From 1c00c7d340d470fa027f855e7e62becd3769dd54 Mon Sep 17 00:00:00 2001
From: Dan Barr <6922515+danbarr@users.noreply.github.com>
Date: Fri, 18 Sep 2026 14:56:44 -0400
Subject: [PATCH] Fix trusted scan workflow revision

Signed-off-by: Dan Barr <6922515+danbarr@users.noreply.github.com>
---
 .github/workflows/trusted-skill-scan.yml | 10 +++++++---
 docs/trusted-skill-scan-workflow.md      |  9 ++++++---
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/trusted-skill-scan.yml b/.github/workflows/trusted-skill-scan.yml
index a611f97e..540761f8 100644
--- a/.github/workflows/trusted-skill-scan.yml
+++ b/.github/workflows/trusted-skill-scan.yml
@@ -9,8 +9,9 @@ on:
       - 'skills/**/*.yaml'
 
 # This workflow has access to the LLM credential. It must only execute code
-# checked out from the trusted base commit; pull-request files are fetched as
-# data through the contents API and are never sourced or executed.
+# checked out from the commit that supplied this workflow; pull-request files
+# are fetched as data through the contents API and are never sourced or
+# executed.
 permissions: {}
 
 jobs:
@@ -155,7 +156,10 @@ jobs:
       - name: Checkout trusted scan implementation
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event.pull_request.base.sha }}
+          # pull_request.base.sha can remain at an older merge base after main
+          # advances. workflow_sha is the exact trusted revision from which
+          # GitHub loaded this pull_request_target workflow.
+          ref: ${{ github.workflow_sha }}
           persist-credentials: false
 
       - name: Fetch proposed specification as data
diff --git a/docs/trusted-skill-scan-workflow.md b/docs/trusted-skill-scan-workflow.md
index 74b6e2f8..ed2fad46 100644
--- a/docs/trusted-skill-scan-workflow.md
+++ b/docs/trusted-skill-scan-workflow.md
@@ -49,9 +49,12 @@ workflow validates specifications and confirms that the proposed skill can be
 packaged, but it does not run the LLM-backed scanner or publish artifacts.
 
 `trusted-skill-scan.yml` has access to the scanner credential. It checks out
-the workflow and scanner implementation from the trusted base commit. It
-fetches each proposed `spec.yaml` through the GitHub contents API and treats
-the file as data. Pull request code is never executed in this workflow.
+the workflow and scanner implementation from `github.workflow_sha`, the exact
+trusted commit from which GitHub loaded the `pull_request_target` workflow.
+This avoids using `pull_request.base.sha`, which can remain at an older merge
+base after `main` advances. The workflow fetches each proposed `spec.yaml`
+through the GitHub contents API and treats the file as data. Pull request code
+is never executed in this workflow.
 
 The trusted workflow also enforces the following boundaries: