fix(lock): keep relock-standards-pin's original pin match, minus comment lines

[hyperpolymath]

Summary

This follows up #1317, which merged at b3862040 before this fix was pushed. It answers Codex's second finding on #1317 (quoted uses keys).

#1317 changed standards_pins so that commented caller examples no longer count as pins. Each version it shipped matched pins more narrowly than main's original scan, and each one dropped a YAML form the original found:

• ^\s*uses: dropped one-line flow calls, build: { uses: "…@<sha>" };
• uses: after {, , or a space (what merged) drops quoted keys, "uses": …@<sha>. apply-workflow-pins-remote.sh still rewrites the SHA in such a call, but the relock then refuses with "no workflow pins".

The only line that needed excluding was a full-line comment. standards_pins is now main's original match with those lines removed, and nothing else changed:

standards_pins() { grep -hvE '^[[:space:]]*#' "$@" 2>/dev/null | grep -oE "$PIN_RE"; }

Type of change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• 🔧 Build / CI / tooling

How has this been verified?

bash scripts/tests/relock-standards-pin-test.sh → PASS, with one new case: "a quoted uses key is counted as a pin". I ran the suite against the script at each earlier version. Each fails exactly the case it missed:

Script at	Result
main before #1317	FAIL: commented caller example
38e4d91a	FAIL: flow-style call
b3862040 (merged)	FAIL: quoted uses key
this PR	PASS

On this repo, relock-standards-pin.sh --to d55304a0 reports "already keyed" and check-lock-sync.sh reports in sync. shellcheck -S warning on the script is clean.

Checklist

• My commits are signed. The session's managed signing is inactive (see CLAUDE.md).
• I ran the project's own checks/tests locally and they pass.
• No new files; no SPDX or licence change.
• Docs: no public claim changes.
• No soundness hole introduced. The scan matches what main's did, except full-line comments.

Notes for reviewers

A run: body or a trailing comment that quotes a pin still counts, as it always has. Excluding those would need a YAML parser. This script greps everywhere else, so I kept it to the one exclusion that was actually breaking relocks.

Separately, #1317 works on main: Mirror run 1169 on 0d47b892 started under its real name and resolved mirror-reusable.yml@d55304a0.

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 26 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d49f913e-87a9-4dd9-ad49-95a2133d9608

📥 Commits

Reviewing files that changed from the base of the PR and between 0d47b89 and bf3a360.

📒 Files selected for processing: 2

• scripts/relock-standards-pin.sh
• scripts/tests/relock-standards-pin-test.sh

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🟢 conformant · commit bf3a360bf7a7 · run 39425747820

Category	Status	Pass	Fail	Indeterminate	N/A	Since previous revision
DEED syntax	🟢 conformant	4	0	0	0	— no comparable baseline
K9 contract typecheck	🟢 conformant	1	0	0	0	— no comparable baseline
K9 validator self-test	🟢 conformant	37	0	0	0	— no comparable baseline
K9 positive/negative controls	🟢 conformant	27	0	0	0	— no comparable baseline
K9 live corpus (L0–L2)	🟢 conformant	12	0	0	2	— no comparable baseline

K9 live corpus (L0–L2): 2 finding(s) / scope notes

• 2-protocols/k9-coordination/examples/minimal.k9 — not_applicable: Routed to another dialect; not validated as a K9 contract.
• coordination.k9 — not_applicable: Routed to another dialect; not validated as a K9 contract.

Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T13:03:25.608389Z	bf3a360	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.