@@ -5,9 +5,9 @@ on:
   pull_request:
   workflow_dispatch: # Follow open-java-format releases runs this on the bump it pushes
 
-# No version input anywhere here: the tests run the action with its default, the version that Follow
-# open-java-format releases bumps. That workflow pushes with its own token, which may not change a
-# workflow file, so the version must not be written in this one.
+# No version anywhere here: the action and the hook read .open-java-format-version from the checkout,
+# the file that Follow open-java-format releases bumps. That workflow pushes with its own token, which
+# may not change a workflow file, so the version must not be written in this one.
 jobs:
   test-changed:
     name: Test mode=changed
@@ -25,8 +25,9 @@ jobs:
           mode: changed
           code-scanning: true # with the permission: the upload has to go through
 
-  # The action and the hook on every platform they support, with a file that is formatted and one that
-  # is not. The repository itself has no Java files, so the tests write their own.
+  # The action and the hook on every platform they support: with a file that is formatted, with one
+  # that is not, and without .open-java-format-version. The repository itself has no Java files, so
+  # the tests write their own.
   test-platforms:
     name: Test on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
@@ -64,12 +65,34 @@ jobs:
       - name: Make sure the check failed
         run: test "${{ steps.unformatted.outcome }}" = failure
 
-      - name: Run the pre-commit hook on a file that is not formatted, then on a formatted one
+      - name: Take .open-java-format-version away, leaving only the formatted file
+        run: |
+          rm Unformatted.java
+          mv .open-java-format-version version.away
+
+      - name: Check without the version file, expecting a failure
+        id: no-version
+        continue-on-error: true
+        uses: ./
+        with:
+          mode: all
+
+      - name: Make sure that failed, and put the file back
+        run: |
+          test "${{ steps.no-version.outcome }}" = failure
+          mv version.away .open-java-format-version
+
+      - name: Run the pre-commit hook without the version file, then on a file that is not formatted, then on a formatted one
         run: |
           git init -q hook-test
           cd hook-test
           printf 'class Hook{int x;}\n' > Hook.java
           git add Hook.java
+          if bash ../pre-commit; then
+            echo "::error::The hook ran without .open-java-format-version"
+            exit 1
+          fi
+          cp ../.open-java-format-version .
           if bash ../pre-commit; then
             echo "::error::The hook accepted a file that is not formatted"
             exit 1
 
@@ -1,7 +1,8 @@
 name: Follow open-java-format releases
 
-# The action, the pre-commit hook and the README name one open-java-format version, and
-# .open-java-format-version holds it. Once an hour this compares that file with the latest release of
+# .open-java-format-version holds the open-java-format version this repository is on, as it does in
+# any repository that uses the action or the pre-commit hook; the README and the error messages name
+# the version too. Once an hour this compares that file with the latest release of
 # openjavaformat/open-java-format. When a new release is out, the version is replaced in every file
 # that names it, the result is pushed to main, and Test Action is run on it. That run has to be
 # explicit: a push made with the workflow's own token starts no push-triggered workflow.
@@ -49,8 +50,9 @@ jobs:
           git commit --all --quiet --file - <<COMMIT
           Check with open-java-format $latest
 
-          The action and the pre-commit hook default to $latest, which
-          openjavaformat/open-java-format released on $published. Made by the
+          .open-java-format-version names $latest, which
+          openjavaformat/open-java-format released on $published, so the tests
+          run the action and the pre-commit hook with it. Made by the
           "$GITHUB_WORKFLOW" workflow:
           $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID
           COMMIT
 
@@ -6,21 +6,26 @@ No Java, Maven, or Gradle required — downloads a native binary from Maven Cent
 
 ## Usage
 
+The version of open-java-format to check with goes in `.open-java-format-version` at the repository root, one of the versions on [Maven Central](https://repo1.maven.org/maven2/dev/openjavaformat/open-java-format-native/):
+
+```
+2.98.0.6
+```
+
+The action and the [pre-commit hook](#git-pre-commit-hook) both read that file, so the two cannot drift apart; without it, both stop and ask for it. The action itself needs no inputs:
+
 ```yaml
 - uses: actions/checkout@v7
 
-- uses: openjavaformat/open-java-format-action@v3
-  with:
-    version: '2.98.0.6'
+- uses: openjavaformat/open-java-format-action@v4
 ```
 
-v3 is for open-java-format 2.98.0.2 and later, which has a single style; it differs from v2 by the optional [code scanning report](#code-scanning). A workflow that pins 2.98.0.1 stays on `@v1`, which passes that version the `--ojf` flag it needs.
+v4 is for open-java-format 2.98.0.2 and later, which has a single style. v3 and v2 are for the same versions but take the version as a `version` input instead of the file. A workflow that pins 2.98.0.1 stays on `@v1`, which passes that version the `--ojf` flag it needs.
 
 ## Inputs
 
 | Input | Required | Default | Description |
 |-------|----------|---------|-------------|
-| `version` | yes | `2.98.0.6` | Version of the open-java-format native binary, one of those on [Maven Central](https://repo1.maven.org/maven2/dev/openjavaformat/open-java-format-native/) |
 | `mode` | no | `changed` | `changed` — only files from PR or push; `all` — every `.java` file in repo |
 | `code-scanning` | no | `false` | Also report the version check to [code scanning](#code-scanning); needs the `security-events: write` permission |
 
@@ -32,6 +37,7 @@ v3 is for open-java-format 2.98.0.2 and later, which has a single style; it diff
 
 ## Behaviour
 
+- If `.open-java-format-version` is missing → stops and asks for the file ❌
 - If all files are formatted correctly → passes ✅
 - If any file has formatting issues → lists unformatted files and fails ❌
 - If a newer open-java-format release is out → warns in the job log, and raises a [code scanning alert](#code-scanning) when that is turned on
@@ -70,7 +76,7 @@ Notes:
 
 ## Recommended setup
 
-Both setups check the files of a pull request and every file on a push to `main`. They differ in where a newer open-java-format release is announced.
+Both setups check the files of a pull request and every file on a push to `main`, with the version from `.open-java-format-version`. They differ in where a newer open-java-format release is announced.
 
 ### With the version check in the job log
 
@@ -88,9 +94,8 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: openjavaformat/open-java-format-action@v3
+      - uses: openjavaformat/open-java-format-action@v4
         with:
-          version: '2.98.0.6'
           mode: ${{ github.event_name == 'push' && 'all' || 'changed' }}
 ```
 
@@ -114,24 +119,22 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: openjavaformat/open-java-format-action@v3
+      - uses: openjavaformat/open-java-format-action@v4
         with:
-          version: '2.98.0.6'
           mode: ${{ github.event_name == 'push' && 'all' || 'changed' }}
           code-scanning: true
 ```
 
 ## Code scanning
 
-The action compares the `version` it runs with the latest [open-java-format release](https://github.com/openjavaformat/open-java-format/releases) and warns in the job log when a newer one is out. A log warning is easy to miss, so the check can also be reported to code scanning: the action then uploads a SARIF file with one alert while the version is behind, and with none once it is current, which closes the alert. The alert shows up under **Security → Code scanning** and in the **Code scanning results** check on pull requests, and points at the line of the workflow that names the version.
+The action compares the version in `.open-java-format-version` with the latest [open-java-format release](https://github.com/openjavaformat/open-java-format/releases) and warns in the job log when a newer one is out. A log warning is easy to miss, so the check can also be reported to code scanning: the action then uploads a SARIF file with one alert while the version is behind, and with none once it is current, which closes the alert. The alert shows up under **Security → Code scanning** and in the **Code scanning results** check on pull requests, and points at `.open-java-format-version`.
 
 This is off by default, because the upload needs the `security-events: write` permission, which the default token does not have. To turn it on, set `code-scanning: true` and give the job the permission, as in the [second recommended setup](#with-the-version-check-in-code-scanning-too). If the permission is missing anyway, the upload is skipped with a line in the log, the check passes as before, and the log warning stays. Code scanning is free on public repositories; a private repository needs [GitHub Code Security](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository) enabled. Pull requests from forks run with a read-only token and get the log warning only.
 
 One report per job is enough. When the job runs on a matrix, turn it on for one leg only:
 
 ```yaml
         with:
-          version: '2.98.0.6'
           code-scanning: ${{ matrix.os == 'ubuntu-latest' }}
 ```
 
@@ -148,9 +151,7 @@ cp pre-commit .githooks/pre-commit
 git config core.hooksPath .githooks
 ```
 
-The hook automatically downloads the native binary on first run and caches it in `~/.cache/open-java-format`, then checks only staged `.java` files on each commit. It also honours the same [`.open-java-format-exclude`](#excluding-files) file as the action.
-
-The hook pins its own formatter version in `FORMATTER_VERSION` at the top of the script — keep it in step with the `version` your workflow passes to the action.
+The hook reads the version from the same [`.open-java-format-version`](#usage) file as the action and honours the same [`.open-java-format-exclude`](#excluding-files) file. It downloads the native binary on first run and caches it in `~/.cache/open-java-format`, then checks only staged `.java` files on each commit.
 
 ## Supported platforms
 
 
@@ -7,10 +7,6 @@ branding:
   color: 'green'
 
 inputs:
-  version:
-    description: 'Version of open-java-format to use'
-    required: true
-    default: '2.98.0.6'
   mode:
     description: 'Which files to check: "changed" for files from PR/push, "all" for every .java file'
     required: false
@@ -23,6 +19,25 @@ inputs:
 runs:
   using: 'composite'
   steps:
+    - name: Read the open-java-format version
+      id: version
+      shell: bash
+      run: |
+        # The version to check with comes from .open-java-format-version in the repository root,
+        # the file the pre-commit hook reads too, so that the two cannot drift apart.
+        FILE=".open-java-format-version"
+        if [ ! -f "$FILE" ]; then
+          echo "::error::No $FILE in the repository root. Put the open-java-format version to check with in it, one of the releases at https://github.com/openjavaformat/open-java-format/releases, for example: echo 2.98.0.6 > $FILE"
+          exit 1
+        fi
+        VERSION=$(head -n1 "$FILE" | tr -d '[:space:]')
+        if ! [[ "$VERSION" =~ ^[0-9]+(\.[0-9]+)+$ ]]; then
+          echo "::error file=$FILE,line=1::$FILE holds '$VERSION', not an open-java-format version such as 2.98.0.6."
+          exit 1
+        fi
+        echo "Checking with open-java-format $VERSION, from $FILE."
+        echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
     - name: Detect platform
       id: platform
       shell: bash
@@ -61,7 +76,7 @@ runs:
       env:
         GH_TOKEN: ${{ github.token }}
       run: |
-        VERSION="${{ inputs.version }}"
+        VERSION="${{ steps.version.outputs.version }}"
 
         # Best-effort version check — must never fail the build. The GitHub API
         # returns 403 for unauthenticated CI requests (rate limit), so authenticate
@@ -79,24 +94,23 @@ runs:
         if [ -z "$LATEST" ]; then
           echo "Could not check the latest open-java-format version — skipping this check."
         elif [ "$LATEST" != "$VERSION" ]; then
-          echo "::warning::A newer open-java-format version is available: $LATEST (you are using $VERSION)"
+          echo "::warning file=.open-java-format-version,line=1::A newer open-java-format version is available: $LATEST (.open-java-format-version has $VERSION)"
         fi
 
     - name: Report the version check to code scanning
       if: inputs.code-scanning == 'true' && steps.latest.outputs.version != ''
       shell: bash
       env:
         GH_TOKEN: ${{ github.token }}
-        VERSION: ${{ inputs.version }}
+        VERSION: ${{ steps.version.outputs.version }}
         LATEST: ${{ steps.latest.outputs.version }}
       run: |
         # A log warning is easy to miss, so the check is also handed to code scanning: a SARIF
         # file with one alert while a newer release is out, and with none once the version is
-        # current, which closes the alert. The alert sits on the line of this repository's
-        # workflow that names the version, so that it points at what to change. The upload goes
-        # straight to the REST API: github/codeql-action/upload-sarif fails the job when the
-        # permission is missing, and this must stay best-effort, like the check itself — nothing
-        # here may fail the build.
+        # current, which closes the alert. The alert sits on .open-java-format-version, the file
+        # to change. The upload goes straight to the REST API: github/codeql-action/upload-sarif
+        # fails the job when the permission is missing, and this must stay best-effort, like the
+        # check itself — nothing here may fail the build.
         case "$GITHUB_REF" in
           refs/heads/*|refs/tags/*|refs/pull/*) ;;
           *) echo "Code scanning takes no results for ref '$GITHUB_REF' — not reporting the version check."; exit 0 ;;
@@ -108,37 +122,13 @@ runs:
 
         RESULTS='[]'
         if [ "$LATEST" != "$VERSION" ]; then
-          # The first line naming the version: in the workflow that runs this job, then in any
-          # other workflow of the repository (a reusable one, say). Failing that, the line that
-          # uses the action, then the top of the workflow.
-          FILE=""
-          LINE=""
-          PATTERN="(^|[^0-9.])${VERSION//./\\.}([^0-9.]|$)"
-          while IFS= read -r CANDIDATE; do
-            [ -f "$CANDIDATE" ] || continue
-            HIT=$(grep -nE -m1 "$PATTERN" "$CANDIDATE" | cut -d: -f1 || true)
-            if [ -n "$HIT" ]; then
-              FILE="$CANDIDATE"
-              LINE="$HIT"
-              break
-            fi
-          done < <(printf '%s\n' "$WORKFLOW"; find .github/workflows -maxdepth 1 \( -name '*.yml' -o -name '*.yaml' \) 2>/dev/null | sort)
-          if [ -z "$FILE" ] && [ -f "$WORKFLOW" ]; then
-            FILE="$WORKFLOW"
-            LINE=$(grep -nE -m1 'uses:.*open-java-format-action' "$FILE" | cut -d: -f1 || true)
-            LINE="${LINE:-1}"
-          fi
-          if [ -z "$FILE" ]; then
-            echo "No workflow file to put the alert on — not reporting the version check."
-            exit 0
-          fi
-
-          # Code scanning tells alerts apart by this fingerprint, not by the line number. It is
-          # made from the line's text without whitespace, so the alert survives the line moving.
-          TEXT=$(sed -n "${LINE}p" "$FILE" | tr -d '\r')
+          FILE=".open-java-format-version"
+          LINE=1
+          # Code scanning tells alerts apart by this fingerprint, made from the line's text.
+          TEXT=$(head -n1 "$FILE" | tr -d '\r')
           FINGERPRINT=$(printf '%s' "${TEXT//[[:space:]]/}" | git hash-object --stdin)
           RESULTS=$(jq -n \
-            --arg text "open-java-format $LATEST is available; this workflow checks formatting with $VERSION." \
+            --arg text "open-java-format $LATEST is available; $FILE has $VERSION." \
             --arg file "$FILE" --argjson line "$LINE" --argjson end "$(( ${#TEXT} + 1 ))" \
             --arg fingerprint "${FINGERPRINT:0:16}:1" \
             '[{
@@ -155,14 +145,9 @@ runs:
 
         HELP="$RUNNER_TEMP/open-java-format-version-help.md"
         cat > "$HELP" <<'HELP_END'
-        A newer [open-java-format release](https://github.com/openjavaformat/open-java-format/releases) is out than the one this workflow checks formatting with. Releases fix formatting bugs, so code that passes with the pinned version may be formatted differently by the newer one.
-
-        To update:
-
-        - set the `version` input of `openjavaformat/open-java-format-action` to the new release;
-        - if the repository uses the pre-commit hook, set `FORMATTER_VERSION` at the top of it to the same release.
+        A newer [open-java-format release](https://github.com/openjavaformat/open-java-format/releases) is out than the one named in `.open-java-format-version`. Releases fix formatting bugs, so code that passes with the pinned version may be formatted differently by the newer one.
 
-        The alert closes on its own once the workflow runs with the latest release.
+        To update, put the new release in `.open-java-format-version` at the repository root. The action and the pre-commit hook both read that file. The alert closes on its own once the workflow runs with the latest release.
         HELP_END
 
         # One category per workflow and job, so that uploads from different jobs do not replace
@@ -179,7 +164,7 @@ runs:
                 id: "outdated-version",
                 name: "OutdatedVersion",
                 shortDescription: {text: "A newer open-java-format release is available"},
-                fullDescription: {text: "The workflow checks formatting with an open-java-format version older than the latest release. Releases fix formatting bugs, so code that passes with the pinned version may be formatted differently by the newer one."},
+                fullDescription: {text: ".open-java-format-version names an open-java-format version older than the latest release. Releases fix formatting bugs, so code that passes with the pinned version may be formatted differently by the newer one."},
                 help: {text: $help, markdown: $help},
                 defaultConfiguration: {level: "warning"},
                 properties: {tags: ["maintainability"], precision: "very-high", "problem.severity": "warning"}
@@ -224,13 +209,13 @@ runs:
       uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ github.action_path }}/${{ steps.platform.outputs.binary }}
-        key: open-java-format-${{ inputs.version }}-${{ steps.platform.outputs.suffix }}
+        key: open-java-format-${{ steps.version.outputs.version }}-${{ steps.platform.outputs.suffix }}
 
     - name: Download open-java-format native binary
       if: steps.cache.outputs.cache-hit != 'true'
       shell: bash
       run: |
-        VERSION="${{ inputs.version }}"
+        VERSION="${{ steps.version.outputs.version }}"
         SUFFIX="${{ steps.platform.outputs.suffix }}"
         BASE_URL="https://repo1.maven.org/maven2/dev/openjavaformat/open-java-format-native/${VERSION}"
         ARTIFACT="open-java-format-native-${VERSION}-nativeImage-${SUFFIX}.${{ steps.platform.outputs.extension }}"
 
@@ -15,7 +15,6 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Check formatting
-        uses: openjavaformat/open-java-format-action@v3
+        uses: openjavaformat/open-java-format-action@v4
         with:
-          version: '2.98.0.6'
           mode: ${{ github.event_name == 'push' && 'all' || 'changed' }}