From b31b715089fab7c5e6baa7ba69e5c5202159eef8 Mon Sep 17 00:00:00 2001
From: Taku Kodama <79110363+risu729@users.noreply.github.com>
Date: Thu, 27 Aug 2026 05:20:36 +1000
Subject: [PATCH 1/2] fix(builtins): match root action metadata files in pinact
 glob

---
 pkl/builtins/pinact.pkl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkl/builtins/pinact.pkl b/pkl/builtins/pinact.pkl
index f8003eddd..c8ca5212b 100644
--- a/pkl/builtins/pinact.pkl
+++ b/pkl/builtins/pinact.pkl
@@ -7,7 +7,7 @@ import "./test/helpers.pkl"
   description = "Pin GitHub Actions to commit SHA for security"
 }
 const pinact = new Config.Step {
-  glob = List(".github/workflows/*", "*/action.*")
+  glob = List(".github/workflows/*", "**/action.*")
   types = List("yaml")
   // `verify-comment` verifies pairs of commit SHA and version comments are correct
   check_diff = new Config.CommandSpec {

From a532fcd43f267c34083caa0bcb6bc31198653e14 Mon Sep 17 00:00:00 2001
From: Taku Kodama <79110363+risu729@users.noreply.github.com>
Date: Thu, 27 Aug 2026 07:41:10 +1000
Subject: [PATCH 2/2] fix(builtins): match root action metadata files in
 pinact_update glob

---
 pkl/builtins/pinact_update.pkl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkl/builtins/pinact_update.pkl b/pkl/builtins/pinact_update.pkl
index b0cd33fe4..7d6ff5d0f 100644
--- a/pkl/builtins/pinact_update.pkl
+++ b/pkl/builtins/pinact_update.pkl
@@ -6,7 +6,7 @@ import "../Config.pkl"
   description = "Pin GitHub Actions to update actions to latest versions"
 }
 const pinact_update = new Config.Step {
-  glob = List(".github/workflows/*", "*/action.*")
+  glob = List(".github/workflows/*", "**/action.*")
   types = List("yaml")
   // `verify-comment` verifies pairs of commit SHA and version comments are correct
   check_diff = new Config.CommandSpec {