Reconcile script should normalize workflow references when detecting shim drift

[fullsend-ai-retro]

What happened

The reconcile bot (reconcile-repos.sh) detected that konflux-ci/mintmaker's shim workflow had 'drifted' from the template and created PR #560 on 2026-07-06 to sync it. The diff replaced dispatch.yml@ec21706cccc58d01588ecd842464a5afcc375ba1 # main (SHA-pinned) with dispatch.yml@main (floating). The review agent correctly flagged this as a medium security/supply-chain concern at 20:59 UTC and added requires-manual-review. Human reviewer staticf0x closed the PR at 08:45 UTC on 2026-07-07, confirming that the change 'removes the digest pin and as such provides worse security.' Meanwhile, Renovate had already opened PR #561 to update the SHA pin from ec21706 to 14477fe while preserving the pinning pattern — the correct security-preserving approach. The two bots are in conflict: the reconcile bot wants to unpin, Renovate wants to keep the pin current.

What could go better

The reconcile script's drift detection (around line 400 of internal/scaffold/fullsend-repo/scripts/reconcile-repos.sh) uses byte-for-byte base64 comparison via managed_content_b64(). When the shim-workflow-call.yaml template has @main and a repo has @sha # main, the comparison detects false drift because the content differs at the workflow reference line. The script then creates a PR that replaces the immutable SHA-pinned reference with a mutable floating reference — reducing supply chain integrity for a workflow that has id-token: write and actions: write permissions on a pull_request_target trigger.

Confidence is high that this is the root cause: all 8 other checked repos in the org (build-service, architecture, caching, build-definitions, integration-service, release-service, konflux-ci, konflux-ui) already use @main and would not trigger this drift. Only mintmaker uses SHA pinning (managed by Renovate), making it the only repo affected. The reconcile bot will keep recreating this PR on every reconcile cycle unless the content is normalized.

The review agent performed well here — it correctly identified the issue as medium severity, listed mitigating factors, and deferred to human judgment with requires-manual-review. No change needed to the review agent.

Proposed change

In internal/scaffold/fullsend-repo/scripts/reconcile-repos.sh, add a normalization step before the managed content comparison (around line 410). Before comparing REMOTE_MANAGED and EXPECTED_MANAGED, normalize both by replacing @[0-9a-f]{7,40}\s*#\s*<branch> patterns with @<branch>. This makes SHA-pinned references with branch comments equivalent to floating branch references for drift detection purposes.

Example implementation in the comparison block:

normalize_workflow_refs() {
  printf '%s' "$1" | base64 -d | sed -E 's/@[0-9a-f]{7,40}[[:space:]]*#[[:space:]]*(\S+)/@\1/g' | base64 -w0
}
REMOTE_NORMALIZED=$(normalize_workflow_refs "$REMOTE_MANAGED")
EXPECTED_NORMALIZED=$(normalize_workflow_refs "$EXPECTED_MANAGED")
if [ "$REMOTE_NORMALIZED" = "$EXPECTED_NORMALIZED" ]; then
  echo "✓ $REPO already enrolled (shim up to date)"
  ...
fi

This preserves the existing SHA pin in repos that use it, avoids fighting with Renovate, and has no effect on repos already using @main (since the normalization is a no-op for them).

Validation criteria

1. Running reconcile-repos.sh against a repo that has dispatch.yml@<sha> # main does NOT detect drift or create a sync PR when the only difference is the reference format. 2. Running reconcile-repos.sh against a repo with genuinely stale content (e.g., missing a new workflow trigger type) still correctly detects drift and creates a sync PR. 3. The Renovate-managed SHA pin in konflux-ci/mintmaker is preserved across future reconcile runs. 4. No new 'update fullsend shim workflow' PRs are created for mintmaker on subsequent reconcile cycles.

---

Generated by retro agent from konflux-ci/mintmaker#560