Harden `gh aw add` SHA pinning, enforce `.md`/`.lock.yml` frontmatter hash parity, require pinned action refs by default, and audit pin-resolution failures#27419

Merged

pelikhan merged 11 commits intomainfrom

copilot/fix-asymmetric-lock-file-issue

Apr 20, 2026

Commits on Apr 20, 2026

Initial plan
Copilot
authored
fix add sha resolution retries and lock hash parity safeguards

Copilot
and
pelikhan
authored
test and docs: cover sha resolution failures and frontmatter hash parity

Copilot
and
pelikhan
authored
fix add retry errors and make SHA backoff context-cancelable

Copilot
and
pelikhan
authored
docs: clarify context-aware retry sleep helper behavior

Copilot
and
pelikhan
authored
test/docs: refine cancellation test and retry sleep docs

Copilot
and
pelikhan
authored
docs/test: align retry cancellation contract and test behavior

Copilot
and
pelikhan
authored
feat: require pinned action refs by default with allow-action-refs override

Copilot
and
pelikhan
authored
feat: audit unresolved action ref pinning failures in lock manifest

Copilot
and
pelikhan
authored
test: strengthen manifest failure auditing assertions

Copilot
and
pelikhan
authored
refactor: tighten failure audit normalization helpers

Copilot
and
pelikhan
authored