@codyswann/lisa 4.35.4 → 4.36.0

package/dist/core/third-party-action-pins.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Finding and rewriting mutable third-party `uses:` refs in a workflow file.
+ *
+ * Pure text in, pure text out — no filesystem, no network, no policy. The
+ * migration that owns those concerns is
+ * `migrations/ensure-third-party-action-pins`; everything here is the part that
+ * can be tested against a string.
+ *
+ * **Why a consumer needs this at all.** #3585 pinned every third-party action
+ * in this repository and in the `create-only` workflow templates. A
+ * `create-only` file is written once, at repository creation, and is never
+ * overwritten on a later run — that is the contract and it is correct. So the
+ * template correction changed what FUTURE repositories are seeded with and
+ * changed nothing about any repository seeded before it. Every already-seeded
+ * consumer still resolves those actions through a branch or a floating tag at
+ * job start, including the ones whose entire function is to place repository
+ * secrets into the job environment (#3588).
+ *
+ * **Why the rewrite is line-scoped rather than file-scoped.** A seeded workflow
+ * belongs to the host, who may have edited it. Replacing the file would be an
+ * overwrite of somebody else's work; replacing only the matched `uses:` refs
+ * leaves every other edit intact, which is what lets this run against a
+ * diverged file at all.
+ * @module core/third-party-action-pins
+ */
+/**
+ * One `uses:` line carrying a mutable third-party ref.
+ */
+export interface UnpinnedRef {
+    /** Zero-based line index within the source. */
+    readonly line: number;
+    /** Owner segment, e.g. `noliran`. */
+    readonly owner: string;
+    /** Repository segment, e.g. `branch-based-secrets`. */
+    readonly repo: string;
+    /** Full action path as written, e.g. `snyk/actions/node`. */
+    readonly action: string;
+    /** The mutable ref as written, e.g. `v1` or `master`. */
+    readonly ref: string;
+}
+/** A resolved pin: the SHA a ref pointed at, for one action path. */
+export interface ResolvedPin {
+    readonly action: string;
+    readonly ref: string;
+    readonly sha: string;
+}
+/**
+ * Find every mutable third-party `uses:` ref in one workflow source.
+ *
+ * A ref that is already a 40-character SHA is not returned even when it carries
+ * no version comment. That is a real finding for the detector, which reports
+ * it, but it is not something this migration can repair: recovering the
+ * human-readable version behind an existing pin needs a judgement the migration
+ * cannot make, and rewriting the pin would risk moving it.
+ * @param source - Workflow file contents
+ * @returns Every unpinned third-party reference, in file order
+ */
+export declare function findUnpinnedRefs(source: string): readonly UnpinnedRef[];
+/**
+ * Rewrite the matched refs to their resolved SHAs.
+ *
+ * The original ref becomes the trailing comment, so the line still says what is
+ * installed. A pin without that is immutable but unreadable: nobody can tell
+ * what it carries, so nobody upgrades it, so it rots at whatever commit it was
+ * frozen at — the same reason #3585's own gate treats a bare SHA as a finding.
+ *
+ * Any pre-existing trailing comment on the line is replaced rather than
+ * appended to, because it described the ref that is being pinned away.
+ * @param source - Workflow file contents
+ * @param pins - Resolutions to apply, keyed by action path and ref
+ * @returns The rewritten source, or the original when nothing matched
+ */
+export declare function applyPins(source: string, pins: readonly ResolvedPin[]): string;
+/**
+ * Collapse findings to the distinct `action@ref` pairs that need resolving.
+ *
+ * One workflow can reference the same action five times — the seeded NestJS
+ * deploy workflow references `noliran/branch-based-secrets@v1` exactly that
+ * often — and each must resolve to the same SHA, so they are resolved once.
+ * @param refs - Findings from one or more files
+ * @returns Distinct references, in first-seen order
+ */
+export declare function distinctRefs(refs: readonly UnpinnedRef[]): readonly UnpinnedRef[];
+//# sourceMappingURL=third-party-action-pins.d.ts.map

package/dist/core/third-party-action-pins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"third-party-action-pins.d.ts","sourceRoot":"","sources":["../../src/core/third-party-action-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAyBH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAsDD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,WAAW,EAAE,CASvE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,WAAW,EAAE,GAC3B,MAAM,CAmBR;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,SAAS,WAAW,EAAE,GAC3B,SAAS,WAAW,EAAE,CAKxB"}

package/dist/core/third-party-action-pins.js

@@ -0,0 +1,153 @@
+/**
+ * Finding and rewriting mutable third-party `uses:` refs in a workflow file.
+ *
+ * Pure text in, pure text out — no filesystem, no network, no policy. The
+ * migration that owns those concerns is
+ * `migrations/ensure-third-party-action-pins`; everything here is the part that
+ * can be tested against a string.
+ *
+ * **Why a consumer needs this at all.** #3585 pinned every third-party action
+ * in this repository and in the `create-only` workflow templates. A
+ * `create-only` file is written once, at repository creation, and is never
+ * overwritten on a later run — that is the contract and it is correct. So the
+ * template correction changed what FUTURE repositories are seeded with and
+ * changed nothing about any repository seeded before it. Every already-seeded
+ * consumer still resolves those actions through a branch or a floating tag at
+ * job start, including the ones whose entire function is to place repository
+ * secrets into the job environment (#3588).
+ *
+ * **Why the rewrite is line-scoped rather than file-scoped.** A seeded workflow
+ * belongs to the host, who may have edited it. Replacing the file would be an
+ * overwrite of somebody else's work; replacing only the matched `uses:` refs
+ * leaves every other edit intact, which is what lets this run against a
+ * diverged file at all.
+ * @module core/third-party-action-pins
+ */
+/**
+ * The owner of Lisa's own reusable workflows.
+ *
+ * A first-party `uses:` is a different threat model — a stability question
+ * about an upstream we own and can read (#3488) — and pinning it here would
+ * freeze consumers at whatever Lisa release happened to be current, which is
+ * the opposite of what those refs are for. Compared case-insensitively because
+ * GitHub owners are.
+ */
+const FIRST_PARTY_OWNERS = ["codyswanngt"];
+/**
+ * GitHub's own action namespaces.
+ *
+ * These are published by the same party that runs the job, so pinning them
+ * moves no trust boundary. The exemption is an OWNER allowlist, never a
+ * substring match, so `actions-rs/toolchain` is still third-party.
+ */
+const GITHUB_OWNED_OWNERS = ["actions", "github"];
+/** A ref that is already an immutable full commit SHA. */
+const PINNED_REF = /^[0-9a-f]{40}$/;
+/**
+ * `uses:` lines, with or without the list dash.
+ *
+ * The value is captured as one run of non-space, non-comment characters and
+ * split afterwards rather than being described in the pattern. Spelling the
+ * `owner/repo/path@ref` shape as adjacent character classes gives the engine
+ * two ways to divide the same text, which is super-linear on a long line; one
+ * greedy run has only one.
+ */
+const USES_LINE = /^(?<lead>\s*(?:-\s+)?uses:\s*)(?<slug>[^\s#]+)/;
+/**
+ * Split a `uses:` value into its action path and ref.
+ *
+ * The ref is taken from the LAST `@`, because an action path may not contain
+ * one but a ref legitimately can.
+ * @param slug - The raw value of a `uses:` line
+ * @returns The parsed parts, or null when this is not an owner/repo reference
+ */
+function parseSlug(slug) {
+    const at = slug.lastIndexOf("@");
+    if (at <= 0) {
+        return null;
+    }
+    const action = slug.slice(0, at);
+    const [owner, repo] = action.split("/");
+    if (owner === undefined || repo === undefined || repo === "") {
+        return null;
+    }
+    return { owner, repo, action, ref: slug.slice(at + 1) };
+}
+/**
+ * Whether an owner is exempt from pinning.
+ * @param owner - The owner segment of a `uses:` path
+ * @returns True for first-party and GitHub-owned actions
+ */
+function isExemptOwner(owner) {
+    const lower = owner.toLowerCase();
+    return (FIRST_PARTY_OWNERS.includes(lower) || GITHUB_OWNED_OWNERS.includes(lower));
+}
+/**
+ * Find every mutable third-party `uses:` ref in one workflow source.
+ *
+ * A ref that is already a 40-character SHA is not returned even when it carries
+ * no version comment. That is a real finding for the detector, which reports
+ * it, but it is not something this migration can repair: recovering the
+ * human-readable version behind an existing pin needs a judgement the migration
+ * cannot make, and rewriting the pin would risk moving it.
+ * @param source - Workflow file contents
+ * @returns Every unpinned third-party reference, in file order
+ */
+export function findUnpinnedRefs(source) {
+    return source.split("\n").flatMap((text, line) => {
+        const slug = USES_LINE.exec(text)?.groups?.slug;
+        const parsed = slug === undefined ? null : parseSlug(slug);
+        if (parsed === null || isExemptOwner(parsed.owner)) {
+            return [];
+        }
+        return PINNED_REF.test(parsed.ref) ? [] : [{ line, ...parsed }];
+    });
+}
+/**
+ * Rewrite the matched refs to their resolved SHAs.
+ *
+ * The original ref becomes the trailing comment, so the line still says what is
+ * installed. A pin without that is immutable but unreadable: nobody can tell
+ * what it carries, so nobody upgrades it, so it rots at whatever commit it was
+ * frozen at — the same reason #3585's own gate treats a bare SHA as a finding.
+ *
+ * Any pre-existing trailing comment on the line is replaced rather than
+ * appended to, because it described the ref that is being pinned away.
+ * @param source - Workflow file contents
+ * @param pins - Resolutions to apply, keyed by action path and ref
+ * @returns The rewritten source, or the original when nothing matched
+ */
+export function applyPins(source, pins) {
+    if (pins.length === 0) {
+        return source;
+    }
+    const bySlug = new Map(pins.map(pin => [`${pin.action}@${pin.ref}`, pin]));
+    return source
+        .split("\n")
+        .map(text => {
+        const groups = USES_LINE.exec(text)?.groups;
+        const slug = groups?.slug;
+        if (slug === undefined) {
+            return text;
+        }
+        const pin = bySlug.get(slug);
+        return pin === undefined
+            ? text
+            : `${groups?.lead}${pin.action}@${pin.sha} # ${pin.ref}`;
+    })
+        .join("\n");
+}
+/**
+ * Collapse findings to the distinct `action@ref` pairs that need resolving.
+ *
+ * One workflow can reference the same action five times — the seeded NestJS
+ * deploy workflow references `noliran/branch-based-secrets@v1` exactly that
+ * often — and each must resolve to the same SHA, so they are resolved once.
+ * @param refs - Findings from one or more files
+ * @returns Distinct references, in first-seen order
+ */
+export function distinctRefs(refs) {
+    const slugs = refs.map(ref => `${ref.action}@${ref.ref}`);
+    return refs.filter((_ref, index) => slugs.indexOf(slugs[index] ?? "") === index);
+}
+//# sourceMappingURL=third-party-action-pins.js.map

package/dist/core/third-party-action-pins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"third-party-action-pins.js","sourceRoot":"","sources":["../../src/core/third-party-action-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,CAAC,aAAa,CAAC,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAElD,0DAA0D;AAC1D,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAyBpC;;;;;;;;GAQG;AACH,MAAM,SAAS,GAAG,gDAAgD,CAAC;AAUnE;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,CACL,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,MAAM,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,SAAS,CACvB,MAAc,EACd,IAA4B;IAE5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,IAAI,CAAC,EAAE;QACV,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;QAC1B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,GAAG,KAAK,SAAS;YACtB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,GAAG,MAAM,EAAE,IAAc,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;IACvE,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,IAA4B;IAE5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,MAAM,CAChB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,CAC7D,CAAC;AACJ,CAAC"}

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwhFpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAorQjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0hFpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA2rQjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -8,9 +8,10 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "all/copy-overwrite/scripts/check-orphaned-branches.mjs": "b2a63c522fdc99dd7b89707fd734da9d1cb534bc9a505589c503f2576ac3e39b",
     "all/copy-overwrite/scripts/check-release-package-identity.mjs": "a0f17592d4436de4c240f7c78512537581aa2ed5e89f0caf1fe890694163a873",
     "all/copy-overwrite/scripts/check-state-classification.mjs": "a72910f9885629dd6d8a739b900f5603e4b53d68ece64100a2a5647016b58e1e",
+    "all/copy-overwrite/scripts/check-third-party-action-pins.mjs": "79117b039e0d7df001e60835ad3538126ba88273bc5fa3c1d30d8e8e704e77cc",
     "all/copy-overwrite/scripts/check-third-party-review-evidence.mjs": "95f91f2a74ed4e523d064d5d374eadd1c1114f03a3a4fa41532c9b0fd32089de",
     "all/copy-overwrite/scripts/lib/bounded-spawn.mjs": "72e277ada531914d7bc51c3cb8dc67b8881aa817d96fa2f9f4d81668a3d3bbc1",
-    "all/copy-overwrite/scripts/lib/gate-failure-diagnosis.mjs": "bc135e1c130844a2e5daf769104e78a42fd804de06ae79b7b50bf357b3d76795",
+    "all/copy-overwrite/scripts/lib/gate-failure-diagnosis.mjs": "b93880769e7ac402879200ce80a32095baa38d1fbc47cf17804bd6df49ce3b8a",
     "all/copy-overwrite/scripts/lib/invoked-as-script.mjs": "fbb9b88fc85a3e22f21af39e1c17acf67ff83fc6b5a6cdc8081bde333c48faa7",
     "all/copy-overwrite/scripts/lib/kill-marks.mjs": "13388da7203b02ba84a845abd7885074bc8a495e215437a97122060d69367030",
     "all/copy-overwrite/scripts/lib/placeholder-expiry.mjs": "101e8e230618aa817c88534c3b22d069afa5d30fc8e742a681af2f5edff6f1af",
@@ -482,7 +483,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/reference/leaf-only-lifecycle.md": "08e95253161bbc2b670407a78a6c33731d4860e2ed46bac195f24e1a80b68a0f",
     "plugins/src/base/rules/reference/learnings-ladder.md": "4b6760e8ec58dea0e646cfa1b0518f468cc959ef3be55e3f87c225ec076f53c7",
     "plugins/src/base/rules/reference/local-ci-first.md": "4db796a9e159d25e5edd0d8d8d713b6556a3024a96e3882a50e19928b0e81a18",
-    "plugins/src/base/rules/reference/measurement-integrity.md": "d43e528599c3399d938bbd85b8dc8df72dbbe100ad395a93655f3b263d683bf4",
+    "plugins/src/base/rules/reference/measurement-integrity.md": "f628573c591e2cbbbbedd22821d40a3687dc14dba3aba5aebdc75c37ebd62494",
     "plugins/src/base/rules/reference/not-blocked-just-waiting.md": "bef69d0cefa92e2b8ca589bb27f8e92749140e662d54110e12f0a47890e69f14",
     "plugins/src/base/rules/reference/observability-audit.md": "98cf4c849baf0801bd2c46a90e7a072196649d506fbda577cc5c4019d2194551",
     "plugins/src/base/rules/reference/prd-definition-of-ready.md": "041a8f3c9b703b3921acc30fe92acfb9e2ab43da04cf019c102ebca98b2f4ba3",
@@ -612,7 +613,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-jira-validate-ticket/SKILL.md": "02ab79176b95dd3eaba2b4295edb11ad874ea83d513073ff17238859b4e68f1d",
     "plugins/src/base/skills/lisa-jira-verify/SKILL.md": "4e48dcd9e1144837890359e75cc405280bf5f52cf497e44f294b608ad681580c",
     "plugins/src/base/skills/lisa-jira-write-ticket/SKILL.md": "5352b209c42c8263b0ecdd1826116a244d3eba70c861592b8d4df6bf13a0b5bf",
-    "plugins/src/base/skills/lisa-jsdoc-best-practices/SKILL.md": "7cf0729966ac0afcab6e2c043f192772a9e9e7c72fae61e55b300e97308f970e",
+    "plugins/src/base/skills/lisa-jsdoc-best-practices/SKILL.md": "c70ebb143c511cd09c789611bf5dbd636d769c462de000dd694c53f8fcf6f444",
     "plugins/src/base/skills/lisa-kane-browser/SKILL.md": "e082517cb42f437eeb22b3935aa0fef09299874736e55184e88d2b64f7860a7d",
     "plugins/src/base/skills/lisa-learnings-audit/SKILL.md": "73624a3f94954c414c000d734a52a45528674afbeb43936ec746ea7591e10760",
     "plugins/src/base/skills/lisa-linear-access/SKILL.md": "2f25e54f3f91a8b3b4c0cdb7dc53f0314a20bb78e2fe102edd93fc4380cefbe0",
@@ -1129,7 +1130,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/check-shell-guard-refusal-coverage.mjs": "d6b056c4311ea612e85d16ae565a57c5e10c822e87e21d689e12a6cc89dfda3f",
     "scripts/check-state-classification.mjs": "26baaa85c0758fa41f1f66257f7d3a31ea4dd5cf17a9c0acaa3e89caaaf6265a",
     "scripts/check-template-workflow-refs.mjs": "89176394a933d0a42c39ab1805a45e782a2f3e1893d707ac1afb439062397088",
-    "scripts/check-third-party-action-pins.mjs": "b578c55d2d8d63243de502e332f2dd2e0ae2a670c6ed18c418c67abb96c8b8fd",
+    "scripts/check-third-party-action-pins.mjs": "f61b310333d4734225482906708bba90582882b5312ba39701a43cf6960706db",
     "scripts/check-ui-demo-data.mjs": "82a5ed89ae830482dbaab99e2f8eeededcde60a7dd6ac145f191b4ac8394c85b",
     "scripts/check-whole-output-guards.mjs": "bb3c959fe67a6f481a9b8442a5a9a51a49599b4efd8fbefe3329fdf5c96b9c02",
     "scripts/check-workflow-package-paths.mjs": "d057c7666ad048cfbd11a1ef83ad1e13fb1c61a9d399ec83221c99c4256728a1",
@@ -1204,7 +1205,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/remote-agent-aws-setup.sh": "f181062436c214c95fe15be8000cce18de0b553b3dab06b822a4fe55cb285ca6",
     "scripts/setup-deploy-key.sh": "2bed19346810b7af18a5225fd463c4d553a7bcc7b2f11a21bd47b93e6b5e1719",
     "scripts/test-intent-routing.sh": "97b9dc86cbd805df8a7fdb8c99ffab9b8c5e751ba2e84c05420b2a124f80635d",
-    "scripts/two-channel-couplings.json": "c080b1fe059632a5dfbc3039d1c28b71474b3eb0a544246598993f2d80435562",
+    "scripts/two-channel-couplings.json": "5021ab4e53a83f59aed05c428a1189712fb6897da7ed801ec95513dfe0afbdae",
     "scripts/update-node-version.ts": "dcfec9f8666f65925deb9efdc8a4bebb6c3f41d9fa1c1365be23edb82c40fffa",
     "scripts/update-test-skill-paths.mjs": "e26a3ac716c33013e22bf5223a58457452f5af2038218a0e3a51c244eab5ddc9",
     "scripts/verify-health-agentic-built.mjs": "4b0d20b2c94390ff6f5af881fc50c5c225215a282891db0b3e3d84a7e6455367",
@@ -1232,7 +1233,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "typescript/copy-overwrite/.github/GITHUB_ACTIONS.md": "3f5d8e7f5f2c8ec1d369359f2ee64c033736df4bc172d06da1b4be5ee65b173b",
     "typescript/copy-overwrite/.lintstagedrc.json": "60bf2d5e86bf9d72f04b8b14368591f104674ff80046fe8bd82e4174ca1523fd",
     "typescript/copy-overwrite/.nvmrc": "0775c6feb7638122e8b68d611cd709bf270f7b5adb5d0d2baa9afab8a6c0fc42",
-    "typescript/copy-overwrite/.prettierignore": "92687bc0086590a813817a0a243f36deeab789ea30a9e94258c49b7b1a97bf1a",
+    "typescript/copy-overwrite/.prettierignore": "2c665c73e141e29f455f27674e071dcda240f432a07fff3d2781ab617ef562b9",
     "typescript/copy-overwrite/.prettierrc.json": "a20621f79a064486fba53cc0ea3000a2ece3f312ff38495c6a6606a27d2a727c",
     "typescript/copy-overwrite/.versionrc": "96d51e3087892bb795788dbd0ca3e5ebe7b67252e58adae5bbc469eaf424af35",
     "typescript/copy-overwrite/.yamllint": "685de50b905e024ac8882cdf6443850e96a44744ac03366cae636ceb384dd4e0",
@@ -1289,7 +1290,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "typescript/github-rulesets/quality-checks.json": "3aa1c6dbc703ad2ecd87c6f7fdff1aae118696dba95c9795c2c954c6b8a444d9",
     "typescript/merge/.claude/settings.json": "a455fb55d5bf99f7f71136a3a4f8f21b283b9627556c3b22d039b01d093eb2a9",
     "typescript/merge/.oxlintrc.json": "9504c20db80470c242c4ffe8cccad6951ed8141dfb5bf6503053e0b2712ab276",
-    "typescript/package-lisa/package.lisa.json": "4804b20a50d9c66154643c73bcb84655c36e9dc8f2a514d22990adba1c0ce947",
+    "typescript/package-lisa/package.lisa.json": "cc58815ec5cd6b7df3ab401fb3ff7b9b154f0aedb09857395273e7c1df7313a6",
     "ui/README.md": "9c4aa65ff4028eedfda1f284d47b620fff7353c07fd8084ccc427fe4c5a1ed72",
     "ui/index.html": "9e1a68cd70fe6e74bc615e9f012e5837fa9ad0d828202f998e8cf97551931906",
 });
@@ -1439,6 +1440,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "all/copy-overwrite/scripts/check-orphaned-branches.mjs": true,
     "all/copy-overwrite/scripts/check-release-package-identity.mjs": true,
     "all/copy-overwrite/scripts/check-state-classification.mjs": true,
+    "all/copy-overwrite/scripts/check-third-party-action-pins.mjs": true,
     "all/copy-overwrite/scripts/check-third-party-review-evidence.mjs": true,
     "all/copy-overwrite/scripts/lib/bounded-spawn.mjs": true,
     "all/copy-overwrite/scripts/lib/gate-failure-diagnosis.mjs": true,
@@ -7700,6 +7702,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/core/self-apply.ts": true,
     "src/core/sonar-integration.ts": true,
     "src/core/template-ownership.ts": true,
+    "src/core/third-party-action-pins.ts": true,
     "src/core/two-channel-delivery-scan.ts": true,
     "src/core/two-channel-delivery.ts": true,
     "src/core/upstream-attribution-body.ts": true,
@@ -7757,6 +7760,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/migrations/ensure-quality-caller-scopes.ts": true,
     "src/migrations/ensure-seeded-gates.ts": true,
     "src/migrations/ensure-sonar-excludes-lisa-harness.ts": true,
+    "src/migrations/ensure-third-party-action-pins.ts": true,
     "src/migrations/ensure-tsconfig-local-files-fallback.ts": true,
     "src/migrations/ensure-tsconfig-local-includes.ts": true,
     "src/migrations/ensure-wiki-source-declared.ts": true,
@@ -8535,6 +8539,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/core/skill-frontmatter-contract.test.ts": true,
     "tests/unit/core/skip-git-check-decoupling.test.ts": true,
     "tests/unit/core/sonar-integration.test.ts": true,
+    "tests/unit/core/third-party-action-pins.test.ts": true,
     "tests/unit/core/two-channel-delivery-scan.test.ts": true,
     "tests/unit/core/two-channel-delivery.test.ts": true,
     "tests/unit/core/update-skill-apply-mode.test.ts": true,
@@ -8678,6 +8683,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/migrations/ensure-quality-caller-scopes.test.ts": true,
     "tests/unit/migrations/ensure-seeded-gates.test.ts": true,
     "tests/unit/migrations/ensure-sonar-excludes-lisa-harness.test.ts": true,
+    "tests/unit/migrations/ensure-third-party-action-pins.test.ts": true,
     "tests/unit/migrations/ensure-tsconfig-local-files-fallback.test.ts": true,
     "tests/unit/migrations/ensure-tsconfig-local-includes.test.ts": true,
     "tests/unit/migrations/ensure-wiki-source-declared.test.ts": true,
@@ -8768,6 +8774,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/scripts/e2e-coverage-run-awareness.test.ts": true,
     "tests/unit/scripts/e2e-coverage.test.ts": true,
     "tests/unit/scripts/floor-collisions.test.ts": true,
+    "tests/unit/scripts/gate-diagnosis-comment-terminated.test.ts": true,
     "tests/unit/scripts/gate-diagnosis-no-tests-ran.test.ts": true,
     "tests/unit/scripts/gate-failure-diagnosis.test.ts": true,
     "tests/unit/scripts/gate-killed-under-load.test.ts": true,
@@ -8912,6 +8919,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/scripts/skipped-required-checks.test.ts": true,
     "tests/unit/scripts/slow-lint-dead-code-enforcement.test.ts": true,
     "tests/unit/scripts/state-classification.test.ts": true,
+    "tests/unit/scripts/third-party-action-pins-warn-mode.test.ts": true,
     "tests/unit/scripts/third-party-review-evidence.test.ts": true,
     "tests/unit/scripts/threshold-ratchet-baseline.test.ts": true,
     "tests/unit/scripts/threshold-ratchet-gates.test.ts": true,