[chaksaray]

Closes #60

What and why

INT-2. The README told people to use bawbel/integrations@v1 and actions/checkout@v4, a mutable tag, which is the practice this project's own scanner would flag.

• RELEASING.md: what v1 and vX.Y.Z mean, when v1 may move and when it may not, how consumers pin, and the release steps (tag, test, move v1, update the pins).
• README, examples/basic.yml, examples/sarif.yml: actions/checkout, bawbel/integrations (v1.1.0) and upload-sarif are pinned by commit SHA with the release in a trailing comment. The SHAs for checkout and upload-sarif are copied from workflows already pinned in this repo and in bawbel/scanner; I did not re-check them against the upstream tags.
• scripts/check_pins.py, tests/test_check_pins.py (25 tests) and .github/workflows/pins.yml: fail any uses: or rev: that is not a 40-character SHA with a release comment, and compare this repo's own SHAs with the tag the comment names. It follows the rule that a number or pin in docs is checked by a script, not trusted.
• .github/workflows/action-smoke.yml keeps its deliberate @v1 and now carries # pin-exempt: .... Every other workflow was already pinned by SHA.
• PR template: the checklist line now asks for SHA pins instead of @v1.

I asked and was told to pin the examples to v1.1.0 now.

Action inputs and outputs

action.yml is unchanged.
Inputs added: none
Inputs renamed or removed: none
Outputs added: none
Outputs renamed or removed: none

Things you need to know (found while doing this)

1. v1 is older than the latest release. gh api repos/bawbel/integrations/commits/v1 --jq .sha gives d57f114... (2026-04-25); .../commits/v1.1.0 gives ee77de3... (2026-04-26). RELEASING.md says v1 points at the newest v1.x.y, which describes the intended state, not today's.
2. No tag contains the fail-closed fix. git merge-base --is-ancestor 4757cd8 <tag> says no for v1, v1.0.1 and v1.1.0. At v1.1.0 the scan step writes ${{ inputs.* }} straight into the shell and ends the scan with || echo "[]", so a scanner error reads as clean. So both @v1 and the pinned @v1.1.0 in the new examples run that older action until a release includes fix: fail closed when the scanner fails, and pass inputs through env #37.
3. The pre-commit hooks are in no release. .pre-commit-hooks.yaml was added on 2026-05-02 (feat: Pre commit hook #12), after v1.1.0. I reproduced the failure a user gets with rev: v1.1.0:

An error has occurred: InvalidManifestError:
=====> .../.pre-commit-hooks.yaml is not a file
exit=1

So the pre-commit examples cannot be SHA-pinned to a real release yet. They show rev: <release-commit-sha> # frozen: <release tag>, with a note saying no release contains the hooks. The checker lists those five placeholders so the release PR can fill them in.

Verify (run this session)

python3 -m unittest discover -s tests -p "test_check_pins.py"   -> Ran 25 tests ... OK
python3 scripts/check_pins.py                                    -> all references pinned (5 placeholder(s) to fill at release), exit 0
gh api repos/bawbel/integrations/commits/v1.1.0 --jq .sha        -> ee77de3c8fb927a41ca9d8d5f51be22215978d14

Mutation check on a copy of the tree. Each change makes check_pins.py report the right file and line:

README @ee77de3... back to @v1            -> not pinned README.md:52 ... not 'v1'
README SHA d57f114 with comment # v1.1.0   -> tag v1.1.0 is ee77de3..., not d57f114...
examples/basic.yml comment removed         -> add the release as a trailing comment
action-local.yml checkout back to @v4      -> pin to a 40-character commit SHA
action-smoke.yml pin-exempt removed        -> bawbel/integrations@v1 flagged
.pre-commit-hooks.yaml rev back to v1      -> flagged

Checks

• Docs and examples/ pin every action and rev by commit SHA (python scripts/check_pins.py); the pre-commit examples use the documented placeholder, see item 3
• README and examples/ match any changed action input or output (none changed)
• No em dashes in added lines
• Action smoke test passes on this PR (gh pr checks 61: 6 pass, 0 fail: pins, smoke, findings, and the three scanner fails closed jobs)

Not verified

• checkout and upload-sarif SHAs against the upstream tags (copied from repo files already in use).
• Dependabot rewriting SHA pins in examples/: it only reads .github/workflows, which is stated in RELEASING.md.
• pre-commit autoupdate --freeze output: my attempt to test it created a tag and was denied, so the docs do not mention it.

For the maintainer

• The tag policy and release steps are my proposal; edit them freely. The part that needs your judgment is item 4 of "Cutting a release": moving v1 with git tag -f and a forced push of the tag is a release action I cannot do and did not do.
• Conflicts to expect: feat: add a bawbel-gate manifest lint action and GitLab template #59 (gate-lint) adds a README section with actions/checkout@v4 and bawbel/integrations/gate-lint@v1. Once both are merged, Pins will fail on those two lines until they are changed (a pinned checkout, and <release-commit-sha> for gate-lint, which no release contains). I will update whichever PR lands second.

🤖 Generated with Claude Code

https://claude.ai/code/session_015T9K217kxBqsUZ3omKYv9P