Initiative: adopt tag-based release pinning for ALL reusable workflows (extend the dev-lead/pr-review standard org-wide) #665

Note: intended as a Discussion to ideate → plan → deliver as an initiative. The Discussions API isn't available to the agent tooling, so it's captured here — please Convert to discussion (Issue → ⋯ → Convert to discussion) if you want it in Discussions.

Problem

First-party reusable workflows are pinned inconsistently. Concretely, ci-failure-analyst-reusable.yml is pinned to off-main SHAs with inaccurate # main annotations — verified on main @ a682741:

Result: the lock file, templates/ci-failure-analyst.yml, and docs/aw/ci-failure-analyst.md all pin a commit that was never merged, and consumers copying the template inherit an off-main pin. The pr-review agent flagged this on #520 (MEDIUM, needs-human).

The agreed direction

Adopt tag-based release pinning + release versions for all reusable workflows — the standard already defined in petry-projects/.github and adopted by dev-lead (@dev-lead/stable, dev-lead/vX.Y.Z) and pr-review (@pr-review/stable). Replace SHA-# main pins with channel/version tags backed by cut-release.sh-style cuts.

Scope

1. Enumerate every cross-repo / first-party reusable workflow still pinned by SHA-or-# main (e.g. ci-failure-analyst, and any others under .github/workflows/* callers + templates/* + docs/aw/*).
2. Define release channels + cut initial versions for each reusable per the .github standard.
3. Repin all callers/templates/docs to the channel tag; remove inaccurate # main SHA pins.
4. Compliance checks: extend the structure tests (cf. tests/dev-lead/integration/test_auto_rebase_stub.py, test_dependency_audit_stub.py) so a SHA/off-main pin can't merge for any reusable — make tag-pinning a CI-enforced standard, not per-workflow bespoke tests.
5. Roll out across consuming repos (this is cross-repo, so it likely touches petry-projects/.github standards + downstream callers).

Deliverables

• A pinning standard doc update in .github covering all reusables (not just dev-lead/pr-review).
• Release tags cut for each reusable; callers/templates/docs repinned.
• A generalized compliance test enforcing tag pins org-wide.

Open questions (for ideation)

• One channel convention for all (@<name>/stable + vX.Y.Z) or per-tier?
• Who/what cuts releases for the non-agent reusables (manual cut-release.sh by OrganizationAdmin, as today, vs. a release workflow)?
• Migration order and how to avoid breaking in-flight consumers.
• Immediate stopgap for the already-merged off-main ci-failure-analyst pin (repin to an on-main SHA now, or fast-track its first tag)?

Originally filed as a bug from PR #520's pr-review finding; reframed per maintainer as an initiative covering all reusable workflows + compliance.