[fp-enhancer] refactor(actionpins): precompile SHA regex and extract findCompatiblePin helper

[github-actions]

Round-Robin Progress

Package processed: pkg/actionpins (1st package — first run, no previous cache)
Next run will process: pkg/agentdrain

---

Summary

Two targeted functional/immutability improvements applied to pkg/actionpins/actionpins.go:

#	Category	Change	Files
1	Precompile regex	Move regexp.MustCompile to package level	actionpins.go
2	Pure function extraction	Extract findCompatiblePin helper, eliminate mutable flag	actionpins.go

Changes

1. Precompiled fullSHARegex

isValidFullSHA previously called regexp.MatchString(...) on every invocation, which recompiles the pattern each time. The pattern is now a package-level var compiled once at startup:

// Before
func isValidFullSHA(s string) bool {
    matched, err := regexp.MatchString(`^[0-9a-f]{40}$`, s)
    return err == nil && matched
}

// After
var fullSHARegex = regexp.MustCompile(`^[0-9a-f]{40}$`)

func isValidFullSHA(s string) bool {
    return fullSHARegex.MatchString(s)
}

Benefits: better performance (no repeated compilation), cleaner code, eliminates the ignored err return.

2. Extracted findCompatiblePin pure helper

The compatible-pin search loop used a mutable foundCompatible bool flag and a pre-declared var selectedPin ActionPin. This has been extracted into a named pure function:

// Before – mutable flag pattern
var selectedPin ActionPin
foundCompatible := false
for _, pin := range matchingPins {
    if semverutil.IsCompatible(pin.Version, version) {
        selectedPin = pin
        foundCompatible = true
        break
    }
}

// After – pure helper
selectedPin, foundCompatible := findCompatiblePin(matchingPins, version)

Benefits: eliminates mutable intermediate state, gives the operation a clear name, isolates the logic for independent testability.

---

Testing

• ✅ go build ./pkg/actionpins/ — clean
• ✅ go vet ./pkg/actionpins/ — no issues
• ✅ All TestActionPin* and TestGetActionPin* tests in pkg/workflow/ pass — no behavior change

Review Focus

• Confirm fullSHARegex placement and naming is idiomatic
• Confirm findCompatiblePin signature and doc comment are sufficient
• No other files changed

Generated by Functional Pragmatist · ● 1.3M · ◷

• expires on Apr 17, 2026, 10:01 AM UTC

[Copilot]

Pull request overview

Refactors pkg/actionpins to reduce per-call overhead in SHA validation and to simplify compatible-pin selection logic.

Changes:

• Precompiles the full SHA validation regex at package scope and reuses it in isValidFullSHA.
• Extracts compatible-pin selection into a small helper (findCompatiblePin) and removes the mutable flag pattern at the call site.

Show a summary per file

File	Description
pkg/actionpins/actionpins.go	Precompiles SHA regex and extracts findCompatiblePin helper for cleaner pin selection.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1

[Copilot]

The isValidFullSHA doc comment says “hexadecimal SHA”, but the regex only accepts lowercase ([0-9a-f]). Consider clarifying the comment to explicitly say “lowercase hex” (or broaden the regex to accept uppercase too) to avoid ambiguity for callers.

Suggested change

	// isValidFullSHA checks if a string is a valid 40-character hexadecimal SHA.
	// isValidFullSHA checks if a string is a valid 40-character lowercase hexadecimal SHA.