fix(cursor-review): harden blocking gate + pin all action SHAs (BE-1981)

.github/workflows/cursor-review.yml

@@ -254,7 +254,7 @@ jobs:
       within_cap: ${{ steps.count.outputs.within_cap }}
     steps:
       - name: Checkout PR repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -332,7 +332,7 @@ jobs:
           PY
 
       - name: Checkout PR repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -342,7 +342,7 @@ jobs:
         # pinned via workflows_ref) — never from the PR checkout, so a
         # malicious PR can't rewrite the prompt to exfiltrate the diff or
         # smuggle instructions to the model.
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: Comfy-Org/github-workflows
           ref: ${{ inputs.workflows_ref }}
@@ -427,7 +427,7 @@ jobs:
 
       - name: Upload findings artifact
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: findings-${{ matrix.review_type }}-${{ matrix.model }}
           path: /tmp/findings-out/findings.json
@@ -447,13 +447,13 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout PR repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Load cursor-review assets
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: Comfy-Org/github-workflows
           ref: ${{ inputs.workflows_ref }}
@@ -475,7 +475,7 @@ jobs:
           echo "$HOME/.cursor/bin" >> "$GITHUB_PATH"
 
       - name: Download panel findings
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: /tmp/panel
           pattern: findings-*
@@ -680,7 +680,7 @@ jobs:
       - name: Mint bot-identity token (optional)
         id: bot_token
         if: ${{ inputs.bot_app_id != '' }}
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ inputs.bot_app_id }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
@@ -742,15 +742,27 @@ jobs:
     # resolved. `needs: consolidate` (with always()) orders it after the review
     # is posted on a fresh run, and lets it run even when consolidate is skipped.
     name: Blocking gate
-    needs: [gate, consolidate]
+    needs: [gate, diff-size, consolidate]
     if: ${{ always() && inputs.blocking && needs.gate.outputs.should_run == 'true' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
       pull-requests: read
     steps:
+      - name: Fail if the fresh review did not complete
+        # always() lets this gate run after a failed/cancelled consolidate, where
+        # no threads are posted and the unresolved-thread check below would pass
+        # green. Guard the fresh, within-cap path: if the panel was supposed to
+        # run and consolidate did not succeed, refuse to pass. The skip paths
+        # (already_reviewed re-trigger, over-cap) leave consolidate skipped and
+        # are intentionally exempt — they fall through to the live thread query.
+        if: ${{ needs.gate.outputs.already_reviewed != 'true' && needs.diff-size.outputs.within_cap == 'true' && needs.consolidate.result != 'success' }}
+        run: |
+          echo "Consolidate panel did not complete; refusing to pass the blocking gate."
+          exit 1
+
       - name: Load cursor-review assets
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: Comfy-Org/github-workflows
           ref: ${{ inputs.workflows_ref }}
@@ -776,7 +788,7 @@ jobs:
       contents: read
     steps:
       - name: Load cursor-review assets
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: Comfy-Org/github-workflows
           ref: ${{ inputs.workflows_ref }}
@@ -830,7 +842,7 @@ jobs:
       contents: read
     steps:
       - name: Load cursor-review assets
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: Comfy-Org/github-workflows
           ref: ${{ inputs.workflows_ref }}