Compliance: unpinned-actions-pr-review-mention.yml

[don-petry]

Compliance Finding

Category: action-pinning
Severity: error
Check: unpinned-actions-pr-review-mention.yml

Detail

Workflow pr-review-mention.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@v1

Standard Reference

standards/ci-standards.md#action-pinning-policy

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Claude finished @don-petry's task in 2m 0s —— View job • claude/issue-271-20260511-1237 • [Create PR ➔](https://github.com/petry-projects/google-app-scripts/compare/main...claude/issue-271-20260511-1237?quick_pull=1&title=Issue%20%23271%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%23271%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

---

Fixing Action Pinning Compliance

• Locate .github/workflows/pr-review-mention.yml
• Look up SHA for v1 tag in petry-projects/.github repo → 0cb4bba11d7563bf197ad805f12fb8639e4879e4
• Pin action to SHA in workflow file
• Commit and push changes
• Create pull request — petry-projects/google-app-scripts#272
• Self-review PR
• Wait for CI and tag CODEOWNERS

Self-review notes: The change is a minimal single-line update pinning @v1 to @0cb4bba11d7563bf197ad805f12fb8639e4879e4 # v1. SHA was looked up via gh api (lightweight tag → commit directly), so no dereferencing needed. Trigger events and permissions block are unchanged per the file's own AGENTS guidance. No issues found.

CI checks are currently in progress — waiting for results.
| View PR

[don-petry]

Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Workflow pr-review-mention.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@v1

Standard: standards/ci-standards.md#action-pinning-policy

[don-petry]

Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Workflow pr-review-mention.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@v1

Standard: standards/ci-standards.md#action-pinning-policy

[don-petry]

Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Workflow pr-review-mention.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@v1

Standard: standards/ci-standards.md#action-pinning-policy

[don-petry]

Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Workflow pr-review-mention.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@v1

Standard: standards/ci-standards.md#action-pinning-policy

[don-petry]

Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Workflow pr-review-mention.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@v1

Standard: standards/ci-standards.md#action-pinning-policy

[don-petry]

Weekly Compliance Audit (2026-05-13)

This finding is still open.

Detail: Workflow pr-review-mention.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@v1

Standard: standards/ci-standards.md#action-pinning-policy