From f051dbd8deddfe2e1b442464b2a672e54db5eaf9 Mon Sep 17 00:00:00 2001 From: Wayne Sun Date: Wed, 24 Jun 2026 14:58:09 -0400 Subject: [PATCH 1/2] fix(scaffold): use __FULLSEND_AI_REF__ for mint-token action refs Replace hardcoded @v0 with __FULLSEND_AI_REF__ placeholder for the mint-token composite action in prioritize-scheduler and repo-maintenance scaffold templates. At scaffold time the placeholder is replaced with a SHA pin, matching the pattern already used by reusable workflow refs. Without this, downstream .fullsend repos that enable sha_pinning_required reject mint-token@v0 as an unpinned action ref. Assisted-by: Claude Signed-off-by: Wayne Sun --- .../fullsend-repo/.github/workflows/prioritize-scheduler.yml | 2 +- .../fullsend-repo/.github/workflows/repo-maintenance.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/internal/scaffold/fullsend-repo/.github/workflows/prioritize-scheduler.yml b/internal/scaffold/fullsend-repo/.github/workflows/prioritize-scheduler.yml index 0d453b7f83..612408e69c 100644 --- a/internal/scaffold/fullsend-repo/.github/workflows/prioritize-scheduler.yml +++ b/internal/scaffold/fullsend-repo/.github/workflows/prioritize-scheduler.yml @@ -35,7 +35,7 @@ jobs: - name: Mint fullsend token id: app-token - uses: fullsend-ai/fullsend/.github/actions/mint-token@v0 + uses: fullsend-ai/fullsend/.github/actions/mint-token@__FULLSEND_AI_REF__ with: role: fullsend repos: .fullsend diff --git a/internal/scaffold/fullsend-repo/.github/workflows/repo-maintenance.yml b/internal/scaffold/fullsend-repo/.github/workflows/repo-maintenance.yml index 192621f345..5a402c470e 100644 --- a/internal/scaffold/fullsend-repo/.github/workflows/repo-maintenance.yml +++ b/internal/scaffold/fullsend-repo/.github/workflows/repo-maintenance.yml @@ -67,7 +67,7 @@ jobs: - name: Mint fullsend token if: steps.repo-list.outputs.skip != 'true' id: app-token - uses: fullsend-ai/fullsend/.github/actions/mint-token@v0 + uses: fullsend-ai/fullsend/.github/actions/mint-token@__FULLSEND_AI_REF__ with: role: fullsend repos: ${{ steps.repo-list.outputs.names }} From 9111c9cd2bc6859d4ef3613c91ccc10fd0c78a2f Mon Sep 17 00:00:00 2001 From: Wayne Sun Date: Wed, 24 Jun 2026 17:17:45 -0400 Subject: [PATCH 2/2] fix(scaffold): update tests for mint-token __FULLSEND_AI_REF__ change Update scaffold_test.go assertions to expect mint-token@__FULLSEND_AI_REF__ instead of mint-token@v0, matching the template change. Assisted-by: Claude Signed-off-by: Wayne Sun --- internal/scaffold/scaffold_test.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/internal/scaffold/scaffold_test.go b/internal/scaffold/scaffold_test.go index 5725da0234..3f8672620c 100644 --- a/internal/scaffold/scaffold_test.go +++ b/internal/scaffold/scaffold_test.go @@ -718,7 +718,7 @@ func TestRepoMaintenanceWorkflowContent(t *testing.T) { "push trigger must include workflow_call shim template so changes propagate to enrolled repos") assert.NotContains(t, s, "templates/shim-workflow.yaml", "PAT shim template reference should be removed") - assert.Contains(t, s, "fullsend-ai/fullsend/.github/actions/mint-token@v0") + assert.Contains(t, s, "fullsend-ai/fullsend/.github/actions/mint-token@__FULLSEND_AI_REF__") assert.Contains(t, s, "Checkout upstream scripts") assert.Contains(t, s, "Prepare scripts") assert.Contains(t, s, "customized/scripts") @@ -799,7 +799,7 @@ func TestPrioritizeSchedulerWorkflowContent(t *testing.T) { require.NotEqual(t, -1, guardIndex) require.NotEqual(t, -1, projectViewIndex) assert.Less(t, guardIndex, projectViewIndex, "PROJECT_NUMBER must be checked before gh project view") - assert.Contains(t, s, "fullsend-ai/fullsend/.github/actions/mint-token@v0") + assert.Contains(t, s, "fullsend-ai/fullsend/.github/actions/mint-token@__FULLSEND_AI_REF__") assert.Contains(t, s, "role: fullsend") assert.Contains(t, s, "id-token: write") assert.NotContains(t, s, "create-github-app-token")