test(enrichment): unit coverage for the actions-pin workflow scanner

[JSONbored]

review-enrichment/src/analyzers/actions-pin.ts (54 lines) has no test. scanWorkflowPins is a pure scanner that flags GitHub Actions pinned to a mutable ref (branch/tag) instead of a commit SHA — small and fully deterministic. Part of the REES analyzer runtime.

Deliverables

• Create review-enrichment/test/actions-pin.test.ts
• scanWorkflowPins: uses: owner/action@v3 (tag → flagged), @main (branch → flagged), @<40-char sha> (pinned → not flagged), and non-uses lines ignored
• Finding shape (file/line/action) and stable ordering
• Leave scanActionPins request wiring out of scope

References

• review-enrichment/src/analyzers/actions-pin.ts:13
• review-enrichment/src/analyzers/actions-pin.ts:44

Part of #1499.

---

size: XS · gittensor:bug

[linear-code]

JSO-2218