From 70968386bf49f51132ba7c71b1bb0efa21c55a1f Mon Sep 17 00:00:00 2001
From: m9751 <75797396+m9751@users.noreply.github.com>
Date: Thu, 18 Jun 2026 17:14:20 -0400
Subject: [PATCH 1/2] ci: SHA-pin lychee-action (govern row 3, github HR#2)

---
 .github/workflows/doc-link-check.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/doc-link-check.yml b/.github/workflows/doc-link-check.yml
index 372ac9d..795b336 100644
--- a/.github/workflows/doc-link-check.yml
+++ b/.github/workflows/doc-link-check.yml
@@ -33,7 +33,7 @@ jobs:
           restore-keys: cache-lychee-
 
       - name: Run lychee
-        uses: lycheeverse/lychee-action@v2
+        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411  # v2.8.0
         with:
           args: >-
             --no-progress

From 465f25fee46c99c9a5a5521224bf2b163634e003 Mon Sep 17 00:00:00 2001
From: m9751 <75797396+m9751@users.noreply.github.com>
Date: Thu, 18 Jun 2026 17:14:21 -0400
Subject: [PATCH 2/2] ci: extract github.event SHA to env (govern row 3, github
 HR#4)

---
 .github/workflows/rules-lint.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/rules-lint.yml b/.github/workflows/rules-lint.yml
index d0a7b93..b11f36e 100644
--- a/.github/workflows/rules-lint.yml
+++ b/.github/workflows/rules-lint.yml
@@ -57,11 +57,13 @@ jobs:
           echo "Validator self-test passed: good fixture accepted, bad fixture rejected."
 
       - name: Done Criteria schema validation
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
         run: |
           set -e
           # Find any plan files added or modified in this PR.
           # Plans live under plans/ at the repo root or examples/plans/.
-          changed=$(git diff --name-only --diff-filter=AM "${{ github.event.pull_request.base.sha || github.event.before }}" HEAD -- 'plans/**/*.md' 'examples/plans/**/*.md' 2>/dev/null || true)
+          changed=$(git diff --name-only --diff-filter=AM "$BASE_SHA" HEAD -- 'plans/**/*.md' 'examples/plans/**/*.md' 2>/dev/null || true)
           if [ -z "$changed" ]; then
             echo "No plan files added/modified in this PR — skipping Done Criteria validation."
             exit 0
@@ -85,10 +87,12 @@ jobs:
           echo "Empty-rule-body gate self-test passed: real rules accepted, stub rejected."
 
       - name: Empty-rule-body gate on changed rule files
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
         run: |
           set -e
           # Find rule files added/modified in this PR.
-          changed=$(git diff --name-only --diff-filter=AM "${{ github.event.pull_request.base.sha || github.event.before }}" HEAD -- 'examples/claude-code-rules/**/*.md' 2>/dev/null || true)
+          changed=$(git diff --name-only --diff-filter=AM "$BASE_SHA" HEAD -- 'examples/claude-code-rules/**/*.md' 2>/dev/null || true)
           if [ -z "$changed" ]; then
             echo "No rule files added/modified in this PR — skipping per-file check."
             exit 0