Skip to content

fix(ci): include root action.yml in pinact and pre-commit checks #2622

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ralphbean merged 2 commits into from
Jun 24, 2026
Merged

fix(ci): include root action.yml in pinact and pre-commit checks #2622

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
77294c7
fix(ci): include root action.yml in pinact and pre-commit checks
ralphbean Jun 24, 2026
52f61ba
fix(ci): extend pinact patterns to cover .yaml workflow extensions
ralphbean Jun 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .pinact.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,11 @@ version: 3

files:
- pattern: ".github/workflows/*.yml"
- pattern: ".github/workflows/*.yaml"
- pattern: "internal/scaffold/fullsend-repo/.github/workflows/*.yml"
Comment on lines 6 to 8

@qodo-code-review qodo-code-review Bot Jun 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. Workflows .yaml not scanned 🐞 Bug ≡ Correctness

.pinact.yaml only matches .github/workflows/*.yml, but the repo contains
.github/workflows/fullsend.yaml, so pinact will never scan that workflow and unpinned uses: refs
in .yaml workflows can bypass the SHA-pin gate. This is especially risky because CI runs
pre-commit run --all-files, which will run pinact, but pinact itself still ignores .yaml
workflows due to the configured files: patterns.
Agent Prompt 
## Issue description
`.pinact.yaml` scopes pinact to `*.yml` workflows only, but the repo contains at least one `.yaml` workflow. Because pinact v3+ treats `files:` as an override scope, `.yaml` workflows are skipped entirely, allowing unpinned `uses:` refs in those files to slip through.

## Issue Context
CI runs `make lint-all` which executes `pre-commit run --all-files`. The pinact hook runs, but pinact only scans files matched by `.pinact.yaml`’s `files:` list.

## Fix Focus Areas
- .pinact.yaml[5-9]
  - Add an additional pattern for `.github/workflows/*.yaml` (and consider the same for the internal scaffold workflows for consistency), or replace with a glob that matches both extensions if supported (e.g., two explicit patterns).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

- pattern: "internal/scaffold/fullsend-repo/.github/workflows/*.yaml"
- pattern: ".github/actions/*/action.yml"
- pattern: "action.yml"
Comment on lines 10 to +11

@qodo-code-review qodo-code-review Bot Jun 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

2. New scan breaks lint-all 🐞 Bug ☼ Reliability

By adding root action.yml to pinact’s scan scope, CI (make lint-all) will now fail because
action.yml currently contains tag-based uses: references (e.g., actions/setup-go@v6) that
pinact flags as unpinned. This change introduces a new failing lint gate unless those references are
SHA-pinned (or explicitly ignored).
Agent Prompt 
## Issue description
The PR expands pinact coverage to include the repository root `action.yml`. That file currently contains unpinned `uses: owner/repo@vX` references, which will cause `pinact run --fix=false` (invoked by pre-commit in CI) to fail.

## Issue Context
CI runs `make lint-all` → `pre-commit run --all-files`, and the pinact hook executes `pinact run --fix=false --no-api`.

## Fix Focus Areas
- action.yml[230-235]
- action.yml[281-284]
- action.yml[424-427]
  - Replace tag-based refs with SHA-pinned refs (optionally retaining the tag in a trailing comment, consistent with other workflows in the repo).
- .pinact.yaml[5-9]
  - Keep `action.yml` in scope once the file is compliant.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


rules:
# Ignore self-references to this repo's own reusable workflows and actions.
Expand Down
1 change: 1 addition & 0 deletions .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,7 @@ repos:
\.github/workflows/
|\.github/actions/
|internal/scaffold/fullsend-repo/\.github/workflows/
|action\.yml$
)
pass_filenames: false

Expand Down
Loading