From fe85a664c2e64f7025e8cbe6b2416bc26072d69c Mon Sep 17 00:00:00 2001 From: luckyPipewrench Date: Tue, 18 Aug 2026 14:41:36 -0400 Subject: [PATCH] ci: pin the reviewer to the release carrying credential redaction The shared reviewer publishes model findings into pull-request comments, and a finding can quote the line it is describing. Until this pin moves, that text reaches a comment without being checked for credential material first. Both pinned positions move in this one commit. Leaving them out of step would run one commit's workflow against a different commit's reviewer. --- .github/workflows/pr-review.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr-review.yaml b/.github/workflows/pr-review.yaml index d2fdca5..7ac9094 100644 --- a/.github/workflows/pr-review.yaml +++ b/.github/workflows/pr-review.yaml @@ -35,7 +35,7 @@ jobs: github.event_name == 'workflow_dispatch') # Pinned to an immutable Pipelock commit in both positions. A branch or tag # here would run reviewer code that can change under the pin. - uses: luckyPipewrench/pipelock/.github/workflows/pr-review-reusable.yaml@74b3b3f1099d8d6d8ffeb67407ba7e99d1bd3119 + uses: luckyPipewrench/pipelock/.github/workflows/pr-review-reusable.yaml@aa5c8dc6661c72632533ef6cee9453614ee4d885 with: pr_number: >- ${{ github.event_name == 'issue_comment' && @@ -45,7 +45,7 @@ jobs: (github.event.comment.body == '/review deep' && 'deep' || 'default') || inputs.review_mode }} - reviewer_sha: 74b3b3f1099d8d6d8ffeb67407ba7e99d1bd3119 + reviewer_sha: aa5c8dc6661c72632533ef6cee9453614ee4d885 # Personal-account repositories cannot use secrets: inherit with a reusable # workflow, so every secret the reviewer needs is mapped by name. secrets: