ci: SHA-pin actions in pr-size workflow and drop dead job

[kridaydave]

Hardened .github/workflows/pr-size.yml:

• SHA-pinned actions/checkout and actions/github-script (was floating major).
• Removed the sync-label-definitions job, which could never run (its if-condition contradicted the workflow trigger).
• Updated docs/project/good-first-prs.md status.

YAML structure verified; label job still wired correctly.

---

Note

Low Risk
CI-only changes; PR size labeling behavior is unchanged aside from no longer auto-syncing label colors/descriptions via the removed dead job.

Overview
Hardens the PR size workflow by pinning actions/checkout and actions/github-script to commit SHAs instead of floating major tags, and documents why the pull_request_target checkout stays on the base branch only.

Removes the sync-label-definitions job, which could never run because its if excluded pull_request_target while the workflow only triggers on that event. prepare-config now outputs label names only (no color/description), which is all the remaining label job needs. Adds inline comments on passive PR commit handling when bumping checkout.

Also adds docs/project/good-first-prs.md, a contributor audit list (tests, CI, docs), and marks related items such as the checkout bump and dead sync-label-definitions job as done.

^{Reviewed by Cursor Bugbot for commit ec0d5cd. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Pin actions to commit SHAs and remove label-sync job in pr-size workflow

• Pins actions/github-script and actions/checkout to specific commit SHAs in pr-size.yml instead of floating major version tags.
• Removes the sync-label-definitions job, which previously created and updated PR size label color/description via the GitHub Issues API.
• The prepare-config output now includes only label name fields, dropping color and description.

^{Macroscope summarized ec0d5cd.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 8e719f3b-9315-4472-ae78-1ba3926158e8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 512d84a. Configure here.}

[macroscopeapp]

Approvability

Verdict: Approved

CI workflow cleanup (SHA-pinning actions, removing dead job) and new contributor documentation. No runtime behavior changes. The open review comment is a low-severity doc inconsistency that doesn't block approval.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate ae95dfd