fix(enrichment): classify workflow paths case-insensitively in analysis-context

review-enrichment/src/analysis-context.ts

@@ -17,6 +17,7 @@ import {
   type BoundedFetchOptions,
   type BoundedFetchResult,
 } from "./external-fetch.js";
+import { isWorkflowPath } from "./workflow-path.js";
 
 type ChangedFile = NonNullable<EnrichRequest["files"]>[number];
 
@@ -422,7 +423,7 @@ function categorizeFile(path: string): FileCategory {
   ) {
     return { path, extension, category: "lockfile" };
   }
-  if (path.startsWith(".github/workflows/")) {
+  if (isWorkflowPath(path)) {
     return { path, extension, category: "workflow" };
   }
   if (

review-enrichment/src/analyzers/actions-pin.ts

@@ -3,15 +3,11 @@
 // where a compromised upstream tag silently re-points and runs in your CI with your secrets. Pure compute, no network.
 // Official actions/* + github/* are excluded (lowest risk, extremely common) to keep the signal high. Line-cited.
 import type { EnrichRequest, ActionPinFinding } from "../types.js";
+import { isWorkflowPath } from "../workflow-path.js";
 
 const USES_RE = /^\s*-?\s*["']?uses["']?\s*:\s*["']?([\w.-]+\/[\w./-]+)@([^\s"'#]+)/;
 const FULL_SHA = /^[0-9a-f]{40}$/;
 const OFFICIAL = /^(actions|github)\//;
-const WORKFLOW_PATH = /^\.github\/workflows\/.+\.ya?ml$/;
-
-function isWorkflowPath(path: string): boolean {
-  return WORKFLOW_PATH.test(path.replace(/\\/g, "/").toLowerCase());
-}
 
 /** Scan one workflow patch's added lines for unpinned third-party `uses:` refs, line-cited via hunk headers. Pure. */
 export function scanWorkflowPins(

review-enrichment/src/workflow-path.ts

@@ -0,0 +1,6 @@
+const WORKFLOW_PATH = /^\.github\/workflows\/.+\.ya?ml$/;
+
+/** GitHub workflow paths are case-insensitive; normalize separators before matching. */
+export function isWorkflowPath(path: string): boolean {
+  return WORKFLOW_PATH.test(path.replace(/\\/g, "/").toLowerCase());
+}

review-enrichment/test/analysis-context.test.ts

@@ -420,3 +420,28 @@ test("createAnalysisContext treats capped patch scans as added-line presence", (
     true,
   );
 });
+
+test("createAnalysisContext classifies workflow paths case-insensitively", () => {
+  const context = createAnalysisContext({
+    repoFullName: "JSONbored/gittensory",
+    prNumber: 2516,
+    files: [
+      {
+        path: ".github/Workflows/CI.YML",
+        patch: "@@ -1,0 +1,1 @@\n+    - uses: pnpm/action-setup@v3",
+      },
+      {
+        path: "docs/readme.md",
+        patch: "@@ -1,0 +1,1 @@\n+# docs",
+      },
+    ],
+  });
+
+  assert.deepEqual(
+    context.fileCategories.map((file) => [file.path, file.category]),
+    [
+      [".github/Workflows/CI.YML", "workflow"],
+      ["docs/readme.md", "docs"],
+    ],
+  );
+});

review-enrichment/test/scheduler.test.ts

@@ -246,3 +246,30 @@ test("added-line analyzers run when patch scan is capped before additions", asyn
   assert.equal(brief.telemetry.skippedWorkByCategory.analyzer_no_added_lines, undefined);
   assert.ok(brief.telemetry.cappedWorkByCategory.has_added_lines_patch_bytes > 0);
 });
+
+test("actionPin runs for mixed-case workflow paths", async () => {
+  let actionPinRan = false;
+  const brief = await buildBrief(
+    {
+      repoFullName: "JSONbored/gittensory",
+      prNumber: 2516,
+      analyzers: ["actionPin"],
+      files: [
+        {
+          path: ".github/Workflows/CI.YML",
+          patch: "@@ -1,0 +5,1 @@\n+    - uses: pnpm/action-setup@v3",
+        },
+      ],
+    },
+    {
+      actionPin: async () => {
+        actionPinRan = true;
+        return [{ file: ".github/Workflows/CI.YML", line: 5, action: "pnpm/action-setup", ref: "v3" }];
+      },
+    },
+  );
+
+  assert.equal(actionPinRan, true);
+  assert.equal(brief.analyzerStatus.actionPin, "ok");
+  assert.notEqual(brief.telemetry.analyzers.actionPin.skipReason, "no_workflow");
+});