Compliance: unpinned-actions-dependabot-automerge.yml

Compliance Finding

Category: action-pinning
Severity: error
Check: unpinned-actions-dependabot-automerge.yml

Detail

Workflow dependabot-automerge.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1

Standard Reference

standards/ci-standards.md#action-pinning-policy

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

@don-petry

Claude finished @don-petry's task in 4m 26s —— View job • claude/issue-239-20260511-1242 • [Create PR ➔](https://github.com/petry-projects/.github/compare/main...claude/issue-239-20260511-1242?quick_pull=1&title=Issue%20%23239%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%23239%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

Fixing Compliance Issue: False Positive in `check_action_pinning`

Root cause: The check_action_pinning function in scripts/compliance-audit.sh did not exempt internal reusable workflow refs (petry-projects/.github/...@v1). Per standards/ci-standards.md#exception-internal-reusable-workflow-references, these are explicitly exempt from SHA pinning — internal reusable refs intentionally use tags and must NOT be SHA-pinned. The dependabot-automerge.yml workflow was already correct; the compliance check was the bug.

Fix: Added grep -vE 'petry-projects/\.github/' exclusion to the unpinned-action detection pipeline in check_action_pinning.

Gather context (read AGENTS.md, ci-standards.md, compliance-audit.sh, workflow files)
Identify root cause: check_action_pinning missing exemption for petry-projects/.github reusable refs
Fix scripts/compliance-audit.sh to exclude internal reusable workflow refs
Commit and push
Create PR: fix: exempt internal reusable workflow refs from action-pinning check #242
Self-review PR (Lint, ShellCheck, AgentShield, SonarCloud all pass; exemption regex is correct and consistent with other script exemptions)
Tag code owners (@petry-projects/org-leads) on PR

View PR #242

Weekly Compliance Audit (2026-05-12)

This finding is still open.