Extend the dev-lead/pr-review channel-tag pinning standard (<name>/stable + immutable <name>/vX.Y.Z, cut via scripts/cut-release.sh) to every first-party reusable workflow in this repo, and make it a CI-enforced standard rather than per-workflow bespoke tests.
Why now: ci-failure-analyst-reusable.yml is pinned by three sites (.github/workflows/ci-failure-analyst.lock.yml, templates/ci-failure-analyst.yml, docs/aw/ci-failure-analyst.md) to an off-main SHA 0ef7b6150516c4fa447700b4902e8ed406bcfb99 annotated # main — a commit that lives only on the unmerged fix/action-sha-pinning branch. Consumers copying the template inherit an off-main pin. The pr-review agent flagged this on #520 (MEDIUM, needs-human).
Grounded scope (from grep workflow_call): the first-party same-repo reusables are ci-failure-analyst-reusable.yml (non-compliant — 3 SHA-# main pin sites), dev-lead-reusable.yml (compliant — @dev-lead/stable), pr-review.yml (compliant — @pr-review/stable), and actions-fleet-monitor.yml (self-scheduled, no external callers). Only ci-failure-analyst needs migration. Other-repo petry-projects/.github reusables (e.g. agent-shield, feature-ideation) are pinned SHA-# vN and follow a different (cross-repo SHA-to-version) rule — the inventory/compliance test must distinguish the two.
Deliverables: (1) generalize cut-release.sh to release non-agent reusables; (2) cut ci-failure-analyst/v1.0.0 + /stable and repin all three sites to the channel tag; (3) a generalized compliance test enforcing tag pins for every first-party reusable, wired into CI; (4) extend the repo-local pinning standard, with org-wide promotion + downstream-consumer rollout tracked as human-gated follow-ups.
References: AGENTS.md §"Release channel tags & the mutable-ref exception", docs/release/versioning.md, docs/initiatives/agentic-release-strategy.md. Originating findings: #520 (closed), #640 (closed). The epic is created inert — activation is a human decision.
Planned from idea discussion #666 by the BMAD Scrum Master initiative-planner. Inert until a maintainer adds initiative:auto.
Extend the dev-lead/pr-review channel-tag pinning standard (
<name>/stable+ immutable<name>/vX.Y.Z, cut viascripts/cut-release.sh) to every first-party reusable workflow in this repo, and make it a CI-enforced standard rather than per-workflow bespoke tests.Why now:
ci-failure-analyst-reusable.ymlis pinned by three sites (.github/workflows/ci-failure-analyst.lock.yml,templates/ci-failure-analyst.yml,docs/aw/ci-failure-analyst.md) to an off-mainSHA0ef7b6150516c4fa447700b4902e8ed406bcfb99annotated# main— a commit that lives only on the unmergedfix/action-sha-pinningbranch. Consumers copying the template inherit an off-main pin. The pr-review agent flagged this on #520 (MEDIUM, needs-human).Grounded scope (from
grep workflow_call): the first-party same-repo reusables areci-failure-analyst-reusable.yml(non-compliant — 3 SHA-# mainpin sites),dev-lead-reusable.yml(compliant —@dev-lead/stable),pr-review.yml(compliant —@pr-review/stable), andactions-fleet-monitor.yml(self-scheduled, no external callers). Onlyci-failure-analystneeds migration. Other-repopetry-projects/.githubreusables (e.g.agent-shield,feature-ideation) are pinned SHA-# vNand follow a different (cross-repo SHA-to-version) rule — the inventory/compliance test must distinguish the two.Deliverables: (1) generalize
cut-release.shto release non-agent reusables; (2) cutci-failure-analyst/v1.0.0+/stableand repin all three sites to the channel tag; (3) a generalized compliance test enforcing tag pins for every first-party reusable, wired into CI; (4) extend the repo-local pinning standard, with org-wide promotion + downstream-consumer rollout tracked as human-gated follow-ups.References: AGENTS.md §"Release channel tags & the mutable-ref exception",
docs/release/versioning.md,docs/initiatives/agentic-release-strategy.md. Originating findings: #520 (closed), #640 (closed). The epic is created inert — activation is a human decision.Planned from idea discussion #666 by the BMAD Scrum Master initiative-planner. Inert until a maintainer adds
initiative:auto.