fix: drift detector must skip commented-out uses: lines

[hyperpolymath]

The detector matched uses: owner/repo@ref anywhere in a workflow, including inside comments.

metadatastician/_pathroot's e2e.yml carries ten commented-out # - uses: actions/checkout@34e11487… lines from a disabled job block. The live line already uses @v7.0.1 correctly — so the tool reported drift on dead code.

That is precisely the false-positive class that gets a detector ignored, which would be worse than not shipping it at all.

Verified both ways

Test	Before	After
_pathroot	1 false positive	clean
hypatia pre-fix fixture	finds real drift	still finds it

Found in anger

This surfaced while using the detector on metadatastician/metadatastician-governance#24. It correctly identified the four dead workflows in _pathroot — ts-blocker, guix-nix-policy, npm-bun-blocker, jekyll-gh-pages — with the false positive sitting alongside them. The signal was right; the noise needed removing.

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 920a70d8-6b54-477a-89c3-cd75286ee059

📥 Commits

Reviewing files that changed from the base of the PR and between 9f916c1 and 6027b7d.

📒 Files selected for processing (1)

• scripts/check-lockfile-drift.sh

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Updated lockfile drift checks to ignore commented-out workflow actions.
  • Prevented inactive action references from being incorrectly reported as drift.

Walkthrough

The lockfile drift check now removes full-line comments before it scans workflow files for uses: references. Commented-out actions no longer affect drift detection.

Changes

Lockfile drift detection

Layer / File(s)	Summary
Filter commented workflow actions scripts/check-lockfile-drift.sh	The action scan removes full-line comments before extracting uses: references. Normalisation and drift comparison remain unchanged.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested reviewers: joshuajewell

Poem

A rabbit checks the workflow lines
And skips the comments, neat and fine
The live actions remain in view
Drift checks now know what is true
The lockfile rests beneath the moon

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar