From 6ea669ec8cbe813c71a0b07d85a6e69a7bc55098 Mon Sep 17 00:00:00 2001 From: Jake Fineman Date: Tue, 25 Aug 2026 15:02:34 -0400 Subject: [PATCH 1/3] chore(pr-agent): repoint the reusable pin to @main MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pinned SHA predates ed47221e and 32af9cef, both already on wave-foundation origin/main. Without the per-attempt timeout budget from 32af9cef a slow review consumes the 15-minute job ceiling, which GitHub renders as `cancelled` and which continue-on-error structurally cannot trap — so the lane looks configured and silently does not run. 100 of the fleet's callers already use @main; this adopts that convention. --- .github/workflows/pr-agent.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-agent.yml b/.github/workflows/pr-agent.yml index 5d4ce23..eadc552 100644 --- a/.github/workflows/pr-agent.yml +++ b/.github/workflows/pr-agent.yml @@ -18,6 +18,6 @@ concurrency: jobs: pr_agent: - uses: wave-av/wave-foundation/.github/workflows/reusable-pr-agent.yml@150ffae24f63e207ab81430fa64cb2b1e5c01546 # post-#1191 + uses: wave-av/wave-foundation/.github/workflows/reusable-pr-agent.yml@main # post-#1191 secrets: OPENAI_KEY: ${{ secrets.OPENAI_KEY }} From 32d87b746adba8cc25ffc14af0b511325eb58d43 Mon Sep 17 00:00:00 2001 From: Jake Fineman Date: Tue, 25 Aug 2026 15:41:46 -0400 Subject: [PATCH 2/3] fix(pr-agent): pin to the fixed reusable SHA, not @main MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @main trips the fleet zizmor `unpinned-uses` ratchet (baseline 0): claude-workstation workflow-lint failed with "This PR ADDS a workflow-security finding". Pinning to 32af9cef — the last commit touching reusable-pr-agent.yml, and the one that ADDS the per-attempt timeout budget — keeps SHA-pinning intact while still carrying both fixes (ed47221e, 32af9cef) the previous pin lacked. --- .github/workflows/pr-agent.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-agent.yml b/.github/workflows/pr-agent.yml index eadc552..dffe148 100644 --- a/.github/workflows/pr-agent.yml +++ b/.github/workflows/pr-agent.yml @@ -18,6 +18,6 @@ concurrency: jobs: pr_agent: - uses: wave-av/wave-foundation/.github/workflows/reusable-pr-agent.yml@main # post-#1191 + uses: wave-av/wave-foundation/.github/workflows/reusable-pr-agent.yml@32af9ceff3dcde239407b6edd5f788ba4feeb7c3 # post-#1191 secrets: OPENAI_KEY: ${{ secrets.OPENAI_KEY }} From 2755494cb7ad3b508b2d526e215659ed1234e1c2 Mon Sep 17 00:00:00 2001 From: Jake Fineman Date: Tue, 25 Aug 2026 17:07:20 -0400 Subject: [PATCH 3/3] chore(pr-agent): bump the pin past the merged lane fix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit wave-foundation#1273 merged, which added a `lane version` step to the reusable that annotates the resolved lane SHA and warns when a caller pins behind 32af9cef. Bumping from 32af9cef to 4ac59c8c picks that up, so this caller lands current instead of one commit stale on merge. Still SHA-pinned — @main trips the zizmor unpinned-uses ratchet (baseline 0). --- .github/workflows/pr-agent.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-agent.yml b/.github/workflows/pr-agent.yml index dffe148..b390893 100644 --- a/.github/workflows/pr-agent.yml +++ b/.github/workflows/pr-agent.yml @@ -18,6 +18,6 @@ concurrency: jobs: pr_agent: - uses: wave-av/wave-foundation/.github/workflows/reusable-pr-agent.yml@32af9ceff3dcde239407b6edd5f788ba4feeb7c3 # post-#1191 + uses: wave-av/wave-foundation/.github/workflows/reusable-pr-agent.yml@4ac59c8c9f97d2e900e2d34605c0092ca7ebb0fc # post-#1191 secrets: OPENAI_KEY: ${{ secrets.OPENAI_KEY }}