chore(ci): pin all GitHub Actions to full-length commit SHAs

[ralphbean]

Summary

• Pin every third-party action in .github/workflows/ and internal/scaffold/fullsend-repo/.github/workflows/ to full-length commit SHAs, preserving versions as YAML comments
• Add .pinact.yaml config (ignores fullsend-ai/* self-references)
• Extend renovate.json to scan scaffold workflow files and keep SHA pins current

Context

Organizations with SHA-pinning enforcement policies (like openkaiden) reject workflows that reference actions by tag alone. This caused dispatch failures (example run).

Self-references (fullsend-ai/fullsend/.github/workflows/reusable-*.yml@v0, fullsend-ai/fullsend/.github/actions/mint-token@v0) are intentionally left unpinned — they use floating tags that track releases.

Test plan

• pinact run --fix=false returns exit 0 for both .github/workflows/ and scaffold files
• make lint passes (including GitHub Actions workflow linter)
• go test ./internal/scaffold/... passes (render tests, workflow alignment tests)
• Pre-existing internal/cli test failures confirmed unrelated

Closes #2385

🤖 Generated with Claude Code

[qodo-code-review]

PR Summary by Qodo

chore(ci): pin GitHub Actions to full-length commit SHAs
⚙️ Configuration changes 🕐 20-40 Minutes

Description

• Pin all third-party GitHub Actions in repo and scaffold workflows to SHAs.
• Add pinact config to enforce pinning while ignoring fullsend-ai self-references.
• Extend Renovate to keep scaffold workflow action SHAs automatically up to date.

Diagram

graph TD
  OrgPolicy{{"SHA-pinning policy"}} --> RepoWF["Repo workflows"] --> ThirdParty["3rd-party actions"]
  OrgPolicy --> ScaffoldWF["Scaffold workflows"] --> ThirdParty
  Pinact["pinact config"] --> RepoWF --> ScaffoldWF
  Renovate["Renovate github-actions"] --> ScaffoldWF

  subgraph Legend
    direction LR
    _pol{{"Policy"}} ~~~ _cfg["Config/Tooling"] ~~~ _wf["Workflows"]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use Renovate-only digest pinning (no pinact)

• ➕ Single automation source for pinning and updates
• ➕ Less local tooling/config to maintain
• ➖ Less immediate enforcement locally/CI without relying on Renovate runs
• ➖ Harder to ensure policy compliance before merge if Renovate lags

2. Use Dependabot for GitHub Actions

• ➕ Native GitHub integration and familiar update PR flow
• ➕ Can update pinned references regularly
• ➖ Digest/SHA pinning behavior and ergonomics are typically weaker than Renovate for actions
• ➖ Less flexibility for ignoring self-references across scaffold templates

3. Centralize action usage via reusable workflows/composite actions

• ➕ Reduces the number of places that need pins
• ➕ Makes future policy changes easier
• ➖ Requires more structural refactoring than a compliance-focused change
• ➖ Doesn’t eliminate the need to pin actions in the centralized layer

Recommendation: Keep the current approach (pin workflows + add pinact rules + extend Renovate). It provides immediate policy compliance, preserves the human-readable version as a comment, and sets up ongoing maintenance for scaffold workflows while explicitly exempting fullsend-ai self-references that are intended to float.

Files changed (21) +91 / -63

Other (21) +91 / -63

branch-cleanup.ymlPin checkout action to full SHA +1/-1

Pin checkout action to full SHA

• Replaces actions/checkout tag reference with a full commit SHA and preserves the version as a comment.

.github/workflows/branch-cleanup.yml

e2e.ymlPin e2e workflow actions (checkout, setup-go, auth, upload-artifact) +5/-5

Pin e2e workflow actions (checkout, setup-go, auth, upload-artifact)

• Pins third-party actions to full SHAs for compliance. Keeps the prior versions as inline YAML comments.

.github/workflows/e2e.yml

lint.ymlPin lint workflow actions (Go/Python/Node, uv, Codecov) +9/-9

Pin lint workflow actions (Go/Python/Node, uv, Codecov)

• Pins all referenced actions to full SHAs across lint/test/web jobs. Retains original version tags as comments for readability.

.github/workflows/lint.yml

pat-cleanup.ymlPin checkout and setup-go actions +2/-2

Pin checkout and setup-go actions

• Switches actions/checkout and actions/setup-go from tags to full commit SHAs with version comments.

.github/workflows/pat-cleanup.yml

release.ymlPin release workflow actions (checkout, setup-go, cosign, goreleaser) +4/-4

Pin release workflow actions (checkout, setup-go, cosign, goreleaser)

• Pins all third-party actions used in the release job to full SHAs. Preserves version intent via comments.

.github/workflows/release.yml

reusable-code.ymlPin checkout action in reusable code workflow +3/-3

Pin checkout action in reusable code workflow

• Pins actions/checkout to a full SHA for config/upstream/target repository checkouts while leaving fullsend-ai repo refs unchanged.

.github/workflows/reusable-code.yml

reusable-dispatch.ymlPin checkout action in reusable dispatch workflow +1/-1

Pin checkout action in reusable dispatch workflow

• Pins the caller-repo checkout action to a full SHA and keeps the version comment.

.github/workflows/reusable-dispatch.yml

reusable-fix.ymlPin checkout action in reusable fix workflow +3/-3

Pin checkout action in reusable fix workflow

• Pins actions/checkout to a full SHA for config/upstream/target repo checkouts, maintaining version comments.

.github/workflows/reusable-fix.yml

reusable-prioritize.ymlPin checkout action in reusable prioritize workflow +2/-2

Pin checkout action in reusable prioritize workflow

• Pins actions/checkout references to full SHAs while preserving prior versions as comments.

.github/workflows/reusable-prioritize.yml

reusable-retro.ymlPin checkout action in reusable retro workflow +3/-3

Pin checkout action in reusable retro workflow

• Pins all actions/checkout usages in the workflow to full commit SHAs with version comments.

.github/workflows/reusable-retro.yml

reusable-review.ymlPin checkout action in reusable review workflow +3/-3

Pin checkout action in reusable review workflow

• Pins actions/checkout to a full SHA for config/upstream/target checkouts and preserves version comments.

.github/workflows/reusable-review.yml

reusable-triage.ymlPin checkout action in reusable triage workflow +3/-3

Pin checkout action in reusable triage workflow

• Pins actions/checkout to full SHAs across checkout steps, leaving the workflow logic intact.

.github/workflows/reusable-triage.yml

sandbox-images.ymlNormalize action version comments for docker actions +9/-9

Normalize action version comments for docker actions

• Keeps existing SHA pins but updates the version comments to full semantic versions for docker actions to match the new convention.

.github/workflows/sandbox-images.yml

site-build.ymlPin site build workflow actions +3/-3

Pin site build workflow actions

• Pins checkout/setup-node/upload-artifact actions to full SHAs, preserving prior versions as comments.

.github/workflows/site-build.yml

site-deploy.ymlPin site deploy workflow actions +7/-7

Pin site deploy workflow actions

• Pins checkout/setup-node/download-artifact/github-script/wrangler-action to full SHAs to satisfy SHA-pinning policies.

.github/workflows/site-deploy.yml

stale.ymlPin stale action to full SHA +1/-1

Pin stale action to full SHA

• Replaces actions/stale tag usage with a full commit SHA and keeps the version comment.

.github/workflows/stale.yml

.pinact.yamlAdd pinact configuration for scaffold workflows and ignore rules +15/-0

Add pinact configuration for scaffold workflows and ignore rules

• Adds pinact config to scan scaffold workflow templates and defines an ignore rule for fullsend-ai/* self-references that should remain tag-based.

.pinact.yaml

dispatch.ymlPin checkout action in scaffold dispatch workflow +1/-1

Pin checkout action in scaffold dispatch workflow

• Pins actions/checkout to a full SHA within the scaffolded dispatch workflow template, preserving the original version comment.

internal/scaffold/fullsend-repo/.github/workflows/dispatch.yml

prioritize-scheduler.ymlPin checkout action in scaffold prioritize scheduler +1/-1

Pin checkout action in scaffold prioritize scheduler

• Pins actions/checkout to a full SHA in the scaffold workflow template.

internal/scaffold/fullsend-repo/.github/workflows/prioritize-scheduler.yml

repo-maintenance.ymlPin checkout action in scaffold repo maintenance workflow +2/-2

Pin checkout action in scaffold repo maintenance workflow

• Pins actions/checkout to full SHAs for both .fullsend and upstream script checkouts in the scaffold template.

internal/scaffold/fullsend-repo/.github/workflows/repo-maintenance.yml

renovate.jsonTeach Renovate to scan scaffold workflow templates and ignore self-references +13/-0

Teach Renovate to scan scaffold workflow templates and ignore self-references

• Adds github-actions manager fileMatch for internal/scaffold workflow YAML and disables updates for fullsend-ai/* action references to preserve floating self tags.

renovate.json

[github-actions]

Site preview

Preview: https://f878ef73-site.fullsend-ai.workers.dev

Commit: 392be785490ef54e19306ed969d4b595a823da98

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 📜 Skill insights (0)

Context used

✅ Tickets: 🎫 fullsend dispatch task is not triggered due to SHA enforcement

✅ Compliance rules (platform): 58 rules

✅ Skills: writing-user-docs, writing-adrs

1. Renovate skips root workflows 🐞 Bug ⚙ Maintainability

Description

renovate.json restricts the GitHub Actions manager fileMatch to only internal/scaffold/...
workflow paths, which can prevent Renovate from scanning .github/workflows/*.yml and thus stop
SHA-pin updates for the repo’s main workflows.

Code

renovate.json[R7-11]

+  "github-actions": {
+    "fileMatch": [
+      "^internal/scaffold/.*\\.github/workflows/[^/]+\\.ya?ml$"
+    ]
+  },

Relevance

⭐⭐⭐ High

Team accepts path/regex correctness fixes; Renovate added recently (#2315) and regex anchoring fixes
accepted (#2398).

PR-#2315
PR-#2398

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Renovate is configured to match only scaffold workflow paths, while the repo’s real workflows live
under .github/workflows/ and therefore don’t match this regex.

renovate.json[7-11]
.github/workflows/e2e.yml[1-26]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`renovate.json` sets `github-actions.fileMatch` to only match scaffold workflow files. This can exclude `.github/workflows/*.yml` from Renovate’s GitHub Actions manager scanning, meaning the newly SHA-pinned actions in the main workflows won’t be kept up to date.

### Issue Context
The repo contains primary workflows under `.github/workflows/` (e.g. `e2e.yml`). After this change, only `internal/scaffold/.../.github/workflows/...` paths match the configured regex.

### Fix Focus Areas
- renovate.json[7-11]

### Suggested fix
Update `github-actions.fileMatch` to include both the default workflow location and the scaffold location, e.g.:
```json
"github-actions": {
 "fileMatch": [
   "^\\.github/workflows/[^/]+\\.ya?ml$",
   "^internal/scaffold/.*\\.github/workflows/[^/]+\\.ya?ml$"
 ]
}
```
(Keep your existing `packageRules` behavior unchanged.)

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:30 PM UTC · Completed 2:40 PM UTC
Commit: fc41cf3 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/workflows/*, .github/actions/*, .pinact.yaml — This PR modifies 18 workflow/action files under .github/ and adds .pinact.yaml, which are protected paths requiring human approval. The PR links to issue fullsend dispatch task is not triggered due to SHA enforcement #2385 and explains the rationale (SHA-pinning enforcement for openkaiden org compliance). Protected-path changes always require human review regardless of context.

• [edge-case] .github/workflows/renovate.yml — This file is not included in the PR's changed files, yet it contains three unpinned third-party action references: actions/checkout@v7 (line 33), actions/create-github-app-token@v3 (line 35), and renovatebot/github-action@v46 (line 41). This is inconsistent with the PR's stated goal of pinning all third-party GitHub Actions to full-length commit SHAs.
  Remediation: Add renovate.yml to this PR and pin all three third-party action references to their corresponding full-length commit SHAs.

Low

• [architectural-fit] .pinact.yaml — This PR introduces pinact as a new tool dependency for SHA-pin management. The configuration is sound (ignores fullsend-ai/* self-references), but the tool adoption is not documented beyond the config file itself. Consider noting this in project documentation if pinact becomes a long-term dependency.

Previous run

Review

Findings

Medium

• [protected-path] .github/workflows/*, .github/actions/*, .pinact.yaml — This PR modifies 18 workflow/action files under .github/ and adds .pinact.yaml, which are protected paths requiring human approval. The PR links to issue fullsend dispatch task is not triggered due to SHA enforcement #2385 and explains the rationale (SHA-pinning enforcement for openkaiden org compliance). Protected-path changes always require human review regardless of context.

Low

• [version-upgrade] .github/workflows/functional-tests.yml — The diff bundles major version bumps alongside SHA pinning: google-github-actions/auth v2→v3, actions/checkout v6→v7, actions/setup-go v5→v6, actions/upload-artifact v4→v7. These upgrades align functional-tests.yml with versions already used elsewhere in the repo (e.g., e2e.yml, setup-gcp/action.yml), so compatibility risk is low. The PR description does not explicitly call out these version bumps.

• [architectural-fit] .pinact.yaml — This PR introduces pinact as a new tool dependency for SHA-pin management. The configuration is sound (ignores fullsend-ai/* self-references), but the tool adoption is not documented beyond the config file itself. Consider noting this in project documentation if pinact becomes a long-term dependency.

Previous run (2)

Review

Findings

Medium

• [edge case] .github/workflows/functional-tests.yml — This file is not included in the PR's changed files, yet it uses tag-only action references (actions/checkout@v6.0.2, actions/setup-go@v5, actions/setup-python@v6.2.0, astral-sh/setup-uv@v7.6.0, google-github-actions/auth@v2, actions/upload-artifact@v4). This is inconsistent with the PR's stated goal of pinning "every third-party action to full-length commit SHAs."
  Remediation: Add functional-tests.yml to this PR, pinning all third-party action references to SHAs.

• [protected-path] .github/workflows/*, .github/actions/*, .pinact.yaml — This PR modifies 17 workflow/action files under .github/ and adds .pinact.yaml, which are protected paths requiring human approval. The PR links to issue fullsend dispatch task is not triggered due to SHA enforcement #2385 and explains the rationale (SHA-pinning enforcement for openkaiden org compliance). Protected-path changes always require human review regardless of context.

Low

• [logic error] .github/actions/setup-gcp/action.yml:20 — The PR pins google-github-actions/auth to SHA 7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 with comment # v3.0.0. If this SHA corresponds to v3.0.0 rather than the latest v3.x patch, future patch fixes would be missed until Renovate bumps it. Risk is mitigated by the Renovate configuration added in this PR.
  Remediation: Verify the SHA corresponds to the latest v3.x tag.

• [API contract] renovate.json — matchPackagePatterns is deprecated in Renovate v38+ in favor of matchPackageNames (which now accepts regex patterns natively). While matchPackagePatterns still works today via internal migration, Renovate logs a deprecation warning and may drop support in a future major release.
  Remediation: Replace "matchPackagePatterns": ["^fullsend-ai/"] with "matchPackageNames": ["/^fullsend-ai\\//"] (Renovate regex pattern syntax uses leading/trailing slashes).

• [scope-alignment] — The PR scope extends beyond the immediate failure described in issue fullsend dispatch task is not triggered due to SHA enforcement #2385 (dispatch workflow failure in openkaiden) to pin all third-party actions repo-wide. This is consistent with the PR's stated intent and good security practice, but the scope expansion from "fix one dispatch failure" to "adopt repo-wide SHA pinning with automated maintenance" is worth noting.

Previous run (3)

Review

Findings

Medium

• [protected-path] .github/workflows/*, .pinact.yaml — This PR modifies 16 workflow files under .github/ and adds .pinact.yaml, which are protected paths requiring human approval. The PR links to issue fullsend dispatch task is not triggered due to SHA enforcement #2385 and explains the rationale (SHA-pinning enforcement for openkaiden org compliance). Protected-path changes always require human review regardless of context.

Low

• [API contract] renovate.json — matchPackagePatterns is deprecated in Renovate v38+ in favor of matchPackageNames (which now accepts regex patterns natively). While matchPackagePatterns still works today via internal migration, Renovate logs a deprecation warning and may drop support in a future major release.
  Remediation: Replace "matchPackagePatterns": ["^fullsend-ai/"] with "matchPackageNames": ["/^fullsend-ai\\//"] (Renovate regex pattern syntax uses leading/trailing slashes).

---

Labels: PR modifies CI workflow files for supply chain security hardening.

Previous run (4)

Review

Findings

Medium

• [protected-path] .github/workflows/*, .pinact.yaml — This PR modifies 16 workflow files under .github/ and adds .pinact.yaml, which are protected paths requiring human approval. The PR links to issue fullsend dispatch task is not triggered due to SHA enforcement #2385 and explains the rationale (SHA-pinning enforcement for openkaiden org compliance). Protected-path changes always require human review regardless of context.

Low

• [API contract] renovate.json — matchPackagePatterns is deprecated in Renovate v38+ in favor of matchPackageNames (which now accepts regex patterns natively). While matchPackagePatterns still works today via internal migration, Renovate logs a deprecation warning and may drop support in a future major release.
  Remediation: Replace "matchPackagePatterns": ["^fullsend-ai/"] with "matchPackageNames": ["/^fullsend-ai\\//"] (Renovate regex pattern syntax uses leading/trailing slashes).

Previous run (5)

Review

Findings

Medium

• [protected-path] .github/workflows/* — This PR modifies 16 files under .github/, which is a protected path requiring human approval. The PR links to issue fullsend dispatch task is not triggered due to SHA enforcement #2385 and explains the rationale (SHA-pinning enforcement for openkaiden org compliance). Protected-path changes always require human review regardless of context.

Low

• [API contract] renovate.json — matchPackagePatterns is deprecated in Renovate v38+ in favor of matchPackageNames (which now accepts regex patterns natively). While matchPackagePatterns still works today via internal migration, Renovate logs a deprecation warning and may drop support in a future major release.
  Remediation: Replace "matchPackagePatterns": ["^fullsend-ai/"] with "matchPackageNames": ["/^fullsend-ai\\//"] (Renovate regex pattern syntax uses leading/trailing slashes).

---

Labels: PR modifies CI workflow files for supply chain security hardening.

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[low] API contract

matchPackagePatterns is deprecated in Renovate v38+ in favor of matchPackageNames (which now accepts regex patterns natively). While matchPackagePatterns still works today via internal migration, Renovate logs a deprecation warning and may drop support in a future major release.

Suggested fix: Replace "matchPackagePatterns": ["^fullsend-ai/"] with "matchPackageNames": ["/^fullsend-ai\\//"] (Renovate regex pattern syntax uses leading/trailing slashes).

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:55 PM UTC · Completed 3:04 PM UTC
Commit: fc41cf3 · View workflow run →

[waynesun09]

Review Squad — 4 findings (MEDIUM+)

Agents: 4 (claude-coder, claude-researcher, gemini-code-review, cursor-code-review)
Models: Claude, Gemini, Codex

---

[HIGH] Unpinned google-github-actions/auth@v3 in composite action

File: .github/actions/setup-gcp/action.yml:20 (not in this diff — file-level comment below)

This composite action references google-github-actions/auth@v3 with a floating tag, but the same action was SHA-pinned in e2e.yml to 7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0. Since setup-gcp is called by 6+ reusable workflows (review, triage, retro, code, fix, prioritize), it has a wider attack surface than the single e2e.yml reference that was pinned.

Orgs with SHA-pinning enforcement (like openkaiden) will reject workflows that transitively call this unpinned action.

Suggestion: Pin to google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0

[waynesun09]

[high] .pinact.yaml does not cover composite action files

The files section only covers scaffold workflows. It does not include .github/actions/*/action.yml, so pinact won't lint composite actions for unpinned third-party references. The setup-gcp action already has an unpinned google-github-actions/auth@v3 (line 20) that pinact should catch.

Suggestion: Add a pattern for composite actions:

files:
  - pattern: "internal/scaffold/fullsend-repo/.github/workflows/*.yml"
  - pattern: ".github/actions/*/action.yml"

[waynesun09]

[medium] actions/checkout pinned to v6.0.2 while all other main workflows use v7.0.0

This pre-existing pin was not updated by this PR. Every other workflow in .github/workflows/ now uses actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0.

Suggestion: Either upgrade to v7.0.0 for consistency or add a comment explaining why v6.0.2 is intentionally retained here.

[waynesun09]

[medium] Scaffold workflows pin actions/checkout to v6.0.3 while main workflows use v7.0.0

All three scaffold workflows (dispatch.yml, prioritize-scheduler.yml, repo-maintenance.yml) use actions/checkout@df4cb1c0... (v6.0.3), while main .github/workflows/ files use v7.0.0. These templates render into customer repos, so the divergence may be intentional for compatibility.

Suggestion: If intentional, add a comment documenting why. Otherwise, update to v7.0.0 — Renovate will keep them synced going forward.

[ralphbean]

Pushed 9aa8f24. Pinned google-github-actions/auth to SHA in setup-gcp, bumped actions/checkout to v7.0.0 in sandbox-images and the three scaffold workflows, and added the composite action glob to .pinact.yaml. Should cover all the version alignment items.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:24 PM UTC · Completed 8:37 PM UTC
Commit: 9aa8f24 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[low] logic error

The PR pins google-github-actions/auth to SHA 7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 with comment v3.0.0. If this SHA corresponds to v3.0.0 rather than the latest v3.x patch, future patch fixes would be missed until Renovate bumps it.

Suggested fix: Verify the SHA corresponds to the latest v3.x tag.

[waynesun09]

Review Squad — 2 findings (MEDIUM+)

Agents: 4 (claude-coder, claude-researcher, gemini-code-review, cursor-code-review)
Models: Claude, Gemini, Codex

---

[HIGH] functional-tests.yml missing from PR branch — 6 unpinned third-party actions

functional-tests.yml exists on main but is absent from the pin-actions-to-sha branch (merged after the branch was cut). It still contains 6 unpinned third-party actions using mutable tags:

• actions/checkout@v6.0.2 (line 29)
• actions/setup-go@v5 (line 33)
• actions/setup-python@v6.2.0 (line 37)
• astral-sh/setup-uv@v7.6.0 (line 42)
• google-github-actions/auth@v2 (line 145)
• actions/upload-artifact@v4 (line 171)

Orgs with SHA-pinning enforcement (openkaiden) will reject this workflow. The auth@v2 reference is especially sensitive since it handles WIF credentials.

Suggestion: Rebase onto current main and pin these 6 actions to full-length SHAs.

Flagged by: claude-coder, claude-researcher, gemini-code-review (3/4 agents)

[waynesun09]

Inline finding posted separately — see below.

[waynesun09]

[medium] .pinact.yaml files: missing .github/workflows/*.yml pattern

The files: key in pinact v3 replaces the default scan paths when present. This config covers scaffold workflows and composite actions, but not the 14+ main workflow files under .github/workflows/. Future unpinned actions added to those files won't be caught by pinact run.

Suggestion: Add the missing pattern:

files:
  - pattern: ".github/workflows/*.yml"
  - pattern: "internal/scaffold/fullsend-repo/.github/workflows/*.yml"
  - pattern: ".github/actions/*/action.yml"

Flagged by: gemini-code-review, verified against pinact v3 docs

[ralphbean]

Rebased on main and pushed 0b6dea8. That picks up functional-tests.yml and pins all 6 of its third-party actions to SHAs (aligned with the rest of the repo — checkout v7.0.0, setup-go v6.4.0, auth v3.0.0, upload-artifact v7.0.1).

Also addressed the other findings:

• Added .github/workflows/*.yml to .pinact.yaml so main workflows stay linted
• Replaced deprecated matchPackagePatterns with matchPackageNames in renovate.json

Scaffold checkout versions were already at v7.0.0 from 216182b.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:36 PM UTC · Completed 9:48 PM UTC
Commit: 0b6dea8 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:57 PM UTC · Completed 3:08 PM UTC
Commit: 392be78 · View workflow run →

[ben-alkov]

LGTM

[ralphbean]

Merge queue ejection here was the e2e TestVendorFromSubdirectory hitting 422 Update is not a fast forward during scaffold push — the async auto_init race. Should be fixed once #2491 lands.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 6:15 PM UTC · Completed 6:24 PM UTC
Commit: 392be78 · View workflow run →

[fullsend-ai-retro]

Retro: PR #2508 — Pin GitHub Actions to SHA

Timeline: Human-authored PR by ralphbean to SHA-pin all third-party GitHub Actions across 22 files. The fullsend review agent ran 4 times across 3 push cycles. It found 2 medium and 1 low finding — a protected-path flag (expected), 3 unpinned actions in renovate.yml, and a suggestion to document the new pinact dependency. A human reviewer (waynesun09, assisted by a 4-agent "Review Squad") found 4 additional high/medium findings the bot missed: an unpinned google-github-actions/auth@v3 in a composite action outside the diff, 6 unpinned actions in functional-tests.yml (absent from the branch), and .pinact.yaml configuration gaps where the files: key silently replaced default scan paths. The PR author addressed all human feedback across 2 additional commits before approval.

Review quality gap: The review bot's findings were valid but shallow. The human reviewer caught all the issues that required looking beyond the diff — checking whether the PR achieved its stated goal of pinning "all" actions. The bot's inline comment about deprecated matchPackagePatterns was valuable and acted upon.

Rework: 3 commits total (1 initial + 2 fix rounds). The 2 fix rounds were driven entirely by human review findings, not bot findings.

Existing issue overlap: #2384 (validate external tool config against execution model) covers the .pinact.yaml semantic gap. #1275 (trace workflow_call chains) is related but narrower than the completeness-checking gap identified here.

1 proposal filed — intent-scoped completeness checking for the review agent.

Proposals filed

• Review agent: verify diff completeness against PR's stated scope for bulk-change PRs (in fullsend-ai/fullsend)