Action Pinning Rule Requires a v-Prefixed Comment That Hub Release Tags Cannot Carry

[ptr727]

Finding

GOVERNANCE.md "Workflow YAML Conventions", Action pinning bullet, requires every pinned uses: to carry "a trailing # vX.Y.Z comment". In 624c324 that bullet now also covers cross-repository reusable workflows, since only ./ and $/ references are exempt. The hub's own release tags have no v prefix (2.0.672, 2.0.670), so a pin to a hub task can only carry the bare tag. A constructed example:

uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@0123456789abcdef0123456789abcdef01234567 # 2.0.672

Read literally, the rule flags that line. Changing it to # v2.0.672 would name a tag that does not exist, and Dependabot could then no longer match the comment to the tag. Every fleet repository calling a hub task by pin carries this shape. WORKFLOW.md D9.1 says only "a version comment", so the two canonical statements also disagree.

Suggested fix

State the comment as the referenced ref's release tag, for example # vX.Y.Z for an upstream action and the bare release tag for a hub task, rather than prescribing the v form.

Found by a local strict review while resyncing ptr727/aiopurpleair to 624c324, where the repository's own WORKFLOW.md now documents both forms.

[ptr727]

A second defect in the same bullet, raised by a Copilot review of a downstream resync: the bullet exempts a "self-repository ($/) reference" without saying what $/ is. It is not a uses: form GitHub Actions documents. ./ is the documented local form, and cross-repository references are owner/repo/path@ref. A downstream reader with only this section could take $/ for valid YAML syntax. Suggested fix, in the same edit: say what $/ denotes and where it appears, or name only ./.