fix(workflows): make workflows_ref required, guard empty refs, lint the default (BE-5546) - #103

Open

mattmillerai wants to merge 12 commits into

mainfrom

matt/be-5546-require-workflows-ref

Commits on Aug 1, 2026

fix(workflows): make workflows_ref required, guard empty refs, lint the default (BE-5546)
mattmillerai
committed
fix(workflows): close the review panel's gaps in the workflows_ref lint + guard (BE-5546)
mattmillerai
committed
docs(workflow-pins): correct the KNOWN_EXEMPT staleness comment (BE-5546)
mattmillerai
committed
fix(workflow-pins): catch the flow-mapping form of the ref checkout (BE-5546)
mattmillerai
committed
fix(workflow-pins): catch the multi-line spelling of the ref checkout (BE-5546)
mattmillerai
committed
fix(workflow-pins): catch the commented spelling of the ref checkout (BE-5546)
mattmillerai
committed
fix(workflow-pins): the env binding is not the guard — verify the rejection (BE-5546)
mattmillerai
committed
fix(workflow-pins): tie the guard's empty test to the ref and its own branch (BE-5546)
mattmillerai
committed
fix(workflow-pins): the guard's condition must be the empty test, not contain it (BE-5546)
mattmillerai
committed
fix(workflow-pins): the inline branch ends at `fi`, and its exit must be bare (BE-5546)
mattmillerai
committed
fix(workflow-pins): the branch's exit must be at its own nesting depth (BE-5546)
mattmillerai
committed
fix(workflow-pins): a guard that can be skipped or soft-failed is not a guard (BE-5546)
mattmillerai
committed