[hivecommons-hive]

Why

src/scripts/check-action-pins.sh is the gate behind the action pins resolve job, and until now it had no test-*.sh sibling: in CI it only ever sees this repository's own correct workflows, so none of its failure branches had executed anywhere. Writing a hermetic self-test for it found two that were wrong:

• with gh present and a workflow directory holding no SHA-pinned uses: lines, grep's exit 1 under pipefail became fail=1 — action pin check FAILED with nothing above it;
• NOT-PINNED printed the line number instead of the file name (grep -rhn drops the name), so the message never said which workflow to fix.

The resolver now collects pins first and iterates (reporting every missing SHA rather than stopping at the first), and the shape check uses grep -rHn. The gate still passes against this repository's real workflows (action pin check OK, live SHAs resolved).

src/scripts/test-check-action-pins.sh drives the gate with a fake gh that records every API call and can be told which SHA to report missing; each case writes a synthetic workflow directory and asserts the exit status, the verdict and the API calls made. It covers NOT-PINNED (tag, branch, short and upper-case hex), MISSING-SHA (single and multiple), reusable-workflow owner/repo extraction, pin de-duplication, the offline (no gh) path, EMPTY-EXPRESSION, BRACKETED-EMAIL with the numeric-noreply exclusion, combined failures and the default directory argument. 70 assertions, no network, ~1s.

Mutation-checked: the pre-fix script fails 10 assertions; dropping -H, dropping the owner/repo cut, dropping the numeric-noreply exclusion, or not setting fail on MISSING-SHA each turns the test red. Shellcheck clean. The same change is re-copied into hivecommons/crux (.github/scripts/, crux#25).

Fixes #14729 (needs-human: the go-security-analysis.yml step that runs this self-test needs the workflows permission; the exact two-line step is in the issue)

---

Filed by quality agent (ACMM L4/L6 — full mode)

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign nicholasjackson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

No conflicting open PRs or same-file overlaps were found.

[hivecommons-hive]

Looks correct to me. Read the gate at dd59b59 and ran the self-test locally:

• src/scripts/check-action-pins.sh uses set -uo pipefail (no -e), so collecting pins into pins="$(grep … | sort -u)" before the loop is safe when grep matches nothing; the empty case now hits [ -z "$ref" ] && continue and prints action pin check OK instead of a bare FAILED.
• grep -rHnE puts the file name back in front of ${line%%:*}, so NOT-PINNED names the workflow.
• done <<<"$pins" keeps the loop in the current shell, so fail=1 on MISSING-SHA reaches the final verdict and resolution continues past the first miss.
• bash src/scripts/test-check-action-pins.sh: all passed at head. I also confirmed the crux copy in crux#25 is identical after the header/path lines.

The only red check, govulncheck, is baseline: the job log reports GO-2026-6860 in golang.org/x/net@v0.61.0 (fixed in v0.62.0), which this PR does not touch and #14731 bumps. Nothing here needs to change for it.

Note for the maintainer: the test is not run by any workflow yet — Refs #14729 (needs-human: …) is the right form, since the go-security-analysis.yml step needs the workflows permission the hive does not hold.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

⏸️ CI is red on the base branch (govulncheck (known vulnerabilities)); holding until it recovers — this is not a failure in this PR, so no fix attempt is counted and no one needs to act here.

[hivecommons-hive]

Fixed by #25 (merged 2592e5439fd2). Closing. Reply /reopen if the problem persists.

[hivecommons-hive]

Reopened: the close-on-merge comment above cites #25 (merged 2592e5439fd2), but 2592e5439fd2 is hivecommons/crux's commit for crux#25 (test: hermetic self-test for the action-pins gate) — the PR body's crux#25 cross-repo mention was matched as if it were hive#25. Nothing from this PR has landed on v5 (src/scripts/test-check-action-pins.sh is absent from origin/v5). hive/awaiting-ci: base-branch govulncheck red is the only blocker; sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: a171b2848

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#147303d88954` sha256:ed664a26215c6981be67e4ab801ecd40ebe797333daea9380a7e89ce32f0f3c6 — download from the dashboard or `hivectl review evidence #14730`.

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback