Skip to content

Compliance: unpinned-actions-feature-ideation.yml #88

Closed
Closed
Compliance: unpinned-actions-feature-ideation.yml#88
Labels
compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

Description

@don-petry
don-petry
opened on Apr 9, 2026

Compliance Finding

Category: action-pinning
Severity: error
Check: unpinned-actions-feature-ideation.yml

Detail

Workflow feature-ideation.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@v1

Standard Reference

standards/ci-standards.md#action-pinning-policy

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

Activity

  1. don-petry
    added
    compliance-auditAutomated compliance audit finding
    on Apr 9, 2026

  2. don-petry commented on Apr 9, 2026

    @don-petry
    don-petry
    on Apr 9, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-04-09)

    This finding is still open.

    Detail: Workflow feature-ideation.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@v1

    Standard: standards/ci-standards.md#action-pinning-policy

  3. don-petry
    added
    claude
    on Apr 9, 2026

  4. don-petry commented on Apr 9, 2026

    @don-petry
    don-petry
    on Apr 9, 2026
    ContributorAuthor

    Claude encountered an error —— View job

    I'll analyze this and get back to you.

  5. don-petry commented on Apr 10, 2026

    @don-petry
    don-petry
    on Apr 10, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-04-10)

    This finding is still open.

    Detail: Workflow feature-ideation.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@v1

    Standard: standards/ci-standards.md#action-pinning-policy

  6. don-petry
    added
    claude
    and removed
    claude
    on Apr 14, 2026

  7. don-petry commented on Apr 14, 2026

    @don-petry
    don-petry
    on Apr 14, 2026
    ContributorAuthor

    Claude finished @don-petry's task in 1m 37s —— View job • claude/issue-88-20260414-1246 • Create PR ➔

    Fixing Compliance: Unpinned Actions in feature-ideation.yml

    • Read current feature-ideation.yml workflow file
    • Fetch template from petry-projects/.github/standards/workflows/feature-ideation.yml
    • Look up SHA for the v1 tag of petry-projects/.github → 208ec2d69b75227d375edf8745d84fbac05a76b2
    • Update workflow file with SHA-pinned version (copied template + pinned SHA + preserved project_context)
    • Commit and push changes
    • Create pull request → petry-projects/markets#102

    Summary

    Pinned petry-projects/.github/.github/workflows/feature-ideation-reusable.yml from @v1 to its resolved SHA 208ec2d69b75227d375edf8745d84fbac05a76b2 to resolve the action-pinning compliance finding. Also synced the file with the latest upstream template by adding the dry_run workflow_dispatch input.

  8. don-petry
    added a commit that references this issue on Apr 14, 2026

    fix: pin feature-ideation.yml reusable workflow to SHA (closes #88)

    5c0454a

  9. don-petry commented on Apr 17, 2026

    @don-petry
    don-petry
    on Apr 17, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-04-17)

    This finding is still open.

    Detail: Workflow feature-ideation.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@v1

    Standard: standards/ci-standards.md#action-pinning-policy

  10. don-petry
    added
    claude
    and removed
    claude
    on Apr 18, 2026

  11. don-petry commented on Apr 18, 2026

    @don-petry
    don-petry
    on Apr 18, 2026
    ContributorAuthor

    Claude finished @don-petry's task in 2m 37s —— View job • claude/issue-88-20260418-1841 • [Create PR ➔](https://github.com/petry-projects/markets/compare/main...claude/issue-88-20260418-1841?quick_pull=1&title=Issue%20%2388%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%2388%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

    Fixing Compliance: Unpinned Actions in feature-ideation.yml

    • Read current feature-ideation.yml workflow file
    • Fetch template from petry-projects/.github/standards/workflows/feature-ideation.yml
    • Look up SHA for the v1 tag of petry-projects/.github → ae9709f4466dec60a5733c9e7487f69dcd004e05 (verified valid commit; template already uses this SHA)
    • Update workflow file with SHA-pinned version (copied template verbatim)
    • Commit and push changes
    • Create pull request → petry-projects/markets#113
    • Self-review: change is minimal and correct — only the uses: line SHA pin plus template sync
    • Tagged @don-petry (CODEOWNER) for review

    Summary

    Pinned petry-projects/.github/.github/workflows/feature-ideation-reusable.yml from @v1 to SHA ae9709f4466dec60a5733c9e7487f69dcd004e05 (verified against the upstream template, which already uses this SHA). Also synced the file with the latest upstream template: added dry_run input, actions: read permission, and sources_file optional comment.
    • claude/issue-88-20260418-1841

  12. don-petry
    added a commit that references this issue on Apr 18, 2026

    fix: pin feature-ideation.yml reusable workflow to SHA

    9ac4557
  13. don-petry
    removed
    claude
    on Apr 19, 2026

  14. 30 remaining items

  15. don-petry
    reopened this on Jun 2, 2026
  16. don-petry
    added
    dev-leadFor dev-lead agent pickup
    and removed
    dev-leadFor dev-lead agent pickup
    on Jun 2, 2026

  17. don-petry commented on Jun 5, 2026

    @don-petry
    don-petry
    on Jun 5, 2026
    ContributorAuthor

    Resolved! This check is now passing as of 2026-06-05. Closing automatically.

  18. don-petry
    closed this as completedon Jun 5, 2026
  19. don-petry
    added a commit that references this issue on Jun 19, 2026

    chore(workflows): adopt centralized stubs from petry-projects/.github (…

    a5255e7
  20. don-petry
    added 4 commits that reference this issue on Aug 4, 2026

    chore(workflows): adopt centralized stubs from petry-projects/.github (…

    4f8a3df

    feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml (

    e852a49

    chore(workflows): adopt centralized stubs from petry-projects/.github (…

    9c23b7b

    feat: implement issue #325 — Compliance: ruleset-drift-pr-quality-req…

    93726a6
  21. don-petry
    added 4 commits that reference this issue on Aug 14, 2026

    chore(workflows): adopt centralized stubs from petry-projects/.github (…

    9c6eb46

    feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml (

    7ae9d8f

    feat: implement issue #325 — Compliance: ruleset-drift-pr-quality-req…

    25b4835

    feat: implement issue #400 — Compliance: ruleset-bypass-dependabot-co…

    af4d65d
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions