fix: SHA-pinned actions lose version comment when SkipHardcodedFallback is set by Copilot · Pull Request #46122 · github/gh-aw

Copilot · 2026-07-17T03:53:23Z

When GH_HOST is non-github.com or the git remote doesn't resolve to github.com (common in sandbox/CI), SkipHardcodedFallback=true caused resolveActionPinFromHardcodedPins to skip all hardcoded lookups — including SHA→version resolution. The fallback then emitted FormatPinnedActionReference(repo, sha, sha), replacing # v7.0.0 with # 9c091bb... in lock files on every recompile.

Root cause

SkipHardcodedFallback guards against using bundled version→SHA mappings on non-github.com hosts (stale pin risk). The guard was also applied to SHA→version lookups, which are purely informational and host-independent.

Fix

pkg/actionpins/actionpins.go: Change early-return condition from if ctx.SkipHardcodedFallback to if ctx.SkipHardcodedFallback && !isAlreadySHA in resolveActionPinFromHardcodedPins

// Before: skipped hardcoded lookup entirely
if ctx.SkipHardcodedFallback {
    return "", false
}

// After: still skip version→SHA lookup, but allow SHA→version for comment resolution
if ctx.SkipHardcodedFallback && !isAlreadySHA {
    return "", false
}

actionpins_internal_test.go / spec_test.go: Regression tests — SHA-pinned action with SkipHardcodedFallback=true must still produce # v7.0.0, not # <sha>.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…edFallback is set Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…hedule churn) Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-07-17T06:03:45Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

github-actions · 2026-07-17T06:03:50Z

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #46122 does not have the 'implementation' label and has only 56 new lines of code in business logic directories (threshold: 100).

github-actions · 2026-07-17T06:03:50Z

✅ Test Quality Sentinel completed test quality analysis.

github-actions · 2026-07-17T06:03:52Z

✅ PR Code Quality Reviewer completed the code quality review.

Copilot

Pull request overview

Fixes SHA-pinned action version comments when hardcoded version-to-SHA fallback is disabled.

Changes:

Allows exact SHA-to-version metadata lookup.
Adds internal and public regression tests.
Regenerates the release lock manifest.

Show a summary per file

File	Description
`pkg/actionpins/actionpins.go`	Permits SHA-to-version lookup during skipped fallback.
`pkg/actionpins/actionpins_internal_test.go`	Tests internal resolution behavior.
`pkg/actionpins/spec_test.go`	Tests the public API regression.
`.github/workflows/release.lock.yml`	Restores the setup-go version metadata.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 4/4 changed files
Comments generated: 2
Review effort level: Medium

+	// However, when version is already a SHA (isAlreadySHA), the lookup is purely
+	// SHA→version (to find a human-readable version label for the comment). That
+	// operation carries no security risk regardless of host, so it is always allowed.
+	if ctx.SkipHardcodedFallback && !isAlreadySHA {


 		assert.Contains(t, result, "actions/checkout@", "result should reference actions/checkout")
 	})
+
+	t.Run("SHA-pinned action with SkipHardcodedFallback=true still produces version comment", func(t *testing.T) {


github-actions

Clean, well-scoped fix. The narrowed guard () is correct — SHA→version lookup is purely informational and host-independent, so allowing it through even on non-github.com hosts carries no security risk. The regression tests are explicit and adequately cover both the blocked path (version→SHA still skipped) and the newly allowed path (SHA→version proceeds). Lock file change confirms the fix works end-to-end.

🔎 Code quality review by PR Code Quality Reviewer · 10.5 AIC · ⌖ 4.28 AIC · ⊞ 5.6K
_{Comment /review to run again}

github-actions

Skills-Based Review 🧠

Applied /diagnosing-bugs and /tdd — approving with one minor suggestion.

📋 Key Themes & Highlights

Fix Quality

✅ Root cause correctly identified: SkipHardcodedFallback guarded SHA→version lookups even though those are host-independent and informational only
✅ The one-line condition change (&& !isAlreadySHA) is minimal and surgical
✅ Regression tests added at both internal and public API levels — solid coverage of the exact failure mode
✅ Test names read as specifications and clearly document the pre-fix failure

Minor Issue

Log message on line 399 still says skipping hardcoded pin lookup but now only fires for version→SHA requests — see inline comment for a suggested update.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · 16.5 AIC · ⌖ 4.41 AIC · ⊞ 6.7K
_{Comment /matt to run again}

github-actions · 2026-07-17T06:10:45Z

+	// However, when version is already a SHA (isAlreadySHA), the lookup is purely
+	// SHA→version (to find a human-readable version label for the comment). That
+	// operation carries no security risk regardless of host, so it is always allowed.
+	if ctx.SkipHardcodedFallback && !isAlreadySHA {


[/diagnosing-bugs] The log message still says "skipping hardcoded pin lookup" but now only fires for version→SHA lookups — slightly misleading when reading logs.

💡 Suggested update

actionPinsLog.Printf("SkipHardcodedFallback set, skipping version→SHA hardcoded pin lookup for %s@%s", actionRepo, version)

This makes it clearer in debug logs that SHA→version lookups are still allowed.

@copilot please address this.

github-actions

The fix is correct and well-tested.

Root cause & fix: SkipHardcodedFallback was unconditionally skipping all hardcoded-pin lookups. The fix restricts the skip to version→SHA lookups (!isAlreadySHA), which is the only case where bundled data could introduce stale/wrong pins on non-github.com hosts. SHA→version lookups are purely informational (no security risk), so they are now always allowed.

Tests: Both the internal and public-API regression tests directly exercise the before/after behavior using a real embedded pin (actions/checkout), making them meaningful rather than mock-driven.

Lock file: The manifest update (actions/setup-go gaining its v7.0.0 comment) is a correct side-effect of the fix.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · 12.9 AIC · ⌖ 4.31 AIC · ⊞ 5K

github-actions · 2026-07-17T06:11:40Z

🧪 Test Quality Sentinel Report

✅ Test Quality Score: 85/100 — Excellent

Analyzed 6 test function(s) (10 subtests): 6 design, 0 implementation, 0 violation(s).

📊 Metrics (6 tests)

Metric	Value
Analyzed	6 (Go: 6, JS: 0)
✅ Design	6 (100%)
⚠️ Implementation	0 (0%)
Edge/error coverage	5 (83%)
Duplicate clusters	0
Inflation	Yes (test:prod ≈ 8:1; -10 pts)
🚨 Violations	0

Test	File	Classification	Issues
`TestResolveExactHardcodedPin_BySHA`	`actionpins_internal_test.go:335`	design_test / high_value	None
`TestResolveExactHardcodedPin_ByVersion`	`actionpins_internal_test.go:344`	design_test / high_value	None
`TestResolveExactHardcodedPin_NoMatch`	`actionpins_internal_test.go:354`	design_test / high_value	None
`TestResolveExactHardcodedPin_VersionTakesPrecedenceOverSHA`	`actionpins_internal_test.go:363`	design_test / high_value	None
`TestResolveActionPinFromHardcodedPins_SkipHardcodedFallback`	`actionpins_internal_test.go:432`	design_test / high_value	None
`TestSpec_PublicAPI_ResolveActionPin_SkipHardcodedFallback`	`spec_test.go:339`	design_test / high_value	None

Verdict

✅ Passed. 0% implementation tests (threshold: 30%). Tests directly exercise the regression described in the PR — SHA-pinned actions under SkipHardcodedFallback=true now emit correct version comments. The inline regression subtest ("SHA-pinned action with SkipHardcodedFallback=true still produces version comment") is particularly valuable: it documents the before/after contract and will catch any future regressions. Test inflation (8:1 added lines) is expected given the focused production fix and the need for thorough behavioral coverage of the new resolveExactHardcodedPin extraction.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🧪 Test quality analysis by Test Quality Sentinel · 44.1 AIC · ⌖ 7.93 AIC · ⊞ 6.8K · ◷
_{Comment /review to run again}

github-actions

✅ Test Quality Sentinel: 85/100. 0% implementation tests (threshold: 30%). All new tests classify as design tests with strong behavioral contracts directly exercising the regression fix.

pelikhan · 2026-07-17T06:11:58Z

@copilot run pr-finisher skill

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-17T06:32:52Z

@copilot run pr-finisher skill

Done in 6c23e60. I addressed the in-scope review feedback by clarifying the exported SkipHardcodedFallback contract, aligning the public spec test comment, and tightening the debug log wording. Local validation passed (go test ./pkg/actionpins -run 'SkipHardcodedFallback', make fmt, make lint, make test-unit, make test, make agent-report-progress). PR mergeability is clean; CI on the new HEAD is still unverified until a maintainer re-triggers it.

github-actions · 2026-07-17T07:24:54Z

🎉 This pull request is included in a new release.

Release: v0.82.12

Copilot AI and others added 3 commits July 17, 2026 03:39

chore: analyzing non-deterministic pin regression

f6b45a6

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

fix: preserve version comment for SHA-pinned actions when SkipHardcod…

3c09f74

…edFallback is set Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

revert: restore agentic-auto-upgrade.yml schedule (unrelated fuzzy-sc…

a572a35

…hedule churn) Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Jul 17, 2026

Copilot AI changed the title ~~fix: preserve version comment for SHA-pinned actions when SkipHardcodedFallback is set~~ fix: SHA-pinned actions lose version comment when SkipHardcodedFallback is set Jul 17, 2026

Copilot finished work on behalf of pelikhan July 17, 2026 03:53

Copilot AI requested a review from pelikhan July 17, 2026 03:53

Copilot created this pull request from a session on behalf of pelikhan July 17, 2026 03:53 View session

pelikhan marked this pull request as ready for review July 17, 2026 06:02

Copilot AI review requested due to automatic review settings July 17, 2026 06:02

Copilot started reviewing on behalf of pelikhan July 17, 2026 06:03 View session

Copilot AI reviewed Jul 17, 2026

View reviewed changes

github-actions Bot approved these changes Jul 17, 2026

View reviewed changes

github-actions Bot mentioned this pull request Jul 17, 2026

[aw] No-Op Runs #43499

Open

github-actions Bot approved these changes Jul 17, 2026

View reviewed changes

Copilot started work on behalf of pelikhan July 17, 2026 06:12 View session

docs: clarify SkipHardcodedFallback scope

6c23e60

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 17, 2026 06:33

pelikhan merged commit c3d6a28 into main Jul 17, 2026
25 checks passed

pelikhan deleted the copilot/determine-avenger-lock-changes branch July 17, 2026 06:37

github-actions Bot mentioned this pull request Jul 17, 2026

Smoke Test: MAI-Code-1-Flash - 29562782974 #46167

Open

Uh oh!

Conversation

Copilot AI commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Root cause

Fix

Uh oh!

github-actions Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Fix Quality

Minor Issue

Uh oh!

github-actions Bot Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 17, 2026

🧪 Test Quality Sentinel Report

Verdict

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Jul 17, 2026

Uh oh!

Copilot AI commented Jul 17, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jul 17, 2026 •

edited

Loading

github-actions Bot commented Jul 17, 2026 •

edited

Loading

github-actions Bot commented Jul 17, 2026 •

edited

Loading

github-actions Bot commented Jul 17, 2026 •

edited

Loading

github-actions Bot commented Jul 17, 2026 •

edited

Loading