fix: pin dependency-audit reusable workflow to SHA

[don-petry]

Pin the reusable workflow reference in .github/workflows/dependency-audit.yml from the mutable @v1 tag to its exact commit SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d, with a # v1 comment for human readability.

The SHA was resolved via the GitHub API (gh api repos/petry-projects/.github/git/refs/tags/v1 --jq '.object.sha'), never guessed.

Closes #86

Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated dependency audit workflow configuration with improved version pinning for enhanced consistency and reliability.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: d4a3f2e0-7d7d-41c1-8a7a-150638e7c43a

📥 Commits

Reviewing files that changed from the base of the PR and between 5f43ff3 and 066902f.

📒 Files selected for processing (1)

• .github/workflows/dependency-audit.yml

---

📝 Walkthrough

Walkthrough

The pull request pins the reusable dependency-audit workflow reference from a semantic @v1 tag to a specific commit SHA (ee22b427...) in .github/workflows/dependency-audit.yml line 33, ensuring reproducible workflow execution.

Changes

Reusable Workflow Reference Pinning

Layer / File(s)	Summary
Reusable workflow reference pinning .github/workflows/dependency-audit.yml	The dependency-audit job uses: reference is updated from the semantic version tag @v1 to a pinned commit SHA, ensuring reproducible and deterministic workflow execution.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related issues

• petry-projects/.github-private#117: Flags the unpinned @v1 reference to petry-projects/.github/.github/workflows/dependency-audit-reusable.yml; this PR resolves it by pinning to a specific commit SHA.
• petry-projects/bmad-bgreat-suite#86: Reports the same unpinned workflow reference issue in this repository; this PR directly addresses the compliance finding.

Possibly related PRs

• petry-projects/bmad-bgreat-suite#78: Previous PR touched the same .github/workflows/dependency-audit.yml file and the dependency-audit-reusable.yml workflow reference; this PR extends that work by pinning the reference to a specific commit SHA.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: pinning a reusable workflow reference to a commit SHA instead of a mutable tag.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-86-20260420-0832

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Self-review: change is a single-line targeted fix — swaps the mutable @v1 tag for the SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d (confirmed via GitHub API) and retains a # v1 comment for readability. No logic changes, no other files touched. Looks good to merge.

@don-petry — you are the CODEOWNERS reviewer for this repo. Please review and merge when ready.

[Copilot]

Pull request overview

Pins the dependency-audit GitHub Actions workflow’s reusable-workflow reference to an immutable commit SHA to satisfy the org action-pinning compliance standard (Issue #86).

Changes:

• Replace @v1 with the exact commit SHA for the dependency-audit-reusable.yml reusable workflow.
• Add a trailing # v1 comment for human-readable version context.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Engine ran but made no changes.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 2b8f00e676d550e408daa68b31dc3f7b878c6b71
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7)

Summary

PR #119 is effectively a no-op: the identical SHA-pinning change was already merged to main via PR #104 on 2026-05-21, leaving this PR with 0 files changed. The original change is a legitimate security improvement (pinning a mutable @v1 tag to a commit SHA), CI is fully green (CodeQL, SonarQube, CodeRabbit all passed), and issue #86 is closed. The pinned SHA (ee22b427) is valid but one version behind the current v1 tag (d3d768da), though this is expected behavior for SHA pinning. This PR is safe to approve but should be closed rather than merged since it introduces no additional changes.

Findings

• INFO: This PR's change was already applied to main by PR #104 (merged 2026-05-21, commit f8a5543). The diff is empty (0 files changed, 0 additions, 0 deletions). This PR should be closed as superseded rather than merged.
• INFO: The pinned SHA (ee22b427cbce9ecadcf2b436acb57c3adf0cb63d) was correct for the v1 tag at PR creation time (2026-04-20), but the v1 tag has since moved to d3d768dabb7f28cc63283cdfe48630da53700e50 (PR #266: rename bot mention trigger). The pinned SHA is still a valid, trusted commit in petry-projects/.github — this is expected behavior for SHA pinning.
• INFO: The underlying change (pinning @v1 to an immutable SHA with a # v1 readability comment) is a correct GitHub Actions supply-chain hardening practice. The SHA was verified via the GitHub API per the PR description.
• INFO: All CI checks passed: CodeQL (SUCCESS), SonarQube Quality Gate (0 new issues, 0 security hotspots), CodeRabbit (APPROVED). No actionable findings from any scanner.

---

Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7). Reply if you need a human review.

[don-petry]

Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead.