hivecommons-hive · Oct 28, 2026 · Oct 27, 2026 · Oct 28, 2026
diff --git a/changelog.d/fixed-check-action-pins-gate.md b/changelog.d/fixed-check-action-pins-gate.md
@@ -0,0 +1 @@
+- The action-pins CI gate (`src/scripts/check-action-pins.sh`) no longer reports `action pin check FAILED` with no finding when a workflow directory contains no SHA-pinned `uses:` lines (pipefail turned grep's empty match into a failure), and its `NOT-PINNED` message now names the workflow file rather than the line number where the file name belonged. The resolver reports every missing SHA instead of stopping at the first, and the gate now has a hermetic self-test, `src/scripts/test-check-action-pins.sh`, covering each of its failure branches.
diff --git a/src/go.mod b/src/go.mod
@@ -5,6 +5,7 @@ go 1.26.10
 require (
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
+	github.com/charmbracelet/x/ansi v0.10.1
 	github.com/charmbracelet/x/exp/teatest v0.0.0-20260823001701-96af6d2cb5f6
 	github.com/charmbracelet/x/term v0.2.2
 	github.com/fsnotify/fsnotify v1.10.1
@@ -34,7 +35,6 @@ require (
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/aymanbagabas/go-udiff v0.3.1 // indirect
 	github.com/charmbracelet/colorprofile v0.3.2 // indirect
-	github.com/charmbracelet/x/ansi v0.10.1 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
 	github.com/charmbracelet/x/exp/golden v0.0.0-20240806155701-69247e0abc2a // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
@@ -67,7 +67,7 @@ require (
 	go.uber.org/automaxprocs v1.6.0
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/exp v0.0.0-20240823005443-9b4947da3948 // indirect
-	golang.org/x/net v0.61.0
+	golang.org/x/net v0.62.0
 	golang.org/x/sys v0.49.0
 	golang.org/x/text v0.43.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc // indirect

diff --git a/src/go.sum b/src/go.sum
@@ -135,8 +135,8 @@ go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/exp v0.0.0-20240823005443-9b4947da3948 h1:kx6Ds3MlpiUHKj7syVnbp57++8WpuKPcR5yjLBjvLEA=
 golang.org/x/exp v0.0.0-20240823005443-9b4947da3948/go.mod h1:akd2r19cwCdwSwWeIdzYQGa/EZZyqcOdwWiwj5L5eKQ=
-golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
-golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
+golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
 golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

diff --git a/src/scripts/check-action-pins.sh b/src/scripts/check-action-pins.sh
@@ -30,23 +30,32 @@ while IFS= read -r line; do
     [0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]) ;;
     *) echo "NOT-PINNED $file: $ref (use a 40-hex commit SHA)"; fail=1; continue ;;
   esac
-done < <(grep -rhnE '^\s*(-\s*)?uses:\s*[a-zA-Z0-9._-]+/' "$DIR" 2>/dev/null | grep -v '^\s*#')
+# -H keeps the file name in front of the line number even for a single-file
+# DIR, so `${line%%:*}` names the workflow and not its line number.
+done < <(grep -rHnE '^\s*(-\s*)?uses:\s*[a-zA-Z0-9._-]+/' "$DIR" 2>/dev/null | grep -v '^\s*#')
 
 # Resolve each unique pin. Skipped without a token so the script stays usable
 # offline; CI always has one.
 if command -v gh >/dev/null 2>&1; then
   # Extract owner/repo from the `uses:` VALUE, taking only the first two path
   # segments: a reusable workflow is `owner/repo/.github/workflows/x.yml@SHA`,
   # so naively splitting on the last '/' asks the API about a path, not a repo.
-  grep -rhoE 'uses:[[:space:]]*[a-zA-Z0-9._-]+/[a-zA-Z0-9._/-]+@[0-9a-f]{40}' "$DIR" 2>/dev/null \
-    | sed -E 's/^uses:[[:space:]]*//' | sort -u | while read -r ref; do
+  #
+  # Collected first, then iterated: when the pipeline's status fed `|| fail=1`
+  # directly, a tree with no SHA-pinned `uses:` at all made grep exit 1 and
+  # pipefail turned that into a FAILED verdict with no finding printed.
+  # Nothing to resolve is a pass, not a failure.
+  pins="$(grep -rhoE 'uses:[[:space:]]*[a-zA-Z0-9._-]+/[a-zA-Z0-9._/-]+@[0-9a-f]{40}' "$DIR" 2>/dev/null \
+    | sed -E 's/^uses:[[:space:]]*//' | sort -u)"
+  while read -r ref; do
+    [ -z "$ref" ] && continue
     sha="${ref#*@}"; path="${ref%@*}"
     repo="$(printf '%s' "$path" | cut -d/ -f1,2)"
     if ! gh api "repos/$repo/commits/$sha" --jq '.sha' >/dev/null 2>&1; then
       echo "MISSING-SHA $repo@$sha does not exist in that repository"
-      exit 1
+      fail=1
     fi
-  done || fail=1
+  done <<<"$pins"
 fi
 
 # An EMPTY workflow-expression delimiter pair anywhere in a workflow file is a
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		- The action-pins CI gate (`src/scripts/check-action-pins.sh`) no longer reports `action pin check FAILED` with no finding when a workflow directory contains no SHA-pinned `uses:` lines (pipefail turned grep's empty match into a failure), and its `NOT-PINNED` message now names the workflow file rather than the line number where the file name belonged. The resolver reports every missing SHA instead of stopping at the first, and the gate now has a hermetic self-test, `src/scripts/test-check-action-pins.sh`, covering each of its failure branches.