fix(pr-risk): enforce workflows_ref as a full 40-hex commit SHA before the tool checkout (BE-6307) - #118

Merged

mattmillerai merged 8 commits into

mainfrom

matt/be-6307-pr-risk-workflows-ref-pin

Aug 4, 2026

Commits on Aug 4, 2026

fix(pr-risk): enforce workflows_ref as a full 40-hex commit SHA before the tool checkout (BE-6307)
mattmillerai
committed
8024f69
fix(pr-risk): tie workflows_ref to the SHA `uses:` resolved to, not just to SHA shape (BE-6307)
mattmillerai
committed
48eb512
fix(pr-risk): fail closed when job_workflow_sha is unreadable, and assert the guard by property (BE-6307)
mattmillerai
committed
dabdfe1
fix(pr-risk): close the guard's neuter paths, and make the suite assert positions not sums (BE-6307)
mattmillerai
committed
b68a2cb
fix(pr-risk): correct the pin contract's claims, sanitize the runner SHA, and close the suite's bypass holes (BE-6307)
mattmillerai
committed
f314614
fix(pr-risk): scope the alias scan to the guard step, judge emits per statement, cover the runner SHA (BE-6307)
mattmillerai
committed
c77b30b
test(pr-risk): use ERE for the emit-scan coverage grep (BE-6307)
mattmillerai
committed
4efc5e7
fix(pr-risk): drop the lock-step axis — github.job_workflow_sha does not exist (BE-6307)
mattmillerai
committed
936e275