fix(ci): three stale action pins, a closed-issue citation, and two guards to catch both recurring

[mrveiss]

Thinking Path

Ground-truthed all three issues against the current tree before touching anything, since the task warned the bodies might be stale:

• ci: three actions still target Node.js 20, and sixteen SHA-pinned actions cannot be checked at all #15332 — grepped every uses: in .github/workflows/*.yml and .github/actions/*/action.yml. The issue's table was accurate: exactly three stale tag pins (actions/cache@v4 × 2 in composite actions, actions/checkout@v4 in one workflow), all other tag-pinned actions already consistent. All 44 SHA-pinned occurrences already carry a # vX.Y.Z comment, so the "low-cost improvement" the issue asked for (comment convention + a guard that reads it) was already half-built — I only needed to add the guard.
• ci(code-quality): a required check has one step disabled by a missing secret and another citing a closed issue #15333 — confirmed #7105 is closed and cited 4× in code-quality.yml to justify live mypy suppressions. No open issue tracks the 1281+4133 backlog, so I filed one (tech-debt(ci): code-quality.yml attributes 4133+1281 pre-existing mypy errors to closed #7105 #15345) and repointed the citations at it. AC1 (CONVENTIONS_DENYLIST secret) is out of scope per the task and untouched.
• bug(ci): the integration-tests step targets a path missing the autobot- prefix, and a comment attributes the gap to a closed issue #15252 — read ci.yml around the cited line 358 and found the dead step had already been retired by c580893246 (PR test(ci): wire 17 uncollected infra/libs tests into CI and name the second edit in the concurrency guard (#15051, #15302) #15315, closing test(ci): 28 tests under autobot-infrastructure/shared/tests and libs/ run in no workflow, and ci.yml's integration step points at a path that does not exist #15051), with the #734 citation replaced by an accurate retirement record. The issue itself has a comment confirming 4 of 5 ACs met; AC5 (a general dead-path guard) is explicitly its own remaining scope, not part of this task. No code change needed here — verified only.
• Building the ci(code-quality): a required check has one step disabled by a missing secret and another citing a closed issue #15333 AC4 guard (closed-issue citation), I first tried "any #N mention that resolves to CLOSED" and it produced 234 false positives out of 293 resolvable references — most workflow comments cite closed issues historically ("fixed by", "RETIRED", "see #N for why"), not as live justification. Narrowed to the actual shared shape of both known defects: tracked (in|by|for|as) #N. That surfaced two more real instances (code-quality.yml:258 → closed discovery(slm/infra): 59 pre-existing datetime.utcnow().isoformat() / + Z sites in autobot-slm-backend, autobot-slm-agent, autobot-infrastructure #5263, ssot-coverage.yml:172 → closed tech-debt: three separate hardcoded-value detectors have drifted (pipeline-scripts, autobot-infrastructure, pre-commit hook) #14371) which need a domain judgment call outside this PR's scope, so I filed ci(workflows): two more comments cite closed issues as live justification (#5263, #14371) #15346 and exempted them explicitly (with the tracking issue recorded), rather than either silently ignoring them or guessing at a fix.

What Changed

File	Change
.github/actions/setup-python-suite/action.yml:155	actions/cache@v4 → @v6
.github/actions/setup-python-ci/action.yml:176	actions/cache@v4 → @v6
.github/workflows/auto-merge-base-into-parked-branches.yml:79	actions/checkout@v4 → @v7
.github/workflows/code-quality.yml:500,503,511,516	GH#7105 → GH#15345 (new issue tracking the actual mypy backlog; #7105 tracked wiring mypy in, not the errors it found)
repo_tests/workflow_action_version_regression_test.py (new)	#15332 AC4: fails when a tag-pinned action drifts below the version standard elsewhere in the repo; fails when a SHA-pinned action lacks a readable # vX.Y.Z comment. Deliberately does not cross-check SHA-pinned versions against each other — docker/login-action, docker/build-push-action, and sigstore/cosign-installer are genuinely pinned to different releases in different workflows today, pre-dating this change, and resolving that is out of scope.
repo_tests/workflow_closed_reference_guard_test.py (new)	#15333 AC4: fails when a tracked ... #N citation resolves (via gh api graphql, batched) to a closed issue/PR. Skips visibly via pytest.skip when gh is unavailable or unauthenticated. Vacuity floor of 3 distinct citations. Carries a two-entry, reasoned exemption for the newly discovered #5263/#14371 citations, pointing at #15346.

New issues filed: #15345 (mypy suppression backlog, replaces #7105 as the citation target), #15346 (two more closed-citation instances found while building the guard, out of this PR's scope to fix).

Verification

• python3 -m pytest repo_tests/ -q -k "workflow or action_version or closed_reference or ci_" → 315 passed
• workflow_closed_reference_guard_test.py run twice: once with gh on PATH (resolves live, both tests pass, zero violations after the two documented exemptions), once with gh removed from PATH (main test SKIPPED with a visible reason, vacuity-floor test still passes independently)
• black --check, isort --check-only, flake8 clean on both new files; both files well under the 30-line function cap (largest is 27 lines) and the 600-line file-size ceiling
• All workflow/composite-action YAML re-parses cleanly with yaml.safe_load after the edits
• git push succeeded through the local pre-push pytest gate (ran exactly these two new test files)
• Confirmed via gh issue view that ci: mypy is installed but never invoked — silent-tuple bug from #7078 would have been caught #7105, discovery(slm/infra): 59 pre-existing datetime.utcnow().isoformat() / + Z sites in autobot-slm-backend, autobot-slm-agent, autobot-infrastructure #5263, tech-debt: three separate hardcoded-value detectors have drifted (pipeline-scripts, autobot-infrastructure, pre-commit hook) #14371 are CLOSED and security(deps): chromadb 1.5.9 carries 4 known advisories — the entire Python dependency backlog #15052, bug(test): the backend conftest Redis stand-in blocks every integration test from the real Redis the marker suite provides #14932, ci: a merge to Dev_new_gui can land with no required context on the head it merges #15107 are OPEN, matching the guard's live resolution

What the issues claimed that turned out false / already resolved

• bug(ci): the integration-tests step targets a path missing the autobot- prefix, and a comment attributes the gap to a closed issue #15252's AC1-3 were already fully met by a prior merged PR (test(ci): wire 17 uncollected infra/libs tests into CI and name the second edit in the concurrency guard (#15051, #15302) #15315) before this task started — the issue's own comment thread documents this, but the issue itself is still open pending its unrelated AC5 (a general dead-path guard, explicitly out of this task's scope).
• ci: three actions still target Node.js 20, and sixteen SHA-pinned actions cannot be checked at all #15332's "sixteen SHA-pinned actions cannot be version-checked" claim undersold the current state: all 44 SHA-pinned call sites already carry a version comment, so the guard only needed to make that an enforced invariant rather than establish it from scratch.

Model Used

Claude Sonnet 5 (model ID: claude-sonnet-5)

Refs #15332 — the three named Node-20 pins are fixed and the SHA-comment invariant is now enforced, but cross-checking SHA-pinned versions against each other is deliberately out of scope (three actions are pinned to genuinely different releases today; picking a canonical one needs an owner decision). Also Refs #15333, #15252.

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No new hardcoded values of either class — ssot and other both block.

Known backlog in pipeline-scripts/hardcoded_values_baseline.txt is suppressed and tracked in #14371.

[mrveiss]

Review pass — no blocking defects. Two non-blocking findings fixed on the branch (c3de8c3578), and the one open risk closed with evidence.

1. test_no_tag_pinned_action_is_older_than_the_repo_standard was unfalsifiable. The repo has zero tag drift today, so with one version per action version < best is never true — an inverted operator would have passed identically. The comparison is now extracted into _version_regressions() and pinned by planted data (a v4 beside a v6, same-version pairs, different actions not being each other's standard, and minor/patch participating). Proven by mutation rather than asserted:

inverted  to   ->  1 failed, 3 passed
restored               ->  4 passed

2. The >= 100 floor did not protect the coverage the guard was built for. .github/workflows/*.yml alone yields ~195 pins, so dropping the ACTIONS_DIR glob from _workflow_files() would have kept the floor green while silently removing composite actions — where two of the three drifted pins that motivated #15332 actually lived. Now asserted separately.

3. Open risk closed: actions/cache@v6 on self-hosted runners. The concern was real — that bump is gated on runner.environment == 'self-hosted', self-hosted runner binaries do not auto-update, and a Node-runtime mismatch fails the job outright rather than warning. Nothing in the repo tracks the runner version, so it could not be settled from the source. It is settled empirically instead:

code-quality on 9e28baa631 -> completed success
code-quality.yml:124  runs-on: [self-hosted, Linux, X64]
code-quality.yml:187  uses: ./.github/actions/setup-python-ci   # where cache@v6 lives

Both registered runners carry self-hosted,Linux,X64 and are online, so the bumped action has already executed on the real hardware and passed. Not inferred from the runner version — observed from the job that uses it.

Also confirmed and left alone: the SHA-comment cross-check correctly excludes SHA pins from the version comparison, and DELIBERATELY_EXEMPT keying fails loudly on a file rename rather than silently passing — the safe direction.