Groom auto-builder — Comfy-Org/github-workflows: this CONFIRMED finding could not be auto-built (patch modifies a CI-privileged path (per .github/groom/patch_policy.py — workflow/action defs, lockfiles, or build/test config that executes in pre-review CI) — a human must author these changes), so it is filed for a human. · run
Verified exactly as claimed. cursor-review.yml has 21 uses: actions/* lines; 17 are 40-hex SHA pins carrying a version comment and 4 float: actions/checkout@v6 (:393), actions/upload-artifact@v7 (:458), actions/download-artifact@v8 (:1259 and :1472). The sharpest instance is real: :1461 pins actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c and :1472, eleven lines later in the SAME consolidate job, uses @v8. test-refresh-reviewers.yml:29 and :34 (actions/checkout@v6, actions/setup-python@v6) are the only unpinned refs across the nine test-* workflows.
This matters most in cursor-review.yml specifically: it is a reusable workflow that other repos SHA-pin precisely to obtain an immutable execution surface, which a floating tag would defeat for those steps, and the jobs involved include ones that mint a bot App token.
Fix (mechanical):
- cursor-review.yml: reuse the SHAs its own siblings already carry, i.e. checkout
3d3c42e5aac5ba805825da76410c181273ba90b1 (v7.0.1), upload-artifact 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a (v7.0.1), download-artifact 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c (v8). While there, normalise the two spellings of that download-artifact version comment (v8 at :1461 and :1478 versus v8.0.1 at :1252).
- test-refresh-reviewers.yml: pin checkout and setup-python to the SHAs its sibling test workflows already use.
- Optional, and the step that makes it stick:
.github/workflow-pins/check_workflow_pins.py already text-parses every file in .github/workflows; add an action-SHA assertion with a self-draining exemption list in the style of its own KNOWN_EXEMPT (:48-56, which fails on a STALE entry).
Steelman, and why it still lands: actions/* is first-party GitHub, so the marginal risk from four floating tags is small, and .github/dependabot.yml already records the state honestly (a handful still sit on floating major tags, and those files get the least benefit from that config until they are pinned by hand). That argues against urgency, not against the fix: it is six lines, Dependabot keeps SHA pins fresh once they exist, and the inconsistency is already visible inside a single job.
Not flagged security-adjacent, deliberately: these are first-party actions, no auth or permission predicate is involved, and the repo already treats this as pinning hygiene with a documented backlog, so it is better implemented mechanically than filed as an investigation. The supply-chain dimension is real but second-order here.
Groom auto-builder — Comfy-Org/github-workflows: this CONFIRMED finding could not be auto-built (patch modifies a CI-privileged path (per .github/groom/patch_policy.py — workflow/action defs, lockfiles, or build/test config that executes in pre-review CI) — a human must author these changes), so it is filed for a human. · run
Verified exactly as claimed. cursor-review.yml has 21
uses: actions/*lines; 17 are 40-hex SHA pins carrying a version comment and 4 float:actions/checkout@v6(:393),actions/upload-artifact@v7(:458),actions/download-artifact@v8(:1259 and :1472). The sharpest instance is real: :1461 pinsactions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7cand :1472, eleven lines later in the SAME consolidate job, uses@v8. test-refresh-reviewers.yml:29 and :34 (actions/checkout@v6,actions/setup-python@v6) are the only unpinned refs across the nine test-* workflows.This matters most in cursor-review.yml specifically: it is a reusable workflow that other repos SHA-pin precisely to obtain an immutable execution surface, which a floating tag would defeat for those steps, and the jobs involved include ones that mint a bot App token.
Fix (mechanical):
3d3c42e5aac5ba805825da76410c181273ba90b1(v7.0.1), upload-artifact043fb46d1a93c77aae656e7c1c64a875d1fc6a0a(v7.0.1), download-artifact3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c(v8). While there, normalise the two spellings of that download-artifact version comment (v8 at :1461 and :1478 versus v8.0.1 at :1252)..github/workflow-pins/check_workflow_pins.pyalready text-parses every file in.github/workflows; add an action-SHA assertion with a self-draining exemption list in the style of its own KNOWN_EXEMPT (:48-56, which fails on a STALE entry).Steelman, and why it still lands: actions/* is first-party GitHub, so the marginal risk from four floating tags is small, and
.github/dependabot.ymlalready records the state honestly (a handful still sit on floating major tags, and those files get the least benefit from that config until they are pinned by hand). That argues against urgency, not against the fix: it is six lines, Dependabot keeps SHA pins fresh once they exist, and the inconsistency is already visible inside a single job.Not flagged security-adjacent, deliberately: these are first-party actions, no auth or permission predicate is involved, and the repo already treats this as pinning hygiene with a documented backlog, so it is better implemented mechanically than filed as an investigation. The supply-chain dimension is real but second-order here.