fix(check-image-updates): check out scripts at the pinned ref

[mairas]

check-image-updates.yml checked out its scripts/ with ref: ${{ github.job_workflow_sha }}. That property does not exist, so the ref was empty and actions/checkout used main. Once callers pin @v1, the workflow would run from the tag with scripts from main.

The fix uses job.workflow_sha and job.workflow_repository, which GitHub documents for exactly this case: a reusable workflow checking out its own files. actionlint 1.7.12, the latest release, does not know these properties yet, so .github/actionlint.yaml ignores that one message in that one file.

Verification: halos-core-containers run 35226523573 called this workflow from a throwaway branch pinned to @fix/check-image-updates-workflow-sha with dry-run: true. The script checkout fetched and checked out d34564034d219ccf33164554ce56ed202aec0a8b, the branch head, while main was at 020cda3. The throwaway branch is deleted.

Fly-by: adds .coderabbit.yaml with review instructions drawn from AGENTS.md (frozen legacy files, ref pinning, interface stability, privacy). It validates against CodeRabbit's schema v2.

Closes #58

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Improved the reliability and consistency of automated image update checks by ensuring shared automation scripts use the same pinned workflow revision as the calling workflow.
  • Updated workflow validation rules to reflect current property names and reduce obsolete warnings.

[coderabbitai]

Warning

Review limit reached

Next included review available in 50 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 26d7cb51-e585-4b0a-b141-3c351eae342e

📥 Commits

Reviewing files that changed from the base of the PR and between d345640 and c5c914d.

📒 Files selected for processing (2)

• .coderabbit.yaml
• .github/actionlint.yaml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: c167df03-c2a1-41bb-a091-f204df848d38

📥 Commits

Reviewing files that changed from the base of the PR and between 020cda3 and d345640.

📒 Files selected for processing (2)

• .github/actionlint.yaml
• .github/workflows/check-image-updates.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The workflow now checks out shared scripts from job.workflow_repository at job.workflow_sha. The actionlint configuration suppresses warnings for these properties instead of the obsolete job_workflow_sha property.

Changes

Workflow revision alignment

Layer / File(s)	Summary
Align script checkout with workflow revision .github/workflows/check-image-updates.yml, .github/actionlint.yaml	The checkout step uses job.workflow_repository and job.workflow_sha. The actionlint ignore rule covers these properties and removes the obsolete job_workflow_sha warning.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Low

Merge Risk: ⚪ Minimal · up to d3456

The workflow checkout now follows the reusable workflow revision, allowing tagged callers to use matching scripts without an identified merge-blocking issue.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The change satisfies issue #58. .github/workflows/check-image-updates.yml now uses ${{ job.workflow_repository }} and ${{ job.workflow_sha }} for the scripts checkout. This selects the reusable …
Out of Scope Changes check	✅ Passed	The changes are limited to the scripts checkout in check-image-updates.yml and its file-specific actionlint exception. Both changes directly support issue #58. No unrelated implementation or configu…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: checking out the image-update scripts at the pinned workflow reference.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mairas]

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 54 minutes.

[mairas]

Local review (CodeRabbit rate-limited)

Scope: 020cda3..c5c914d (.coderabbit.yaml, .github/actionlint.yaml, .github/workflows/check-image-updates.yml). Reviewers: correctness, testing, maintainability, project-standards. No conditional personas: the diff has no endpoints, auth, contracts beyond one checkout ref, or retry logic.

The job.workflow_sha and job.workflow_repository change drew no findings. Correctness confirmed it matches the linked caller run.

P2 -- Moderate

#	File	Issue	Reviewer	Confidence	Outcome
1	.coderabbit.yaml	The examples/** instruction required tag pins and a status job everywhere, but examples/cockpit-apt and examples/docs-repo pin @main. CodeRabbit would have flagged them on every touching PR.	correctness, maintainability	0.90	Fixed: the rule applies to examples/deb and examples/npm; the other two are named as exceptions until issue 54 replaces them.
2	.coderabbit.yaml	The **/* instructions restated AGENTS.md, which knowledge_base.code_guidelines already loads, and had drifted (@v1 vs @vX).	maintainability	0.72	Fixed: the interface, legacy, versioning and privacy rules now point at AGENTS.md. Only review-specific traps stay.

P3 -- Low

#	File	Issue	Reviewer	Confidence	Outcome
3	.github/actionlint.yaml	The ignore matched the message for any context, so a wrong github.workflow_repository would also pass lint. It also had no removal trigger.	maintainability, correctness, testing, project-standards (as residual risk)	0.70	Fixed: the pattern includes in object type \{check_run_id: , the job context's type. A mutant using github.workflow_repository fails actionlint locally. The comment says to remove it when ACTIONLINT_VERSION moves past 1.7.12.
4	.coderabbit.yaml	"about thirty repositories" would go stale.	maintainability	0.62	Fixed: removed with finding 2.

Coverage

• Testing gap: the caller run exercised a branch ref, not a tag. job.workflow_sha is the resolved commit in both cases; the first @v1 canary run in issue 55 confirms it.
• Pre-existing: none.
• The fixes were folded into the two existing commits; check-image-updates.yml content is unchanged since the verified run at d345640.

---

Verdict: Ready to merge once CI passes.