From 31626de86f813e8f0f066d3fc25809b875bde842 Mon Sep 17 00:00:00 2001
From: Blair Hamilton <blair@pinpredict.com>
Date: Wed, 17 Jun 2026 09:20:04 -0400
Subject: [PATCH] fix(actionlint): use github.workflow_ref (not workflow_sha)
 for cross-repo checkout
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`validate-reusable-inputs` vendors pinpredict/.github at the workflow's
own ref to resolve `uses: ./...` against this repo (not the caller).
The previous revision used `github.workflow_sha`, which in cross-repo
reusable calls returns the *caller's* head SHA — fine for self-CI
(caller and this repo are the same) but breaks every downstream
consumer with `not our ref <caller-sha>` when actions/checkout tries
to fetch the caller's SHA from pinpredict/.github.

Parse `github.workflow_ref` instead — its shape is
`<owner>/<repo>/.github/workflows/<file>.yml@<git-ref>` — and pass the
ref portion to actions/checkout. Resolves to `refs/heads/main` for
downstream `@main` callers, `refs/pull/N/merge` for self-CI PRs, and
the SHA when pinned.

Observed failures: every CI run on trading-reports main since #4
merged; service-template PR #12 (the first PR since the actionlint
shim landed).
---
 .github/workflows/actionlint.yml | 29 +++++++++++++++++++++++------
 1 file changed, 23 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index cf6298c..2766dda 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -70,16 +70,33 @@ jobs:
 
       # `uses: ./...` in a reusable workflow resolves against the
       # caller's checkout, not this repo — so we vendor a copy of
-      # pinpredict/.github at the exact SHA this workflow file came
-      # from. github.workflow_sha is the PR head SHA in self-CI and
-      # the @ref SHA when invoked from a downstream caller. This also
-      # sidesteps the @main bootstrap chicken-and-egg the first time
-      # the action lands.
+      # pinpredict/.github at the exact ref this workflow file came
+      # from. Earlier revisions used `github.workflow_sha`, which
+      # actually returns the *caller's* SHA in cross-repo reusable
+      # calls — fine for self-CI (the caller and this repo are the
+      # same), broken for every downstream consumer ("not our ref"
+      # against pinpredict/.github on the caller's head SHA).
+      #
+      # `github.workflow_ref` shape:
+      #   `<owner>/<repo>/.github/workflows/<file>.yml@<git-ref>`
+      # Splitting on `@` yields a ref `actions/checkout` resolves
+      # against pinpredict/.github — `refs/heads/main` for downstream
+      # callers using `@main`, `refs/pull/N/merge` for self-CI PR
+      # runs, a SHA when pinned.
+      - name: Resolve workflow ref
+        id: workflow-ref
+        env:
+          GITHUB_WORKFLOW_REF: ${{ github.workflow_ref }}
+        run: |
+          set -euo pipefail
+          ref="${GITHUB_WORKFLOW_REF#*@}"
+          printf 'ref=%s\n' "$ref" >> "$GITHUB_OUTPUT"
+
       - name: Checkout pinpredict/.github at workflow ref
         uses: actions/checkout@v6
         with:
           repository: pinpredict/.github
-          ref: ${{ github.workflow_sha }}
+          ref: ${{ steps.workflow-ref.outputs.ref }}
           path: .pinpredict-github
 
       - uses: ./.pinpredict-github/actions/validate-reusable-inputs