pincheck

Overview ¶

Command pincheck is the workflow supply-chain pin gate (ADR-0079). Every remote `uses:` reference under .github/workflows must pin a full 40-hex commit SHA (repo-local `./` references are exempt - they are repo code; `docker://` references must pin an image digest), and every goreleaser-action `version:` input must be an exact semver version, so neither a moved tag nor a re-floated tool range can inject unreviewed code into CI. ./x gate runs it on every commit.