ci: re-pin internal action refs to v1.5.0 (A-618)

[RobEasthope]

Summary

• Bumps 12 internal composite-action pins onto @ba77002 # v1.5.0 — 11 off the backfill-era @7f543be # v0.8.0, plus one load-repo-config pin off its interim A-779 SHA.
• The v0.8.0 pin was an A-585 backfill artefact — the last tag before v1.0.0 was cut by hand, chosen to dodge a self-reference at release-cut time. Now that the repo ships v1.x, these internal pins should point at a current self-version rather than staying frozen on a pre-release SHA.
• No functional change: the referenced composite-action content is byte-identical between the old pins and v1.5.0 (verified by git tree-SHA comparison for every action). Consumers are unaffected — they still float the reusable workflows at @v1; only the internal action-to-action pins move.
• no release (ci-only) — .github/workflows/*.yml edits with no behaviour change; the PR title is intentionally ci: so release-please cuts no bump.

Files: reusable-lint.yml (5 pins), reusable-build-test.yml (6 pins), reusable-load-repo-config.yml (1 pin) — 12 in total.

Out of scope (separate follow-up, A-959): reusable-pkg-release.yml's setup-project/build @d0a5949 pins — those point at a pre-release snapshot whose content differs from v1.5.0, so bumping them is a real change needing verification, not this cosmetic pass.

Related Issues

• A-618

Test Plan

• CI GO / NO GO aggregator green (incl. actionlint + 📓 Changelog entry validation)
• Diff is exactly the 12 pin lines — no other edits

[coderabbitai]

📝 Walkthrough

Walkthrough

Reusable build, test, lint, and repository-configuration workflows now pin shared composite actions to the v1.5.0 commit. A changelog entry records the re-pinning and confirms callers remain on the reusable workflows’ @v1 reference.

Changes

Workflow action re-pinning

Layer / File(s)	Summary
Build and test action pins .github/workflows/reusable-build-test.yml	Build, typecheck, Vitest, ShellCheck, bats, and project setup steps use the v1.5.0 SHA while preserving existing gates and inputs.
Lint and repository configuration pins .github/workflows/reusable-lint.yml, .github/workflows/reusable-load-repo-config.yml, changelog/*	Lint and changelog validation steps, repository configuration loading, and the release note reference the v1.5.0 pin update.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• acme-skunkworks/shared-workflows#6: Introduced the reusable lint workflow whose action references are re-pinned here.
• acme-skunkworks/shared-workflows#7: Introduced the reusable build/test workflow updated by this change.
• acme-skunkworks/shared-workflows#19: Previously standardised the reusable lint workflow pins to the v0.8.0 SHA.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: re-pinning internal action references to v1.5.0.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch a-618-shared-workflows-forward-release-automation-re-pin-internals

---

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

Claude finished @RobEasthope's task in 1m 23s —— View job

---

Code Review — PR #75

• Gather context and read changed files
• Review workflow pin changes
• Review changelog entry
• Post findings

---

Verdict: LGTM — clean, mechanical, low-risk. All 12 pin changes are consistent and the scope is correctly bounded.

Workflow pins (reusable-build-test.yml, reusable-lint.yml, reusable-load-repo-config.yml)

All 12 changed lines swap identically to @ba77002fe9249ec379930861ed693e1b6ac3bf37 # v1.5.0. Counts match what the diff claims:

File	Actions re-pinned
reusable-build-test.yml	6 (setup-project, build, typecheck, test-vitest, shellcheck, test-bats)
reusable-lint.yml	5 (setup-project, eslint, lint-markdown, lint-yaml, changelog-validate)
reusable-load-repo-config.yml	1 (load-repo-config)

The reusable-load-repo-config.yml pin moves from a bespoke interim SHA (ab96ef... # A-779) rather than v0.8.0 — the in-code comment update from # A-779 to # v1.5.0 correctly reflects that.

reusable-pkg-release.yml is correctly left alone; its @d0a5949 pins differ in content and are called out as a separate follow-up in the PR body.

Changelog entry

• category: chore, breaking: false, correct branch and issue (A-618) — all accurate.
• Body covers both the 11 v0.8.0-origin pins and the single load-repo-config A-779 pin in separate bullets, consistent with the diff.
• The closing paragraph ("No consumer-facing change…") accurately reflects the byte-identity claim.

Minor observation (no action needed)

The PR description phrases it as "12 internal composite-action pins (and one load-repo-config pin)" — implying 13 total — but the diff is 12 lines (11 from v0.8.0 + 1 from A-779). The code and changelog are correct; the body prose is just slightly ambiguous. Not worth a revision.

[RobEasthope]

triage-pr — review feedback summary

Acknowledging the issue-level review feedback (no resolvable thread per finding):

Finding	Outcome	Reference
PR body pin count read as 13 (should be 12: 11 v0.8.0 + 1 A-779)	Accepted	PR description clarified