fix: address shared sync review blockers

[stranske]

Addresses active non-outdated review feedback on the current consumer sync wave at its source of truth.

• allow unresolved slot profiles to continue to provider-level reviewed selection
• avoid a fragile direct requests import in catalog discovery
• reject credential-like evidence segments after # or @
• pin the agent-run base actions to immutable commits

Validated: focused pytest (62 passed), template sync/completeness, and git diff --check.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Excluded labels (none allowed) (7)

• sync
• workflow:source-sync
• workflow:source-maintenance
• consumer-sync
• integration-sync
• workflows-sync
• template-sync

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 4f3e3736-c718-4646-b56b-a65c3b1d46cf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-sync-review-blockers-20260715

---

_{Comment @coderabbitai help to get the list of available commands.}

[agents-workflows-bot]

Automated Status Summary

Head SHA: 72bf064
Latest Runs: ⏳ pending — Gate
Required contexts: Gate / gate, Health 45 Agents Guard / guard
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 1

Coverage Trend

Metric	Value
Current	75.66%
Baseline	85.00%
Delta	-9.34%
Minimum	70.00%
Status	✅ Pass

Top Coverage Hotspots (lowest coverage)

File	Coverage	Missing
scripts/issue_dedup_smoke.py	0.0%	4
scripts/runner_lib/__main__.py	0.0%	3
scripts/validate_template_sync.py	0.0%	81
scripts/langchain/topic_splitter.py	19.1%	57
tools/codex_log_analyzer.py	19.6%	140
scripts/repo_review_round2_runner.py	25.1%	344
scripts/prune_agent_stubs.py	39.7%	26
scripts/repo_review_round1_runner.py	40.7%	133
tools/ensure_workflow_timeout_variables.py	42.1%	74
scripts/sync_label_docs.py	42.9%	64
tools/ci_failure_triage.py	44.2%	123
tools/discover_model_catalog.py	44.8%	55
scripts/repo_review_backlog_scan.py	45.3%	116
scripts/repo_review_body_writer.py	46.5%	86
tools/codex_session_analyzer.py	47.9%	59

Low Coverage Files (<50.0%)

File	Coverage	Missing
scripts/issue_dedup_smoke.py	0.0%	4
scripts/runner_lib/__main__.py	0.0%	3
scripts/validate_template_sync.py	0.0%	81
scripts/langchain/topic_splitter.py	19.1%	57
tools/codex_log_analyzer.py	19.6%	140
scripts/repo_review_round2_runner.py	25.1%	344
scripts/prune_agent_stubs.py	39.7%	26
scripts/repo_review_round1_runner.py	40.7%	133
tools/ensure_workflow_timeout_variables.py	42.1%	74
scripts/sync_label_docs.py	42.9%	64
tools/ci_failure_triage.py	44.2%	123
tools/discover_model_catalog.py	44.8%	55
scripts/repo_review_backlog_scan.py	45.3%	116
scripts/repo_review_body_writer.py	46.5%	86
tools/codex_session_analyzer.py	47.9%	59

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined

[Copilot]

Pull request overview

This PR addresses consumer sync review blockers by making model selection more resilient to malformed slot profiles, removing a direct requests dependency from catalog discovery, tightening credential-like evidence detection, and pinning critical GitHub Actions to immutable SHAs.

Changes:

• Adjust slot-driven model selection to skip malformed slot profiles and fall back to provider-level reviewed selection.
• Replace requests usage in model catalog discovery with urllib.request and update tests accordingly.
• Expand credential-like evidence segment detection to include # and @ delimiters; pin agent-run-base composite action dependencies to commit SHAs.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tools/llm_registry.py	Skip malformed slot selections so they don’t mask provider-level reviewed selection/fallback.
templates/consumer-repo/tools/llm_registry.py	Mirrors the slot-selection behavior change in the consumer template copy.
tests/tools/test_llm_registry_selection.py	Updates the expected behavior for unknown slot profiles to use reviewed fallback selection.
tools/discover_model_catalog.py	Removes requests by switching to urllib for fixed-URL catalog fetching and error handling.
tests/tools/test_discover_model_catalog.py	Updates request mocking/assertions for the new urllib-based fetch path.
scripts/runner_lib/core.py	Tightens secret-like evidence detection to reject segments following # or @.
.github/actions/agent-run-base/action.yml	Pins actions/create-github-app-token and actions/checkout to immutable commit SHAs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e870f2399e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Runner dispatch state for codex on PR #2778. Do not edit.

[stranske]

Runner dispatch state for autofix on PR #2778. Do not edit.