fix(ci): repair dead $/ ref and the pin detector blind to it

[hyperpolymath]

A workflow has been dead at startup on main for a month, and the gate that should have caught it could not fire

The defect

.github/workflows/signed-push-smoke.yml:56 on main reads:

        uses: $/.github/actions/signed-push

$/... is not valid uses: syntax. GitHub rejects the workflow at startup, so no job of it ever runs — this is not a failing step, it is a workflow that never begins. Measured:

$ gh run list --workflow signed-push-smoke.yml --branch main --limit 5
failure  2026-08-24T10:36:52Z  70cdad0e
failure  2026-08-24T10:10:11Z  c65070f9
failure  2026-08-24T07:46:09Z  a22a7abf
failure  2026-08-24T05:49:38Z  19bccaf0
failure  2026-08-24T05:34:12Z  6f458383

Five failures, and the most recent is 2026-08-24 — the signed-push smoke test has been silent for a month. This is the gh actions-lock rewrite-mode corruption already on record (it also de-pinned 24 SHAs); the correct form for a local action is uses: ./.github/actions/<name>.

Why validate-sha-pins.sh reported a clean tree over it

Two defects, and the second hid the first.

1 — the selector was too narrow. It required a ref to start [A-Za-z0-9]. $ is not alphanumeric, so the line was dropped before any exemption arm saw it. The ref was never reported and the gate went green.

2 — the cure attempted for (1) was dead code. A second grep was added inside the same brace group:

{ grep -nE '...[A-Za-z0-9]' | grep -v ... || true;
  grep -nE 'uses:[[:space:]]+\$/' || true; } < "$file"

Both greps share one stdin. The first reads it to EOF; the second is handed an exhausted stream. Measured directly:

$ grep -nE 'uses:[[:space:]]+\$/' .github/workflows/signed-push-smoke.yml
56:        uses: $/.github/actions/signed-push          # matches in isolation

$ { grep -nE '...[A-Za-z0-9]' | ... ; grep -nE 'uses:[[:space:]]+\$/' ; } < <same file>
(no output)                                            # emits nothing in place

A second reader of one stdin is never a second chance.

Retraction

That arm's comment asserted "Zero matches tree-wide today; this arm is purely prospective." That claim was mine and it was false: signed-push-smoke.yml carried a live $/ ref the entire time. I am retracting it here. It was true only of the feature branch I measured on; main was never checked. This is also why the $/ exemption proposed in 66f26bfe was the wrong direction — it would have taught the detector to wave through real, live corruption on the default branch rather than catch it.

The fix

One pipeline, no brace group. The first selector now matches any non-blank ref, so an unknown-shaped ref is reported rather than silently skipped. The exemptions — ./, ../, docker://, and a full 40-hex pin — remain the only way out, and each is explicit. The dead second arm is deleted.

A $/ hit is now diagnosed as invalid syntax causing startup death, not as an unpinned ref. The old wording sent the reader hunting a SHA that was never the problem.

Mutant kill — both directions, denominator printed each time

defect present  ->  rc=1   78 workflow file(s) scanned, 92 vendored mirror excluded, 1 unpinned ref(s)
                           ERROR: signed-push-smoke.yml:56: uses: $/.github/actions/signed-push
                             invalid ref: a '$/'-leading ref is not valid uses: syntax and kills
                             the workflow at startup.
defect cured    ->  rc=0   78 workflow file(s) scanned, 92 vendored mirror excluded, 0 unpinned ref(s)
                           OK: every third-party uses: ref in scope is pinned to a full SHA

No new findings on the other 77 files, so the widened selector introduces no false positives. bash -n clean; the workflow still parses as YAML; zero $/ refs remain tree-wide.

Scope and safety

Two files, +42/−15. Read-only verification only — no auto-fix flags, no source or core logic touched, no credential inlined.

File	Change
.github/workflows/signed-push-smoke.yml	line 56, $/ → ./
.githooks/validate-sha-pins.sh	UNPINNED_FILTER collapsed to one pipeline, selector widened, dead arm removed, precise diagnosis added

Follow-up debt found while measuring this is being filed as separate issues, per the standing rule that a new scanner finding is an issue and not a blocker.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 5fa91560-c230-4989-afe1-f245fb9a9d90

📥 Commits

Reviewing files that changed from the base of the PR and between 4f7f02c and a43df0a.

📒 Files selected for processing (2)

• .githooks/validate-sha-pins.sh
• .github/workflows/signed-push-smoke.yml

 _______________________________________
< Preventing the Matrix from glitching. >
 ---------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud