fix: SHA-pinned actions lose version comment when SkipHardcodedFallback is set by Copilot · Pull Request #46122 · github/gh-aw

Copilot · 2026-07-17T03:53:23Z

When GH_HOST is non-github.com or the git remote doesn't resolve to github.com (common in sandbox/CI), SkipHardcodedFallback=true caused resolveActionPinFromHardcodedPins to skip all hardcoded lookups — including SHA→version resolution. The fallback then emitted FormatPinnedActionReference(repo, sha, sha), replacing # v7.0.0 with # 9c091bb... in lock files on every recompile.

Root cause

SkipHardcodedFallback guards against using bundled version→SHA mappings on non-github.com hosts (stale pin risk). The guard was also applied to SHA→version lookups, which are purely informational and host-independent.

Fix

pkg/actionpins/actionpins.go: Change early-return condition from if ctx.SkipHardcodedFallback to if ctx.SkipHardcodedFallback && !isAlreadySHA in resolveActionPinFromHardcodedPins

// Before: skipped hardcoded lookup entirelyifctx.SkipHardcodedFallback {
return"", false
}
// After: still skip version→SHA lookup, but allow SHA→version for comment resolutionifctx.SkipHardcodedFallback&&!isAlreadySHA {
return"", false
}

actionpins_internal_test.go / spec_test.go: Regression tests — SHA-pinned action with SkipHardcodedFallback=true must still produce # v7.0.0, not # <sha>.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…edFallback is set Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…hedule churn) Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-07-17T06:03:45Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

github-actions · 2026-07-17T06:03:50Z

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #46122 does not have the 'implementation' label and has only 56 new lines of code in business logic directories (threshold: 100).

github-actions · 2026-07-17T06:03:50Z

✅ Test Quality Sentinel completed test quality analysis.

github-actions · 2026-07-17T06:03:52Z

✅ PR Code Quality Reviewer completed the code quality review.

Copilot

Pull request overview

Fixes SHA-pinned action version comments when hardcoded version-to-SHA fallback is disabled.

Changes:

Allows exact SHA-to-version metadata lookup.
Adds internal and public regression tests.
Regenerates the release lock manifest.

Show a summary per file

File	Description
`pkg/actionpins/actionpins.go`	Permits SHA-to-version lookup during skipped fallback.
`pkg/actionpins/actionpins_internal_test.go`	Tests internal resolution behavior.
`pkg/actionpins/spec_test.go`	Tests the public API regression.
`.github/workflows/release.lock.yml`	Restores the setup-go version metadata.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 4/4 changed files
Comments generated: 2
Review effort level: Medium

+	// However, when version is already a SHA (isAlreadySHA), the lookup is purely
+	// SHA→version (to find a human-readable version label for the comment). That
+	// operation carries no security risk regardless of host, so it is always allowed.
+	if ctx.SkipHardcodedFallback && !isAlreadySHA {


 assert.Contains(t, result, "actions/checkout@", "result should reference actions/checkout")
 	})
+
+	t.Run("SHA-pinned action with SkipHardcodedFallback=true still produces version comment", func(t *testing.T) {


github-actions

Clean, well-scoped fix. The narrowed guard () is correct — SHA→version lookup is purely informational and host-independent, so allowing it through even on non-github.com hosts carries no security risk. The regression tests are explicit and adequately cover both the blocked path (version→SHA still skipped) and the newly allowed path (SHA→version proceeds). Lock file change confirms the fix works end-to-end.

🔎 Code quality review by PR Code Quality Reviewer · 10.5 AIC · ⌖ 4.28 AIC · ⊞ 5.6K
_{Comment /review to run again}

github-actions

Skills-Based Review 🧠

Applied /diagnosing-bugs and /tdd — approving with one minor suggestion.

📋 Key Themes & Highlights

Fix Quality

✅ Root cause correctly identified: SkipHardcodedFallback guarded SHA→version lookups even though those are host-independent and informational only
✅ The one-line condition change (&& !isAlreadySHA) is minimal and surgical
✅ Regression tests added at both internal and public API levels — solid coverage of the exact failure mode
✅ Test names read as specifications and clearly document the pre-fix failure

Minor Issue

Log message on line 399 still says skipping hardcoded pin lookup but now only fires for version→SHA requests — see inline comment for a suggested update.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · 16.5 AIC · ⌖ 4.41 AIC · ⊞ 6.7K
_{Comment /matt to run again}

github-actions · 2026-07-17T06:10:45Z

+	// However, when version is already a SHA (isAlreadySHA), the lookup is purely
+	// SHA→version (to find a human-readable version label for the comment). That
+	// operation carries no security risk regardless of host, so it is always allowed.
+	if ctx.SkipHardcodedFallback && !isAlreadySHA {


[/diagnosing-bugs] The log message still says "skipping hardcoded pin lookup" but now only fires for version→SHA lookups — slightly misleading when reading logs.
💡 Suggested update
actionPinsLog.Printf("SkipHardcodedFallback set, skipping version→SHA hardcoded pin lookup for %s@%s", actionRepo, version)
This makes it clearer in debug logs that SHA→version lookups are still allowed.
@copilot please address this.

github-actions

The fix is correct and well-tested.

Root cause & fix:SkipHardcodedFallback was unconditionally skipping all hardcoded-pin lookups. The fix restricts the skip to version→SHA lookups (!isAlreadySHA), which is the only case where bundled data could introduce stale/wrong pins on non-github.com hosts. SHA→version lookups are purely informational (no security risk), so they are now always allowed.

Tests: Both the internal and public-API regression tests directly exercise the before/after behavior using a real embedded pin (actions/checkout), making them meaningful rather than mock-driven.

Lock file: The manifest update (actions/setup-go gaining its v7.0.0 comment) is a correct side-effect of the fix.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · 12.9 AIC · ⌖ 4.31 AIC · ⊞ 5K

github-actions · 2026-07-17T06:11:40Z

🧪 Test Quality Sentinel Report

✅ Test Quality Score: 85/100 — Excellent

Analyzed 6 test function(s) (10 subtests): 6 design, 0 implementation, 0 violation(s).

📊 Metrics (6 tests)

Metric	Value
Analyzed	6 (Go: 6, JS: 0)
✅ Design	6 (100%)
⚠️ Implementation	0 (0%)
Edge/error coverage	5 (83%)
Duplicate clusters	0
Inflation	Yes (test:prod ≈ 8:1; -10 pts)
🚨 Violations	0

Test	File	Classification	Issues
`TestResolveExactHardcodedPin_BySHA`	`actionpins_internal_test.go:335`	design_test / high_value	None
`TestResolveExactHardcodedPin_ByVersion`	`actionpins_internal_test.go:344`	design_test / high_value	None
`TestResolveExactHardcodedPin_NoMatch`	`actionpins_internal_test.go:354`	design_test / high_value	None
`TestResolveExactHardcodedPin_VersionTakesPrecedenceOverSHA`	`actionpins_internal_test.go:363`	design_test / high_value	None
`TestResolveActionPinFromHardcodedPins_SkipHardcodedFallback`	`actionpins_internal_test.go:432`	design_test / high_value	None
`TestSpec_PublicAPI_ResolveActionPin_SkipHardcodedFallback`	`spec_test.go:339`	design_test / high_value	None

Verdict

✅ Passed. 0% implementation tests (threshold: 30%). Tests directly exercise the regression described in the PR — SHA-pinned actions under SkipHardcodedFallback=true now emit correct version comments. The inline regression subtest ("SHA-pinned action with SkipHardcodedFallback=true still produces version comment") is particularly valuable: it documents the before/after contract and will catch any future regressions. Test inflation (8:1 added lines) is expected given the focused production fix and the need for thorough behavioral coverage of the new resolveExactHardcodedPin extraction.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "awmgmcpg"

See Network Configuration for more information.

🧪 Test quality analysis by Test Quality Sentinel · 44.1 AIC · ⌖ 7.93 AIC · ⊞ 6.8K · ◷
_{Comment /review to run again}

github-actions

✅ Test Quality Sentinel: 85/100. 0% implementation tests (threshold: 30%). All new tests classify as design tests with strong behavioral contracts directly exercising the regression fix.

pelikhan · 2026-07-17T06:11:58Z

@copilot run pr-finisher skill

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-17T06:32:52Z

@copilot run pr-finisher skill

Done in 6c23e60. I addressed the in-scope review feedback by clarifying the exported SkipHardcodedFallback contract, aligning the public spec test comment, and tightening the debug log wording. Local validation passed (go test ./pkg/actionpins -run 'SkipHardcodedFallback', make fmt, make lint, make test-unit, make test, make agent-report-progress). PR mergeability is clean; CI on the new HEAD is still unverified until a maintainer re-triggers it.

github-actions · 2026-07-17T07:24:54Z

🎉 This pull request is included in a new release.

Release: v0.82.12

CopilotAIand others added 3 commits July 17, 2026 03:39

chore: analyzing non-deterministic pin regression
f6b45a6
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

fix: preserve version comment for SHA-pinned actions when SkipHardcod…
3c09f74
…edFallback is set Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

revert: restore agentic-auto-upgrade.yml schedule (unrelated fuzzy-sc…
a572a35
…hedule churn) Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

CopilotAI assigned Copilot and pelikhan Jul 17, 2026

CopilotAI changed the title ~~fix: preserve version comment for SHA-pinned actions when SkipHardcodedFallback is set~~fix: SHA-pinned actions lose version comment when SkipHardcodedFallback is setJul 17, 2026

Copilotfinished work on behalf of pelikhan July 17, 2026 03:53

CopilotAI requested a review from pelikhan July 17, 2026 03:53

Copilotcreated this pull request from a session on behalf of pelikhan July 17, 2026 03:53 View session

pelikhan marked this pull request as ready for review July 17, 2026 06:02

CopilotAI review requested due to automatic review settings July 17, 2026 06:02

Copilotstarted reviewing on behalf of pelikhan July 17, 2026 06:03 View session

CopilotAI reviewed Jul 17, 2026
View reviewed changes

github-actionsBot approved these changes Jul 17, 2026
View reviewed changes

github-actionsBot mentioned this pull request Jul 17, 2026
[aw] No-Op Runs #43499
Closed

github-actionsBot approved these changes Jul 17, 2026
View reviewed changes

Copilotstarted work on behalf of pelikhan July 17, 2026 06:12 View session

docs: clarify SkipHardcodedFallback scope
6c23e60
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilotfinished work on behalf of pelikhan July 17, 2026 06:33

pelikhan merged commit c3d6a28 into mainJul 17, 2026
25 checks passed

pelikhan deleted the copilot/determine-avenger-lock-changes branch July 17, 2026 06:37

CopilotAI mentioned this pull request Jul 17, 2026
Refresh stale package specs and add linters doc drift guard #46257
Merged

github-actionsBot mentioned this pull request Jul 18, 2026
Smoke Test: MAI-Code-1-Flash - 29632319598 #46346
Closed

Uh oh!

Conversation

CopilotAI commented Jul 17, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Root cause

Fix

Uh oh!

github-actionsBot commented Jul 17, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Jul 17, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Jul 17, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Jul 17, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actionsBot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actionsBot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Fix Quality

Minor Issue

Uh oh!

github-actionsBotJul 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actionsBot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actionsBot commented Jul 17, 2026

🧪 Test Quality Sentinel Report

Verdict

Uh oh!

github-actionsBot left a comment

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Jul 17, 2026

Uh oh!

CopilotAI commented Jul 17, 2026

Uh oh!

Uh oh!

github-actionsBot commented Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

CopilotAI commented Jul 17, 2026•
edited
Loading

github-actionsBot commented Jul 17, 2026•
edited
Loading

github-actionsBot commented Jul 17, 2026•
edited
Loading

github-actionsBot commented Jul 17, 2026•
edited
Loading

github-actionsBot commented Jul 17, 2026•
edited
Loading