> <!-- ccr-overview-v2 --> #31

Copilot review overview

🔵 Needs a closer look

Tests should validate every relevant action-pin occurrence, not only that at least one correct pin exists.

Review effort: Lite
Findings: None

What changed in this PR

Repins governance workflow dependencies to immutable Node 24 commits and adds regression coverage.

Changes:

• Updated checkout and setup-python pins in both workflows.
• Added legacy-pin rejection tests.
• Added evidence receipt metadata.

| File | Summary |

|---|---|

| tests/​test_evidence_receipts.py | Validates current and rejects legacy action pins. |

| .quirk/​evidence/​maintenance-node24-action-pins-33d9848478be.json | Records verification evidence. |

| .github/​workflows/​reusable-evidence-binding.yml | Updates immutable action pins. |

| .github/​workflows/​governance-contracts.yml | Updates immutable action pins. |

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Originally posted by @bryansayler in #28 (comment)