Files
gstack/test
garrytanandcapy-ai[bot] 7bb277840b ci-audit: review fixes (weekly template fetch and pins, rate headroom, escaped names, fork runs)
- Template fetches GSTACK_REF with git fetch, so a full commit sha works as the
  comment says; actions are pinned to the SHAs gstack's own workflows use; the
  exit code reaches Publish through env and the report is no longer echoed to
  the log.
- The rate-limit preflight keeps a tenth of the hour's limit spare (at most
  500), so a GITHUB_TOKEN with a little of its hour spent still runs.
- Job, runner and workflow names are escaped in the report and issue body.
- ship-check drops runs whose head repository is not the PR's (fork branches
  that share a name).
- Docs say the /ship step lands in a follow-up PR; egress scanner exempts the
  template with its reason.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
2026-10-31 19:00:26 +00:00
..