[j1mc]

Summary

• Pin the Flatpak publishing and STE reusable workflows to tuna-os/.github commit f835d4a4cdb18746e9b8abbc07defcef796a30a1 (main at the time of this change).
• Keep the existing inputs, secrets, and triggers unchanged.

Closes #206

Validation

• actionlint .github/workflows/publish-flatpak.yml .github/workflows/ste.yml
• Parsed both YAML files and checked their workflow references and 40-character SHAs; confirmed both files exist at the pinned upstream commit.
• Schema copy diffs and git diff --check passed.
• Cargo checks and Podman tests could not run: neither tool is installed in this environment.

The pinned upstream workflows themselves still reference some actions at @main, so this pins the two direct workflow references, not every transitive dependency.

---

🐝 Hive Agent: contributor | SHA: 03ec1a0

— hive: backend=pi model=openrouter/openai/gpt-6.1-terra

[hanthor-hive-agent]

03ec1a0

⚠️ Sentinel alert — maintainer review required

Hive flagged this PR (author @j1mc, head 03ec1a0bb96e) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/publish-flatpak.yml
  • .github/workflows/ste.yml

Hive added the sentinel-alert label. While it is present, Hive will not approve this PR, apply LGTM/approval labels, or merge it through any auto-merge lane. Remove the label once reviewed; Hive will not re-apply it unless new commits are pushed. Tune paths and behaviors under sentinel in hive.yaml or the dashboard Security tab.

[hanthor]

Sentinel reviewed (hanthor): the diff itself is harmless, but this is not merging.

Maintainer decision: dualcut keeps calling org reusable workflows at @main. tuna-os/.github docs/WORKFLOWS.md ("Common patterns and anti-patterns") says callers pin @main and let the org own versioning, and lists pinning a SHA as an anti-pattern. Those workflows are org-owned, branch-protected, and reviewed in tuna-os/.github. A SHA pin here also goes stale silently: f835d4a is already behind main and misses tuna-os/.github#346, which pins and verifies flatpak-cargo-generator in publish-flatpak. Third-party actions are being SHA-pinned in #232. Closing. Thank you for the contribution!

[hanthor]

Maintainer decision (supersedes my earlier @main rationale): cross-repository workflows/actions must use immutable full commit SHAs under the newer enforced org policy (.github#288/#335); the same-repository exemption does not apply to dualcut calling tuna-os/.github. The WORKFLOWS.md @main guidance I previously cited was stale and is being corrected centrally. Sorry for the conflicting guidance.

One corrective PR, #250, now pins both org reusable workflows to the centrally reviewed fded0603d7e383990e8259141419fe6c1d641f41 snapshot. Existing permissions, inputs and token mappings are unchanged. Full workflow-pin tests (29), the actual checker against all dualcut workflows, and actionlint on both changed files passed. Merge still requires green CI. The original duplicate/obsolete PRs remain closed; #250 is the single implementation path.