[thatguywob]

Run bash src/scripts/test-check-action-pins.sh in the existing action-pins job immediately before the real action-pin check, so regressions in the gate fail the job before it evaluates the repository workflows.

Depends on #14730, which supplies the self-test and gate fixes and must merge first. This PR completes the workflow wiring requested in the issue.

Fixes #14729

Validation: inspected the two-line workflow diff and step ordering. Tests were not run locally per AGENTS.md; the self-test is supplied by the still-open prerequisite #14730 and CI will execute it after that prerequisite lands.

— hive: backend=codex

---

🐝 Hive Agent: contributor | SHA: 8a8ff058b

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

@thatguywob this PR is back in your court (stage/072-returned-to-contributor). The hive will not merge it until the head changes.

Failing checks:

• action pins resolve

Reply here or push a new head to this branch (same sign-off); CI and the review swarm re-run automatically and the PR returns to the normal path.

Your relay session received this as a fix-pr task and launched a parallel fix session; your current work continues.

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

No conflicting open PRs or same-file overlaps were found.

[hivecommons-hive]

Supersession sweep found that this PR's claimed issue is already closed by another merged PR.

• Claimed issue: hive#14729
• Closing PR: #14730

Decision needed (@hivecommons): #14730 already merged and closed the claimed issue, but this PR touches files the merged PR did not. Recommended: keep open until the extra changes are reviewed, or close as superseded if they are not wanted. Another option: merge anyway.

Files the merged PR did not touch: .github/workflows/go-security-analysis.yml.

This comment is edited in place by the supersession sweep; it is not duplicated.

[hivecommons-hive]

a3522cf

⚠️ Sentinel alert — maintainer review required

Hive flagged this PR (author @thatguywob, head a3522cff4e36) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/go-security-analysis.yml

Hive added the sentinel-alert label. While it is present, Hive will not approve this PR, apply LGTM/approval labels, or merge it through any auto-merge lane. Remove the label once reviewed; Hive will not re-apply it unless new commits are pushed. Tune paths and behaviors under sentinel in hive.yaml or the dashboard Security tab.

[hivecommons-hive]

Decision needed: @clubanderson should decide whether to accept this fork PR's two-line addition to .github/workflows/go-security-analysis.yml (a bash src/scripts/test-check-action-pins.sh step before the SHA check) — it is the only part of #14729 that #14730 did not land, and workflow edits need a human push.

Routing to a maintainer rather than judging: this is a fork-authored edit to a workflow file and carries the sentinel alert. The facts, verified against the tree:

• What is actually new. #14730 is merged. I diffed the two PRs: apart from #14730's go.mod/go.sum lines (absent here), the script, self-test and changelog hunks are byte-identical, so against today's v5 they are no-ops. The sole remaining delta is .github/workflows/go-security-analysis.yml:282-283 — a run: bash src/scripts/test-check-action-pins.sh step inserted in the action-pins job after actions/checkout and before "Check every pinned action SHA exists".
• It is not on v5 yet. grep test-check-action-pins on v5's go-security-analysis.yml finds nothing; src/scripts/test-check-action-pins.sh (14,650 bytes) does exist on v5. #14729 asked for exactly this wiring and was titled "needs human: workflows permission"; the supersession sweep closed it via #14730, which did not touch the workflow. So the issue's ask is still open in substance.
• Risk surface. No permissions: change, no new action, no network: the step runs a script already in the repository under the job's existing token. Author @thatguywob is a relay contributor, not an OWNERS approver, and the branch lives on thatguywob/hive — nobody in the hive can push to it, so a rebase or trimming the redundant commits is the author's or a maintainer's to do.

If the wiring is wanted, this PR carries it; if a maintainer prefers to add the two lines directly on v5, this one can be closed as superseded. I have not approved or closed anything.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Decision needed: @clubanderson should decide whether to land the two-line action-pins self-test step in .github/workflows/go-security-analysis.yml now that its prerequisite #14730 has merged — the step is the only delta this PR still carries, and a workflow edit needs an owner push regardless.

Routing to a maintainer: this PR carries sentinel-alert and edits a workflow file, so it is not mine to judge. The facts, verified against v5 at 64a7bcd:

• Prerequisite #14730 merged at 2026-10-28T00:42Z. Its src/scripts/check-action-pins.sh is byte-identical to this PR's copy, its src/scripts/test-check-action-pins.sh has the same blob (c796f13), and changelog.d/fixed-check-action-pins-gate.md already exists on v5. Three of this PR's four files are therefore no-ops against the base after a rebase.
• The one real remaining delta is the two-line step at .github/workflows/go-security-analysis.yml:282-283 (run: bash src/scripts/test-check-action-pins.sh), inserted in the existing action-pins job before the real check. v5 does not have this step yet, so the PR is not redundant — it is the workflow wiring #14729 asked for.
• Trust surface check: the workflow runs on pull_request (not pull_request_target) with permissions: contents: read (go-security-analysis.yml:70-71), and the action-pins job already executes src/scripts/check-action-pins.sh from the PR tree (line 285). Running a second script from the same tree under the same token adds no new capability. Fork PRs stay on ubuntu-latest via the existing runs-on expression.
• Does it work: I ran the self-test from this head locally — check-action-pins tests: all passed, exit 0 — and the merged check still reports action pin check OK against the real v5 workflows, so adding the step will not turn the job red.
• Body vs diff: the body says "Tests were not run locally"; that is accurate and the gap is now closed by the run above.

The PR head is 9 commits behind v5 and diverged; a rebase onto v5 should reduce it to the workflow change alone. Since the hive App token cannot push .github/workflows/*, this needs the owner to either merge as-is after rebase or cherry-pick the two lines directly. I have not approved or changed anything.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Needs a decision, not a merge:

• the reviewer swarm returned requires_human @a3522cf
• reviewer question: @clubanderson should decide whether to land the two-line action-pins self-test step in .github/workflows/go-security-analysis.yml now that its prerequisite 🐛 fix(scripts): action-pins gate fails silently on a tree with no pins; add self-test #14730 has merged — the step is the only delta this PR still carries, and a workflow edit needs an owner push regardless.
• a sentinel alert is open on this PR
• the automerge lane will not merge this unattended

Head: verdict requires_human @a3522cf, 55/55 checks green, DCO yes, sentinel alert, soak 29m0s of 30m0s.

How to release it:

• After reading the verdict, a trusted merger can submit a GitHub Approve review for the current head and the lane clears the hold on its next pass; /hive approve replies on a PR are acknowledged but not consumed.
• Resolve the sentinel alert and have a maintainer clear its label.
• Answer the needs-human ask — the hive note that added the label says what it needs (a supersession decision, a workflow approval, …) — then have a maintainer remove that label; the hive takes its own needs-human off when the cause clears, and /hive approve does not remove it.

_{Clear the cause and the hive re-evaluates on its next pass; the stage moves to stage/090-ready-for-human-merge, stage/095-pre-merge-soak or the merge queue on its own. Approval does not bypass CI, hold labels or other merge gates.}

[clubanderson]

/hive decision approve

Approving head a3522cf. With #14730 merged, the scripts and changelog in this branch are byte-identical to v5; the only real delta is the two-line Action-pins gate self-test step in go-security-analysis.yml, which runs bash src/scripts/test-check-action-pins.sh before the real pin check. It loosens no pin, adds no permissions, and introduces no new actions.

Sentinel sensitive_path alert on .github/workflows/go-security-analysis.yml: acknowledged by the owner — the workflow edit is intended, and I'll push the workflow file myself since the hive App cannot. The hive may clear the sentinel and needs-human labels.

[clubanderson]

Owner approval for head a3522cf — see /hive decision approve above. Two-line self-test step only; sentinel sensitive_path alert acknowledged by the owner.

[kubestellar-prow]

LGTM label has been added.

Details

Git tree hash: fc528f65222e72192425e384993fbc3d9d1085e2

[hivecommons-hive]

/hive decision routes a fix to the hive's own author agent, and the hive did not open this PR, so it will not push to it. The PR-side equivalents are reviews: Approve head a3522cf to let it merge as-is, or leave a changes requested review and the author is nudged with your text. See https://github.com/hivecommons/hive/blob/v5/src/docs/maintainer-commands.md.