fix: repair two fabricated SHA pins and pre-existing whitespace

[jbdevprimary]

Summary

Two fabricated/non-existent SHA pins that break CI for every PR, not just mine — both confirmed via raw curl against the GitHub REST commits API on the full 40-character hash (not a prefix match, not transcribed from prose):

1. .github/workflows/automerge.yml: dependabot/fetch-metadata@db3088a99b59bc669c5853f669e2003c23d06b52 — this SHA does not exist (curl https://api.github.com/repos/dependabot/fetch-metadata/commits/<sha> → 422 "No commit found"). Every dependabot PR's automerge job fails to resolve this action as a result — an immediate, visible failure on every dependabot PR. This is the actual reason so many dependabot PRs read blocked/can't automerge. Fixed to the real v3.0.0 SHA (ffa630c65fa7e0ecfa0625b5ceda64399aea1b36) — verified against the tags API, and it's exactly what dependabot's own PR chore(deps): bump dependabot/fetch-metadata from 2.5.0 to 3.0.0 #7 already carries (that PR targets a file that doesn't exist until [codex] Harden installer, docs, and release governance #16 merges, so it can't deliver the fix itself).

2. .github/workflows/release.yml: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8ad5bc06adad52 labeled v6.0.0 — also nonexistent (confirmed the same way; it shares a 28-character prefix with the real v2.2.1 tag's SHA, c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda, which made this easy to mis-verify by eye/prefix-match — the full 40 characters diverge and it is a genuinely different, nonexistent hash). v6.0.0 has never been released either way (the action tops out at v3.0.2). This one is a latent failure: release.yml only triggers on release: published, so it would only have surfaced the next time a release was actually cut — the worst possible moment to discover a broken release-asset-upload step. Found by auditing every SHA pin across all workflow files the same way. Fixed to the real v3.0.2 SHA.

3. Pre-existing install.bash trailing-whitespace lint failure (same one on [codex] Harden installer, docs, and release governance #16/chore(deps): consolidate 7 GitHub Actions version bumps #29/fix(deps): remove orphaned uv.lock, resolving 3 Dependabot alerts #30) — bundled here since it's currently failing on main itself for any PR touching this file.

All other pins verified to exist via the same full-40-char commits-API check.

Test plan

• curl https://api.github.com/repos/<owner>/<repo>/commits/<full-40-char-sha> for every pin in every workflow file — all now resolve
• make lint / make test — both green
• CI green

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

Warning

Review limit reached

@jbdevprimary, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 102fc83e-dae0-4671-a0a0-d3dfedca3082

📥 Commits

Reviewing files that changed from the base of the PR and between 18f3cc5 and f9eb227.

📒 Files selected for processing (1)

• .github/workflows/automerge.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/broken-fetch-metadata-pin

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[amazon-q-developer]

This PR correctly fixes two critical CI failures caused by non-existent SHA pins in GitHub Actions workflows and addresses a pre-existing trailing whitespace lint error. The corrected SHA pins have been verified against the GitHub API and match the expected version tags. All changes are appropriate and resolve blocking issues without introducing new defects.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud