fix(enrichment): match workflow paths case-insensitively in actions-pin

[kiannidev]

Summary

• scanActionPins only scanned files matching a case-sensitive .github/workflows/*.ya?ml regex.
• Paths like .github/Workflows/CI.YML were skipped entirely, so mutable third-party uses: refs evaded detection.
• Normalize paths to lowercase (with backslash-to-slash) before matching, consistent with isConfigFile in path-matchers.ts and change-guardrail tests.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• review-enrichment build + node --test test/actions-pin.test.ts — 5/5 passing (includes mixed-case workflow path regression)
• npm run rees:test — full enrichment gate pending CI on fork PR

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. N/A.
• API/OpenAPI/MCP behavior is updated and tested where needed. Enrichment analyzer only.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• Distinct from open PR fix(enrichment): treat uppercase action SHA pins as pinned #2492 (uppercase SHA pin refs) — this fixes workflow path gating only.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-02 07:20:45 UTC}

2 files · 1 AI reviewer · no blockers · readiness 66/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
The change correctly moves workflow-file gating through a small helper that normalizes separators and lowercases paths before applying the existing workflow regex, so mixed-case workflow YAML paths now reach the existing `scanWorkflowPins` logic without changing finding attribution. The added regression test covers the case-insensitive path behavior and preserves the non-workflow exclusion path. With the provided full file and passing checks, the diff is narrow and coherent.

Nits — 5 non-blocking

• nit: `review-enrichment/test/actions-pin.test.ts:121` covers case-insensitive matching but not the new backslash normalization path introduced in `review-enrichment/src/analyzers/actions-pin.ts:12`.
• nit: `review-enrichment/src/analyzers/actions-pin.ts:11` keeps `WORKFLOW_PATH` as an uppercase constant even though callers should now use `isWorkflowPath`; this is fine locally, but exporting the helper or naming the regex as internal-only would reduce future direct-use drift if this matcher grows.
• Add one assertion or fixture in `review-enrichment/test/actions-pin.test.ts:121` for `.github\\workflows\\ci.yml` so the separator normalization behavior is pinned by a real test.
• Consider moving `isWorkflowPath` near the other path-matcher helpers if more analyzers need the same normalization convention, but keeping it local is acceptable for this focused change.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (size label size:XS; no linked issue context).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 2219 registered-repo PR(s), 1173 merged, 39 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	kiannidev; Gittensor profile; 2219 PR(s), 39 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: kiannidev
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 2219 PR(s), 39 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Explain no-issue PR.
• Await review-lane availability.
• Triage stale or unlinked PRs.
• Refresh registry data or choose a registered active repo.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review