ci: repin Depot PR isolation audit

[ndizazzo]

Summary

• repin all protected PR audit callers to the reviewed bounded-exception-aware action revision
• update the exact audit pin contract expectation
• preserve workflow graph, matrices, commands, cache-policy inputs, and artifacts

Root cause

The live Depot PR canary selected the intended Depot runners and emitted allow_native_github_cache=true, but callers still executed the older audit revision, which rejected that approved bounded-exception combination before checkout.

Validation

• just ci-validate (461 tests, 7 expected skips)
• actionlint -config-file .github/actionlint.yaml
• 66 focused CI policy/audit tests
• git diff --check
• census: 22 workflow refs at the new immutable SHA, zero old or @main refs

Summary by CodeRabbit

• Chores

  • Updated the pinned CI isolation action across Linux, macOS, Windows, SDK, artifact, quality, and testing workflows.
  • Standardized workflow checks on the newer action revision without changing job behavior or inputs.

• Tests

  • Updated CI artifact validation to expect the refreshed protected checkout action revision.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c33812bf-b161-4293-9a95-a9cd70a02e72

📥 Commits

Reviewing files that changed from the base of the PR and between 95c832e and 4f83aed.

📒 Files selected for processing (18)

• .github/workflows/ci-linux-host-slice.yml
• .github/workflows/ci-linux-product-slice.yml
• .github/workflows/ci-linux-runtime-slice.yml
• .github/workflows/ci-macos-host-slice.yml
• .github/workflows/ci-macos-product-slice.yml
• .github/workflows/ci-macos-runtime-slice.yml
• .github/workflows/ci-platform-checks-slice.yml
• .github/workflows/ci-quality-slice.yml
• .github/workflows/ci-rust-tests-slice.yml
• .github/workflows/ci-ui-artifact-slice.yml
• .github/workflows/ci-web-slice.yml
• .github/workflows/ci-windows-host-slice.yml
• .github/workflows/ci-windows-product-slice.yml
• .github/workflows/ci-windows-runtime-slice.yml
• .github/workflows/native-sdk-artifact.yml
• .github/workflows/static-abi-artifact.yml
• .github/workflows/swift-sdk-artifact.yml
• scripts/tests/test_ci_artifact_actions.py

---

📝 Walkthrough

Walkthrough

The pull request updates audit-depot-pr-isolation references across CI and artifact workflows to commit ed07043b84d720aab30e75ed2f038f7042576f16. It also updates the expected SHA in the protected pre-checkout test.

Changes

Audit action pin refresh

Layer / File(s)	Summary
Platform CI workflow pins .github/workflows/ci-linux-*-slice.yml, .github/workflows/ci-macos-*-slice.yml, .github/workflows/ci-platform-checks-slice.yml, .github/workflows/ci-windows-*-slice.yml	Linux, macOS, Windows, and platform-check jobs now use the updated pinned action revision.
Quality and web workflow pins .github/workflows/ci-quality-slice.yml, .github/workflows/ci-rust-tests-slice.yml, .github/workflows/ci-ui-artifact-slice.yml, .github/workflows/ci-web-slice.yml	Quality, Rust test, UI artifact, and web jobs now use the updated pinned action revision.
Artifact workflow pins and validation .github/workflows/native-sdk-artifact.yml, .github/workflows/static-abi-artifact.yml, .github/workflows/swift-sdk-artifact.yml, scripts/tests/test_ci_artifact_actions.py	Artifact workflows and the protected pre-checkout validation now use the updated action SHA.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 4f83a

This PR repins protected PR audit callers to the reviewed immutable revision and updates the pin contract without changing workflow behavior; validation passes and all 22 references use the new pin, so no actionable merge-blocking risk remains.

Possibly related PRs

• Mesh-LLM/mesh-llm#1319: Updates the same action references and artifact test SHA.
• Mesh-LLM/mesh-llm#1333: Changes the policy behavior of the same audit action.
• Mesh-LLM/mesh-llm#1334: Updates and validates the same pinned action references.

Suggested labels: experimental

Suggested reviewers: i386, michaelneale

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: repinning the Depot PR isolation audit action.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/depot-pr-audit-repin

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}