fix(github): pin cache action revision - #3

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

Merge Risk: ⚪ Minimal · up to c15da

The cache dependency is pinned and regression coverage is reported. No actionable code-level merge risk is established; the reported hosted checks remain pending.

Security Architecture Review

Security architecture risk: 🔵 Low · up to c15da

The change reduces dependency-substitution risk without changing the action’s inputs, cache configuration, or execution sequence. No introduced security concern was established. The selected upstream implementation and consumer-specific permissions were not independently assessed.

Retained concerns
No architecture-level concerns identified.

• Fix all pre-merge checks with AI

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

Exact-head repair evidence for c15dabc57a495ecb5e324b7ae4fe50c255212ab9:

• Independent review confirmed both oracle findings closed: inert YAML text cannot satisfy the structural check, and repository identity matching now covers case variants plus actions/cache/* sub-actions.
• No remaining concrete correctness, security, scope, or oracle defect was found in the full delta against 9d05f4f11fbd48cd909e5355591a66563010ff12.
• Focused local verification: 6 pass, 0 fail, 7 assertions across the dependency and runtime-image security tests.
• Hosted exact-head workflow run 36853164446 is queued (four jobs queued). This PR remains Draft / Proposed; queued Checks and the absence of an APPROVED review are not treated as completion.

@coderabbitai review

Please review exact head c15dabc57a495ecb5e324b7ae4fe50c255212ab9 against stacked base 9d05f4f11fbd48cd909e5355591a66563010ff12. Focus on mutable-action identity, executable YAML edge discovery, inert-text/vacuous-oracle bypasses, case-insensitive repository identity, and actions/cache/* sub-actions. This is review admission only; do not infer merge authorization from Ready state.

Thanks for updating your PR! It now meets our contributing guidelines. 👍

Current authority — stacked prerequisite admission correction

Exact head c15dabc57a495ecb5e324b7ae4fe50c255212ab9 is mechanically mergeable and its bounded cache-action pin remains source-complete, but its exact base is mutable Draft prerequisite #2 at 9d05f4f11fbd48cd909e5355591a66563010ff12.

Fresh exact-head evidence before this state correction:

• fix(github): pin cache action revision #3: 10 success / 4 queued, 0 qualifying APPROVED reviews, 0 unresolved threads.
• fix(opencode): harden runtime image #2: Draft, mechanically mergeable, with exact-head SAST and Trivy failures plus six queued product jobs. Those are substantive source/security/prerequisite gates, not merely missing approval or nonterminal Checks.
• fix(github): pin cache action revision #3's stacked-base admission also omits typecheck, nix-eval, central SAST/Security, and automatic model review as already recorded in the PR body.

Therefore the unready mutable prerequisite is a valid Draft reason under the current concurrency authority. This exact head is converted Ready → Draft once in this run. No source ref, head SHA, base, check run, rerun, cancellation, or wake generation is changed. Return to Ready only after #2 becomes an immutable integrated prerequisite or an exact-head authority record proves the prerequisite is no longer mutable/unready.