ci: SHA-pin gate for GitHub Actions uses: refs (mache-b8900d)

[jamestexas]

Motivation

Dependabot bumps action refs but occasionally leaves a bare tag behind — it did on lfs-guard.yml in #457, caught only by hand. A bare tag (actions/checkout@v4) is a mutable, remotely-controlled pointer — a supply-chain foothold. This makes "all actions must be SHA-pinned" executable so the next one can't merge unnoticed.

Reframing vs the bead

mache-b8900d was filed as a find_smells rule, but find_smells is SQL-only over the parsed code .db, and workflow YAML isn't in that DB. A text rule would need a new engine rule-type — that's the larger mache-445887 ("find_smells as a standalone lint") work, out of scope here. So this delivers the value the way mache already does workflow/doc hygiene: a script + Taskfile target + CI wiring, mirroring scripts/docs-lint.sh.

Changes

• scripts/actions-pin-lint.sh — flags any .github/workflows uses: ref whose @-suffix isn't a 40-hex SHA. Exempts local ./ composite refs and docker:// refs (different pinning format).
• task actions:lint — wired into the check + ci aggregates and the GitHub CI lint job, so it gates PRs (taskfile-ci-parity: CI invokes the task target, not a re-implemented command).
• Go tests (cmd/actions_pin_lint_test.go) — flags an unpinned ref, passes when pinned, exempts local/docker, and a live guard that the repo itself stays clean (a regression fails go test ./cmd/ too).

Pairs with actionlint (workflow syntax, mache-f60571); this is pinning.

Verification

• task actions:lint → all refs SHA-pinned ✓ (incl. this PR's ci.yml edit)
• go test ./cmd/ -run TestActionsPinLint → 3/3 pass
• go vet + golangci-lint (pre-commit) → pass

[github-actions]

find_smells (advisory)

Scoped to files changed in this PR. Rules below run on the standalone (no-LLO) cross-ref tables; _ast rules (cyclomatic_complexity, long_function, long_file, magic_int_in_comparison) are not exercised here.

No structural smells in changed files. ✓

Rules: the registry is cmd/smell_rules.go (source of truth); see the authoring guide to add one. Advisory only — these are heuristics, not gates.

[Copilot]

Pull request overview

This PR introduces a repo-enforced gate to ensure all GitHub Actions uses: references in .github/workflows/ are pinned to immutable identifiers, reducing supply-chain risk from mutable tags.

Changes:

• Add scripts/actions-pin-lint.sh to detect non–SHA-pinned uses: refs under .github/workflows/.
• Wire the lint into Taskfile (actions:lint) and aggregate gates (check and ci), and add it to the GitHub Actions CI lint job.
• Add Go tests to validate the lint behavior and add a “repo stays clean” guard test.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
Taskfile.yml	Adds actions:lint task and runs it as part of check and ci aggregates.
scripts/actions-pin-lint.sh	Implements the workflow uses: pinning lint logic.
cmd/actions_pin_lint_test.go	Adds unit tests and a repo-clean regression guard for the lint script.
.github/workflows/ci.yml	Runs task actions:lint in the lint job to gate PRs in CI.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.