fix(enrichment): treat uppercase action SHA pins as pinned

[bohdansolovie]

Summary

• Match GitHub commit refs case-insensitively in the actions-pin analyzer.
• Stop reporting uppercase 40-character SHA pins as mutable third-party workflow references.

Why production-only

Regression coverage already lives on main in review-enrichment/test/actions-pin.test.ts (#2396). This PR changes only the analyzer so it does not collide with that test file.

Test plan

• npm run rees:test -- test/actions-pin.test.ts

[superagent-security]

🚨 Contributor flagged. Click here for more info: Superagent Dashboard

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-02 06:21:35 UTC}

2 files · 1 AI reviewer · no blockers · readiness 66/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
This change correctly makes the action-ref full-SHA check case-insensitive, so uppercase and mixed-case 40-character hex refs are no longer reported as mutable. The production change is narrow and matches the stated analyzer behavior, but the test diff deletes several existing regression cases that covered line attribution, quoted `uses` syntax, `.yaml` workflow files, unchanged lines, missing patches, and positive findings through `scanActionPins`. The regex change itself is safe enough, but the test rewrite weakens coverage around behavior this analyzer still owns.

Nits — 7 non-blocking

• nit: `review-enrichment/test/actions-pin.test.ts` deletes the existing `scanActionPins` positive-path assertion, so the entrypoint no longer proves it reports mutable refs in changed workflow files.
• nit: `review-enrichment/test/actions-pin.test.ts` removes coverage for quoted `uses` keys and values even though `USES_RE` still intentionally supports them.
• nit: `review-enrichment/test/actions-pin.test.ts` removes the `.yaml` workflow-file case and the no-patch case, leaving `WORKFLOW_PATH` and patch filtering less well protected.
• Restore the deleted positive `scanActionPins` case in `review-enrichment/test/actions-pin.test.ts` and add the uppercase SHA case alongside it instead of replacing broad behavior coverage.
• Keep at least one quoted-`uses` regression in `review-enrichment/test/actions-pin.test.ts` because the parser explicitly accepts both single- and double-quoted YAML keys/values.
• AI maintainer-assist flagged possible low-effort patterns (elevated) — Advisory only — review the noted patterns; this AI assist never blocks the gate.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (size label size:XS; no linked issue context).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 147 registered-repo PR(s), 76 merged, 11 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	bohdansolovie; Gittensor profile; 147 PR(s), 11 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: bohdansolovie
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 147 PR(s), 11 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Explain no-issue PR.
• Await review-lane availability.
• Triage stale or unlinked PRs.
• Refresh registry data or choose a registered active repo.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[JSONbored]

Closing:

the test diff deletes several existing regression cases that covered line attribution, quoted `uses` syntax, `.yaml` workflow files, unchanged lines, missing patches, and positive findings through `scanActionPins`. The regex change itself is safe enough, but the test rewrite weakens coverage around behavior this analyzer still owns.