fix(enrichment): exclude official actions/github refs case-insensitively

[jaso0n0818]

What

The unpinned-Actions analyzer excludes official actions/* and github/* refs from its findings (lowest-risk, extremely common). The exclusion regex /^(actions|github)\// is case-sensitive.

Why it is a bug

GitHub org/user names are case-insensitive (github.com/Actions is github.com/actions). A workflow line like uses: Actions/checkout@v4 (or GitHub/codeql-action/init@v3) references the official action, but the case-sensitive exclusion fails to match it — so the analyzer mis-flags an official action as a mutable third-party supply-chain risk. That is a false positive in a security signal.

It is also inconsistent with the same analyzer's own path handling: isWorkflowPath already matches GitHub workflow paths case-insensitively (workflow-path.ts: "GitHub workflow paths are case-insensitive", .toLowerCase()). The official-org exclusion should be case-insensitive for the same reason.

Fix

Add the i flag: /^(actions|github)\//i. GitHub reserves the actions and github orgs, so this can never over-match a real third-party org.

Test

Adds a case-variant scenario (Actions/checkout, GitHub/codeql-action, ACTIONS/setup-node) asserting that only the genuine mutable third-party ref is flagged. It fails on the pre-fix regex (which flags the official refs) and passes after.

No linked issue

No linked issue because this is a maintenance fix for a case-sensitivity inconsistency within the analyzer; there is no tracking issue to link.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-02 23:10:53 UTC}

2 files · 1 AI reviewer · no blockers · readiness 80/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
This change correctly moves the official Actions/GitHub owner exclusion to a case-insensitive match, which aligns the analyzer with GitHub's case-insensitive owner semantics and the existing workflow-path behavior. The added unit test exercises mixed-case official refs alongside a real third-party mutable ref, so the important regression path is covered without changing scan behavior for third-party actions.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ No-issue rationale	PR body explains why no issue is linked.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (size label size:XS; no linked issue context).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 332 registered-repo PR(s), 176 merged, 6 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	jaso0n0818; Gittensor profile; 332 PR(s), 6 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: jaso0n0818
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 332 PR(s), 6 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Await review-lane availability.
• Refresh registry data or choose a registered active repo.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review