From 3c781d3b844d69b1a78f944b8ca2d1116e0bc849 Mon Sep 17 00:00:00 2001 From: don-petry <36422719+don-petry@users.noreply.github.com> Date: Sat, 10 Oct 2026 12:25:38 +0000 Subject: [PATCH 1/2] =?UTF-8?q?feat:=20implement=20issue=20#520=20?= =?UTF-8?q?=E2=80=94=20agent-ingress=20pr-review=20job=20pins=20the=20lega?= =?UTF-8?q?cy=20bare=20`pr-review/stable`=20(DEFECTIVE=20PIN):=20move=20bo?= =?UTF-8?q?th=20pin=20lines=20to=20`pr-review/v1-stable`?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/scripts/tests/agent-ingress-workflow.bats | 11 +++++++++-- .github/workflows/agent-ingress.yml | 4 ++-- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.github/scripts/tests/agent-ingress-workflow.bats b/.github/scripts/tests/agent-ingress-workflow.bats index 6e32d78d..8df513cc 100644 --- a/.github/scripts/tests/agent-ingress-workflow.bats +++ b/.github/scripts/tests/agent-ingress-workflow.bats @@ -92,10 +92,10 @@ ROLES=(dev-lead pr-auto-review pr-review pr-review-mention ci-failure-analyst) [[ "$output" == *"/pr-auto-review-reusable.yml@pr-auto-review/v1-stable" ]] run yq '.jobs.pr-review.uses' "$WORKFLOW" [ "$status" -eq 0 ] - [[ "$output" == *"/pr-review.yml@pr-review/stable" ]] + [[ "$output" == *"/pr-review.yml@pr-review/v1-stable" ]] run yq '.jobs.pr-review.with.agent_ref' "$WORKFLOW" [ "$status" -eq 0 ] - [ "$output" = "pr-review/stable" ] + [ "$output" = "pr-review/v1-stable" ] run yq '.jobs.pr-review-mention.uses' "$WORKFLOW" [ "$status" -eq 0 ] [[ "$output" == *"/pr-review-mention-reusable.yml@pr-review-mention/v2-stable" ]] @@ -161,3 +161,10 @@ ROLES=(dev-lead pr-auto-review pr-review pr-review-mention ci-failure-analyst) || { printf '%s\n' "$role: if: reaches repo state"; return 1; } done } + +@test "pr-review pins the major-scoped v1-stable channel, not the legacy bare tag (#520)" { + run grep -E '/pr-review\.yml@' "$WORKFLOW" + [ "$status" -eq 0 ] + [[ "$output" == *"@pr-review/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref" ]] + [[ "$output" != *"DEFECTIVE PIN"* ]] +} diff --git a/.github/workflows/agent-ingress.yml b/.github/workflows/agent-ingress.yml index 5cdac1ad..d411cff0 100644 --- a/.github/workflows/agent-ingress.yml +++ b/.github/workflows/agent-ingress.yml @@ -142,9 +142,9 @@ jobs: contents: read pull-requests: write checks: read - uses: petry-projects/.github-private/.github/workflows/pr-review.yml@pr-review/stable # NOSONAR(githubactions:S7637) first-party channel ref # DEFECTIVE PIN — see §5 + uses: petry-projects/.github-private/.github/workflows/pr-review.yml@pr-review/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref with: - agent_ref: pr-review/stable + agent_ref: pr-review/v1-stable pr_url: ${{ inputs.pr_url || '' }} dry_run: ${{ inputs.dry_run || '' }} force_review: ${{ inputs.force_review || '' }} From 2a0eb9373be8c8689f1383db6322ae4b31881af9 Mon Sep 17 00:00:00 2001 From: don-petry <36422719+don-petry@users.noreply.github.com> Date: Sat, 10 Oct 2026 12:36:17 +0000 Subject: [PATCH 2/2] fix(reviews): use regex match for v1-stable pin assertion Co-Authored-By: Claude Sonnet 5.5 --- .github/scripts/tests/agent-ingress-workflow.bats | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/scripts/tests/agent-ingress-workflow.bats b/.github/scripts/tests/agent-ingress-workflow.bats index 8df513cc..9667ef32 100644 --- a/.github/scripts/tests/agent-ingress-workflow.bats +++ b/.github/scripts/tests/agent-ingress-workflow.bats @@ -165,6 +165,6 @@ ROLES=(dev-lead pr-auto-review pr-review pr-review-mention ci-failure-analyst) @test "pr-review pins the major-scoped v1-stable channel, not the legacy bare tag (#520)" { run grep -E '/pr-review\.yml@' "$WORKFLOW" [ "$status" -eq 0 ] - [[ "$output" == *"@pr-review/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref" ]] + [[ "$output" =~ @pr-review/v1-stable[[:space:]]+#[[:space:]]*NOSONAR\(githubactions:S7637\)[[:space:]]+first-party[[:space:]]+channel[[:space:]]+ref ]] [[ "$output" != *"DEFECTIVE PIN"* ]] }