uses_local_path can misclassify a workflow that mixes local actions with a remote blocking-review pin

[twistedmelonman]

Non-Blocking Review Concern: uses_local_path can misclassify a workflow that mixes local actions with a remote blocking-review pin

Source: pre-push whole-codebase review
Location: bulk-install-claude-review.sh:143-145
Date: 2026-04-30

What was flagged

uses_local_path matches any uses: ./... line in the file, but it's invoked on a file already known to reference claude-blocking-review.yml. If a single workflow has both a local action (uses: ./.github/actions/setup) and a remote reusable workflow pin (uses: smartwatermelon/.../claude-blocking-review.yml@v2.0.0), the file is wrongly classified as LOCAL and the stale pin is never bumped. Tighter pattern: anchor the ./ to the blocking-review filename specifically, e.g. grep -qE 'uses:[[:space:]]*\./[^[:space:]]*claude-blocking-review\.yml'. Low likelihood across the smartwatermelon fleet (caller workflows are typically standalone), but the misclassification fails silently — the script reports LOCAL, the operator skips it, and the stale pin lingers.

Context

This issue was automatically created from a non-blocking concern identified
during pre-push whole-codebase review. It was flagged for tracking.

---

Created by lib-review-issues.sh

[twistedmelonman]

Closing per fleet-wide issue triage. Verified this cosmetic tech-debt finding is still technically accurate in current code, but it's a low-value, non-blocking style/hardening nit in internal tooling scripts (not a bug, not planned future work, no user-facing impact — misclassification risk in bulk-install-claude-review.sh is real but low-likelihood per the issue's own analysis). Closing to declutter backlog; re-file if it causes an actual incident during future fleet rollouts.