ci: pin github-script workflow action

[seonghobae]

Fixes #1.

Summary

• pin actions/github-script to the v9.0.0 commit SHA in the model catalog sync workflow
• preserve the v9 upgrade while satisfying Scorecard/GHAS pinned-dependency review feedback
• use a hotfix/* branch because this repository only allows release/* or hotfix/* PRs into main

Evidence read

• free-router#1 Trivy job log: bun.lock:271 reported ws@8.20.0 with CVE-2026-48779 HIGH and CVE-2026-45736 MEDIUM against old base d87af0f
• current main lockfile already has ws@8.21.0, so the stale Trivy finding is fixed at base
• free-router#1 review thread: Scorecard / Pinned-Dependencies flagged .github/workflows/model-catalog-sync.yml line 116
• first attempt ci: pin github-script workflow action #10 showed repo policy requires release/* or hotfix/* branches for main
• second attempt ci: pin github-script workflow action #11 policy log required a linked issue in the body

Verification

• workflow yaml ok
• git diff --check -- .github/workflows/model-catalog-sync.yml
• codegraph sync; codegraph status

[opencode-agent]

OpenCode Review Overview

• Head SHA: ac64eb273d4cad154cb59d151d9f0b3b8352a30b
• Workflow run: 29223907389
• Workflow attempt: 1
• Gate result: APPROVE (exit 0)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: model-catalog-sync.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: model-catalog-sync.yml"]
  R1 --> V1["actionlint plus required checks"]

Loading

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head bounded evidence and found no blocking issues.

Findings

No blocking findings.

Summary

Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/model-catalog-sync.yml.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports test coverage as not applicable because no supported changed source files or package manifests were found.
Docstring coverage: coverage execution evidence reports docstring coverage as not applicable because no supported changed source files or package manifests were found.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/model-catalog-sync.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.

Adversarial validation

{"status":"passed","probes":[{"path":".github/workflows/model-catalog-sync.yml","line":117,"hypothesis":"The pinned SHA does not actually correspond to actions/github-script v9.0.0, risking unintended code.","attack_or_counterexample":"Fetch package.json at 3a2844b7e9c422d3c10d287c895573f7108da1b3 to verify version and engines.","evidence":"package.json at that commit shows \"version\": \"9.0.0\" and engines.node \">=24\"; action.yml exists at the same SHA.","outcome":"falsified"},{"path":".github/workflows/model-catalog-sync.yml","line":117,"hypothesis":"actions/github-script v9 (node24 runtime) is not supported on GitHub-hosted runners and will fail at runtime.","attack_or_counterexample":"Inspect action.yml at the pinned SHA (runs: node24) and cross-check GitHub changelog for node24 support timeline.","evidence":"action.yml declares runs: node24; GitHub Changelog (Sep 19, 2025) states runners support node24 and migration underway in 2026.","outcome":"falsified"}],"residual_risk":"Low: The labeling step may still fail with 403 if GITHUB_TOKEN lacks issues: write (current workflow sets contents: write and pull-requests: write). This is preexisting and non-blocking for the PR’s pinning goal; suggest adding issues: write to ensure labels are applied."}

• Result: APPROVE
• Reason: Pins actions/github-script to the exact v9.0.0 commit, improving supply-chain safety while preserving intended behavior.
• Head SHA: ac64eb273d4cad154cb59d151d9f0b3b8352a30b
• Workflow run: 29223907389
• Workflow attempt: 1

[seonghobae]

Temporarily closing and reopening to retrigger the central required workflows on the same current head after ContextualWisdomLab/.github#512 landed; no source change intended.

[seonghobae]

Temporarily closing and reopening to retrigger the central required workflows on the same current head after ContextualWisdomLab/.github#510 landed; no source change intended.

[seonghobae]

Queue hygiene: closing briefly to cancel/retire stale required-workflow runs from before ContextualWisdomLab/.github#510. Reopening immediately on the same head.