Skip to content

fix(enrichment): match workflow paths case-insensitively in actions-pin#2516

Merged
JSONbored merged 1 commit into
JSONbored:mainfrom
kiannidev:fix/actions-pin-workflow-path-case
Jul 2, 2026
Merged

fix(enrichment): match workflow paths case-insensitively in actions-pin#2516
JSONbored merged 1 commit into
JSONbored:mainfrom
kiannidev:fix/actions-pin-workflow-path-case

Conversation

@kiannidev

@kiannidev kiannidev commented Jul 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • scanActionPins only scanned files matching a case-sensitive .github/workflows/*.ya?ml regex.
  • Paths like .github/Workflows/CI.YML were skipped entirely, so mutable third-party uses: refs evaded detection.
  • Normalize paths to lowercase (with backslash-to-slash) before matching, consistent with isConfigFile in path-matchers.ts and change-guardrail tests.

Scope

  • The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
  • This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
  • This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
  • I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

  • git diff --check
  • review-enrichment build + node --test test/actions-pin.test.ts — 5/5 passing (includes mixed-case workflow path regression)
  • npm run rees:test — full enrichment gate pending CI on fork PR

Safety

  • No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
  • Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
  • Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. N/A.
  • API/OpenAPI/MCP behavior is updated and tested where needed. Enrichment analyzer only.
  • Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

@kiannidev @cursoragent
fix(enrichment): match workflow paths case-insensitively in actions-pin
7cf26bd 
The actions-pin analyzer skipped workflow files when directory or extension
casing differed from the lowercase pattern, letting mutable third-party uses
evade detection.

Co-authored-by: Cursor <cursoragent@cursor.com>
@kiannidev
kiannidev requested a review from JSONbored as a code owner July 2, 2026 06:38
@dosubot dosubot Bot added the size:XS label Jul 2, 2026
@loopover-orb

loopover-orb Bot commented Jul 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

Review updated: 2026-07-02 07:20:45 UTC

2 files · 1 AI reviewer · no blockers · readiness 66/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
The change correctly moves workflow-file gating through a small helper that normalizes separators and lowercases paths before applying the existing workflow regex, so mixed-case workflow YAML paths now reach the existing `scanWorkflowPins` logic without changing finding attribution. The added regression test covers the case-insensitive path behavior and preserves the non-workflow exclusion path. With the provided full file and passing checks, the diff is narrow and coherent.

Nits — 5 non-blocking
  • nit: `review-enrichment/test/actions-pin.test.ts:121` covers case-insensitive matching but not the new backslash normalization path introduced in `review-enrichment/src/analyzers/actions-pin.ts:12`.
  • nit: `review-enrichment/src/analyzers/actions-pin.ts:11` keeps `WORKFLOW_PATH` as an uppercase constant even though callers should now use `isWorkflowPath`; this is fine locally, but exporting the helper or naming the regex as internal-only would reduce future direct-use drift if this matcher grows.
  • Add one assertion or fixture in `review-enrichment/test/actions-pin.test.ts:121` for `.github\\workflows\\ci.yml` so the separator normalization behavior is pinned by a real test.
  • Consider moving `isWorkflowPath` near the other path-matcher helpers if more analyzers need the same normalization convention, but keeping it local is acceptable for this focused change.
  • Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.
Signal Result Evidence
Code review ✅ No blockers 1 reviewer
Linked issue ⚠️ Missing No linked issue or no-issue rationale found.
Related work ✅ No active overlap found No same-issue or scoped active PR overlap found.
Change scope ✅ 20/20 Low review scope from cached public metadata (size label size:XS; no linked issue context).
Validation posture ❌ 5/25 Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload ✅ 10/10 Author activity: 2219 registered-repo PR(s), 1173 merged, 39 issue(s).
Contributor context ✅ Confirmed Gittensor contributor kiannidev; Gittensor profile; 2219 PR(s), 39 issue(s).
Gate result ✅ Passing No configured blocker found.
Review context
  • Author: kiannidev
  • Role context: outside_contributor
  • Public audience mode: oss maintainer
  • Lane context: Repository registration is not available in the local Gittensory cache.
  • Public profile languages: not available
  • Official Gittensor activity: 2219 PR(s), 39 issue(s).
  • PR-specific overlap: none found.
Contributor next steps
  • Explain no-issue PR.
  • Await review-lane availability.
  • Triage stale or unlinked PRs.
  • Refresh registry data or choose a registered active repo.
  • Link the issue being solved, or explicitly explain why this is a no-issue PR.
Signal definitions
  • Related work = same linked issue, overlapping active PRs, or title/path similarity.
  • Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
  • Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
  • Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
  • Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

  • Re-run Gittensory review

@loopover-orb loopover-orb Bot added gittensor gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. labels Jul 2, 2026
@dosubot dosubot Bot added the lgtm label Jul 2, 2026
@JSONbored
JSONbored merged commit c0e8660 into JSONbored:main Jul 2, 2026
7 checks passed
@github-project-automation github-project-automation Bot moved this from Todo to Done in gittensory - v1 roadmap Jul 2, 2026
@kiannidev kiannidev mentioned this pull request Jul 2, 2026
Merged
9 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JSONbored JSONbored JSONbored approved these changes

Assignees

@kiannidev kiannidev

Labels

gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier.

Projects

No open projects
gittensory - v1 roadmap
Status: Done

Milestone

REES analyzer runtime (epic #1499)

Development

Successfully merging this pull request may close these issues.

2 participants

@kiannidev @JSONbored