ci: pin agent-shield reusable workflow to SHA

[don-petry]

Summary

• Pins petry-projects/.github/.github/workflows/agent-shield-reusable.yml from @v1 to exact commit SHA (0cb4bba11d7563bf197ad805f12fb8639e4879e4) per the org action-pinning policy.
• The # v1 comment is retained for human readability.
• Repo-specific with: required-files: AGENTS.md input is preserved unchanged.

Change

-    uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@v1
+    uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@0cb4bba11d7563bf197ad805f12fb8639e4879e4 # v1

Closes #114

Generated with Claude Code

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Warning

Rate limit exceeded

@github-actions[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 59 minutes and 57 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 78ea9cc1-e271-4721-819a-ecea05f1670f

📥 Commits

Reviewing files that changed from the base of the PR and between 6bafc6a and a191bfc.

📒 Files selected for processing (1)

• .github/workflows/agent-shield.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-114-20260511-2018

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Self-review: The change is a single-line diff — replaces the mutable @v1 tag with the exact commit SHA 0cb4bba11d7563bf197ad805f12fb8639e4879e4 (confirmed via gh api repos/petry-projects/.github/git/refs/tags/v1) and preserves the # v1 human-readable comment. The repo-specific with: required-files: AGENTS.md input is untouched. No issues found.

@petry-projects/org-leads — please review and merge when CI is green.

[Copilot]

Pull request overview

Pins the AgentShield reusable workflow reference in this repo’s thin-caller workflow to an exact commit SHA to satisfy the org action-pinning compliance policy (Issue #114), while preserving the human-readable # v1 tag.

Changes:

• Updated .github/workflows/agent-shield.yml to use petry-projects/.github/.github/workflows/agent-shield-reusable.yml@0cb4bba11d7563bf197ad805f12fb8639e4879e4 instead of @v1.
• Retained the # v1 inline comment and preserved existing with: inputs (e.g., required-files: AGENTS.md).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: a191bfcfa6fc014ce4d88ea3ba70860a890233d4
Review mode: triage-approved (single reviewer)

Summary

Single-line CI workflow change pinning petry-projects/.github/.github/workflows/agent-shield-reusable.yml from the mutable @v1 tag to the exact commit SHA 0cb4bba11d7563bf197ad805f12fb8639e4879e4, with the # v1 human-readable comment retained and the with: required-files: AGENTS.md input preserved. Verified via gh api repos/petry-projects/.github/git/refs/tags/v1 that the pinned SHA matches the actual commit currently behind the v1 tag. Conforms to the org action-pinning policy and follows the same pattern as the recently merged #127 (auto-rebase-reusable.yml SHA pin).

Linked issue analysis

Closes #114 — a compliance-audit finding for unpinned-actions-agent-shield.yml flagging that agent-shield.yml had 1 action not pinned to SHA. The PR addresses exactly that line; no other unpinned references remain in this workflow.

Findings

No issues found.

• SHA pin verified against upstream tag v1 (matches 0cb4bba11d7563bf197ad805f12fb8639e4879e4).
• Repo-specific with: inputs preserved unchanged.
• No secrets, permissions, or trigger surface modified.
• Pre-existing missing trailing newline on the file is unchanged by this PR; out of scope.

CI status

All required checks green: AgentShield, Claude Code, CodeQL (Analyze actions), Dependency audit (ecosystem detect), SonarCloud / SonarCloud Code Analysis (Quality Gate passed, 0 new issues), CodeRabbit. Dependabot auto-merge and ecosystem-specific audit jobs correctly skipped (no matching ecosystems / not a Dependabot PR). CodeRabbit posted a rate-limit notice but its status check reports SUCCESS; gemini-code-assist skipped due to unsupported file type. Mergeable: yes; merge state BLOCKED only on the required human review.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.