fix(create-issues-from-todos): remove mutable scanner image

.github/workflows/ci.yaml

@@ -82,28 +82,16 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: 🔒 Assert TODO action retries locally
+      - name: 🔒 Assert TODO action is immutable
         shell: bash
         run: |
           action_file="$GITHUB_WORKSPACE/create-issues-from-todos/action.yaml"
-          if grep -Eq '^[[:space:]]*-[[:space:]]*uses:[[:space:]]*Wandalen/wretry\.action@' "$action_file"; then
-            echo "::error::create-issues-from-todos must not depend on the external retry wrapper; it expands to an unpinned nested action ref in consumers with full-SHA policies."
+          if grep -qF "ghcr.io/alstr/todo-to-issue-action:" "$action_file"; then
+            echo "::error::create-issues-from-todos must not execute a mutable container tag."
             exit 1
           fi
-          grep -qF ".scripts/retry.sh" "$action_file" || {
-            echo "::error::create-issues-from-todos must use the bundled retry helper."
-            exit 1
-          }
-          grep -qF "retry_helper=\"\${RUNNER_TEMP}/devantler-actions-retry.sh\"" "$action_file" || {
-            echo "::error::create-issues-from-todos must preserve retry.sh outside the action checkout."
-            exit 1
-          }
-          grep -qF "retry() { bash \"\${RUNNER_TEMP}/devantler-actions-retry.sh\" \"\$@\"; }" "$action_file" || {
-            echo "::error::create-issues-from-todos must invoke the preserved retry helper."
-            exit 1
-          }
-          grep -qF "ghcr.io/alstr/todo-to-issue-action:v5.1.15" "$action_file" || {
-            echo "::error::create-issues-from-todos must keep the pinned todo-to-issue container image floor."
+          grep -qF "alstr/todo-to-issue-action@37bb7b56e58569ef273b60678048030a7f0c261a # v5.1.15" "$action_file" || {
+            echo "::error::create-issues-from-todos must keep todo-to-issue pinned to the reviewed v5.1.15 commit."
             exit 1
           }
 

create-issues-from-todos/action.yaml

@@ -30,71 +30,18 @@ runs:
         # to organization projects instead of inheriting the App installation's
         # blanket permissions (zizmor github-app).
         permission-organization-projects: write
-    - name: 🧰 Preserve retry helper
-      shell: bash
-      run: |
-        retry_helper="${RUNNER_TEMP}/devantler-actions-retry.sh"
-        cp "${GITHUB_ACTION_PATH}/../.scripts/retry.sh" "$retry_helper"
-        chmod +x "$retry_helper"
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         persist-credentials: false
     # Floor is v5.1.15: earlier releases crash the whole workflow with
     # `KeyError: 'web_url'` when a removed to-do marker matches multiple existing
     # issues (GitLab-only field in the ambiguous-match diagnostic). Never downgrade
     # past it. (Lowercase "to-do" avoids this action self-matching its own comment.)
-    # Wrapped in a retry: alstr/todo-to-issue-action does an UNAUTHENTICATED fetch of
-    # github/linguist's languages.yml/syntax.json from raw.githubusercontent.com on
-    # every run and aborts the whole step on any non-200 (devantler-tech/actions#483)
-    # — a transient CDN 429/5xx must not fail the job outright. Keep the retry
-    # local instead of wrapping a docker action with another marketplace action:
-    # some consumers reject the wrapper's unpinned nested implementation ref at
-    # job setup under full-SHA policies.
-    - name: 📝 Create issues from TODOs
-      shell: bash
-      env:
-        INPUT_REPO: ${{ github.repository }}
-        INPUT_BEFORE: ${{ github.event.before || github.base_ref }}
-        INPUT_COMMITS: ${{ toJSON(github.event.commits) }}
-        INPUT_DIFF_URL: ${{ github.event.pull_request.diff_url }}
-        INPUT_SHA: ${{ github.sha }}
-        INPUT_TOKEN: ${{ github.token }}
-        INPUT_CLOSE_ISSUES: "true"
-        INPUT_AUTO_P: "true"
-        INPUT_PROJECT: ${{ inputs.project }}
-        INPUT_PROJECTS_SECRET: ${{ steps.app-token.outputs.token }}
-        INPUT_AUTO_ASSIGN: "true"
-        INPUT_ACTOR: ${{ github.actor }}
-        INPUT_GITHUB_URL: ${{ github.api_url }}
-        INPUT_GITHUB_SERVER_URL: ${{ github.server_url }}
-        INPUT_ESCAPE: "true"
-        INPUT_NO_STANDARD: "false"
-        INPUT_INSERT_ISSUE_URLS: "false"
-        TODO_TO_ISSUE_IMAGE: ghcr.io/alstr/todo-to-issue-action:v5.1.15
-      run: |
-        retry() { bash "${RUNNER_TEMP}/devantler-actions-retry.sh" "$@"; }
-
-        retry docker run --rm \
-          --workdir /github/workspace \
-          --volume "$GITHUB_WORKSPACE:/github/workspace" \
-          --env GITHUB_ACTIONS=true \
-          --env GITHUB_WORKSPACE=/github/workspace \
-          --env CI=true \
-          --env INPUT_REPO \
-          --env INPUT_BEFORE \
-          --env INPUT_COMMITS \
-          --env INPUT_DIFF_URL \
-          --env INPUT_SHA \
-          --env INPUT_TOKEN \
-          --env INPUT_CLOSE_ISSUES \
-          --env INPUT_AUTO_P \
-          --env INPUT_PROJECT \
-          --env INPUT_PROJECTS_SECRET \
-          --env INPUT_AUTO_ASSIGN \
-          --env INPUT_ACTOR \
-          --env INPUT_GITHUB_URL \
-          --env INPUT_GITHUB_SERVER_URL \
-          --env INPUT_ESCAPE \
-          --env INPUT_NO_STANDARD \
-          --env INPUT_INSERT_ISSUE_URLS \
-          "$TODO_TO_ISSUE_IMAGE"
+    # Use the reviewed action commit rather than executing its mutable GHCR tag
+    # directly with repository and project tokens.
+    - uses: alstr/todo-to-issue-action@37bb7b56e58569ef273b60678048030a7f0c261a # v5.1.15
+      with:
+        AUTO_ASSIGN: true
+        CLOSE_ISSUES: true
+        PROJECT: ${{ inputs.project }}
+        PROJECTS_SECRET: ${{ steps.app-token.outputs.token }}