From d32782c5df0fe43701776bc79f3433d615d62f55 Mon Sep 17 00:00:00 2001 From: Daniel A Martinez Julio Date: Fri, 19 Jun 2026 07:25:38 -0700 Subject: [PATCH 1/2] fix(scan): checkout runner helpers at job_workflow_sha (cross-repo reusable) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit github.workflow_sha is the CALLER's commit in a reusable-workflow call, so checking out Sigilix/runner at it fails cross-repo ('not our ref'). Use github.job_workflow_sha — the reusable workflow's OWN commit — which is valid in the runner repo both same-repo and cross-repo (unblocks the engine dogfood). --- .github/workflows/scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml index c55bbe8..4df4bcb 100644 --- a/.github/workflows/scan.yml +++ b/.github/workflows/scan.yml @@ -343,7 +343,7 @@ jobs: uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: Sigilix/runner - ref: ${{ github.workflow_sha }} + ref: ${{ github.job_workflow_sha }} path: runner persist-credentials: false From 1c5748bcfd438ba7fd7263f26e511cee5c4fd8c5 Mon Sep 17 00:00:00 2001 From: Daniel A Martinez Julio Date: Fri, 19 Jun 2026 07:28:20 -0700 Subject: [PATCH 2/2] ci: ignore actionlint false-positive on job_workflow_sha (valid context property) --- .github/workflows/ci.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9700c43..313d2e8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -62,4 +62,8 @@ jobs: ACTIONLINT_VERSION=1.7.12 curl -fsSL "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" \ | tar -xz actionlint - ./actionlint -color + # `job_workflow_sha` is a valid GitHub context property (the reusable + # workflow's own commit) that actionlint 1.7.12's schema predates — + # ignore that one false positive; it's required for the cross-repo + # runner-helper checkout in scan.yml. + ./actionlint -color -ignore 'property "job_workflow_sha" is not defined'