fix(pr-risk): enforce workflows_ref as a full 40-hex commit SHA before the tool checkout (BE-6307) - #118

Open

mattmillerai wants to merge 8 commits into

mainfrom

matt/be-6307-pr-risk-workflows-ref-pin

Commits on Aug 4, 2026

fix(pr-risk): enforce workflows_ref as a full 40-hex commit SHA before the tool checkout (BE-6307)
mattmillerai
committed
804c2cc
fix(pr-risk): tie workflows_ref to the SHA `uses:` resolved to, not just to SHA shape (BE-6307)
mattmillerai
committed
3eefe3a
fix(pr-risk): fail closed when job_workflow_sha is unreadable, and assert the guard by property (BE-6307)
mattmillerai
committed
72e5a4f
fix(pr-risk): close the guard's neuter paths, and make the suite assert positions not sums (BE-6307)
mattmillerai
committed
85ba6d2
fix(pr-risk): correct the pin contract's claims, sanitize the runner SHA, and close the suite's bypass holes (BE-6307)
mattmillerai
committed
382a0e1
fix(pr-risk): scope the alias scan to the guard step, judge emits per statement, cover the runner SHA (BE-6307)
mattmillerai
committed
1c5659d
test(pr-risk): use ERE for the emit-scan coverage grep (BE-6307)
mattmillerai
committed
2f207ac
fix(pr-risk): drop the lock-step axis — github.job_workflow_sha does not exist (BE-6307)
mattmillerai
committed
c2f849b