.0-compatible SHA.\n' >&2
+  printf '.github/workflows/tests.yml must pin both base-bash-libs checkouts to the v1.4.0 release commit.\n' >&2
   exit 1
 fi