[groom] Six actions/* refs float on major tags in files where every sibling is SHA-pinned

**Groom auto-builder** — Comfy-Org/github-workflows: this CONFIRMED finding could not be auto-built (patch modifies a CI-privileged path (per .github/groom/patch_policy.py — workflow/action defs, lockfiles, or build/test config that executes in pre-review CI) — a human must author these changes), so it is filed for a human. · [run](https://github.com/Comfy-Org/github-workflows/actions/runs/31939149292)

**Verified exactly as claimed.** cursor-review.yml has 21 `uses: actions/*` lines; 17 are 40-hex SHA pins carrying a version comment and 4 float: `actions/checkout@v6` (:393), `actions/upload-artifact@v7` (:458), `actions/download-artifact@v8` (:1259 and :1472). The sharpest instance is real: :1461 pins `actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` and :1472, eleven lines later in the SAME consolidate job, uses `@v8`. test-refresh-reviewers.yml:29 and :34 (`actions/checkout@v6`, `actions/setup-python@v6`) are the only unpinned refs across the nine test-* workflows.

This matters most in cursor-review.yml specifically: it is a reusable workflow that other repos SHA-pin precisely to obtain an immutable execution surface, which a floating tag would defeat for those steps, and the jobs involved include ones that mint a bot App token.

**Fix (mechanical):**

1. cursor-review.yml: reuse the SHAs its own siblings already carry, i.e. checkout `3d3c42e5aac5ba805825da76410c181273ba90b1` (v7.0.1), upload-artifact `043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` (v7.0.1), download-artifact `3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` (v8). While there, normalise the two spellings of that download-artifact version comment (v8 at :1461 and :1478 versus v8.0.1 at :1252).
2. test-refresh-reviewers.yml: pin checkout and setup-python to the SHAs its sibling test workflows already use.
3. Optional, and the step that makes it stick: `.github/workflow-pins/check_workflow_pins.py` already text-parses every file in `.github/workflows`; add an action-SHA assertion with a self-draining exemption list in the style of its own KNOWN_EXEMPT (:48-56, which fails on a STALE entry).

**Steelman, and why it still lands:** actions/* is first-party GitHub, so the marginal risk from four floating tags is small, and `.github/dependabot.yml` already records the state honestly (a handful still sit on floating major tags, and those files get the least benefit from that config until they are pinned by hand). That argues against urgency, not against the fix: it is six lines, Dependabot keeps SHA pins fresh once they exist, and the inconsistency is already visible inside a single job.

**Not flagged security-adjacent, deliberately:** these are first-party actions, no auth or permission predicate is involved, and the repo already treats this as pinning hygiene with a documented backlog, so it is better implemented mechanically than filed as an investigation. The supply-chain dimension is real but second-order here.

Start with cursor-review.yml and test-refresh-reviewers.yml, comparing their floating actions/* refs with the pinned sibling workflow entries named in the issue. Run .github/workflow-pins/check_workflow_pins.py before and after the changes; done means all listed refs use the specified SHAs, version comments are consistent, and the checker enforces the invariant without stale exemptions.

Rédigé par le modèle d'indexation à partir du texte de l'issue.