cowork-bot: SHA-pin all GitHub Actions and remove silent-failure trap

.github/workflows/ci.yml

@@ -17,12 +17,12 @@ jobs:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -44,12 +44,12 @@ jobs:
   schema-consistency:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
           python-version: "3.12"
 
@@ -61,7 +61,3 @@ jobs:
       - name: Check schema consistency
         run: |
           python scripts/check_consistency.py
-
-      - name: Run schemaforge check on fixtures
-        run: |
-          schemaforge check --dir /tmp --canonical sql || true

.github/workflows/cowork-auto-pr.yml

@@ -16,7 +16,7 @@ jobs:
       # without this step every run failed with "not a git repository" and no
       # PR was ever opened (fleet-wide defect: 11/11 seeded copies lacked it).
       - name: Check out the pushed branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           ref: ${{ github.ref_name }}
           fetch-depth: 0

.github/workflows/pages.yml

@@ -18,7 +18,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           persist-credentials: false
       - name: Setup Pages

.github/workflows/publish.yml

@@ -23,12 +23,12 @@ jobs:
     environment: pypi
 
     steps:
-      - uses: actions/checkout@v4  # v4.2.2 (pinned)
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           persist-credentials: false
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
           python-version: "3.12"
 
@@ -48,24 +48,24 @@ jobs:
 
       - name: Publish to TestPyPI
         if: ${{ inputs.pypi_target == 'testpypi' }}
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # release/v1
         with:
           repository-url: https://test.pypi.org/legacy/
 
       - name: Publish to PyPI
         if: ${{ inputs.pypi_target == 'pypi' || github.event_name == 'release' }}
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # release/v1
 
   npm-publish:
     runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4  # v4.2.2 (pinned)
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
         with:
           node-version: 22
           registry-url: 'https://registry.npmjs.org'

.gitignore

@@ -79,3 +79,4 @@ node_modules
 _audit_reqs.txt
 nul
 package-lock.json
+work-log.jsonl

fixtures/sample.alembic.py

@@ -4,24 +4,26 @@
 Revises:
 Create Date: 2026-05-15 03:00:00.000000
 """
+
 import sqlalchemy as sa
 from alembic import op
 
 # revision identifiers, used by Alembic.
-revision = 'sample'
+revision = "sample"
 down_revision = None
 
 
 def upgrade() -> None:
-    op.create_table('users',
-        sa.Column('id', sa.Integer(), primary_key=True),
-        sa.Column('name', sa.String(100), nullable=False),
-        sa.Column('email', sa.String(255), nullable=False, unique=True),
-        sa.Column('role', sa.Enum('admin', 'editor', 'viewer'), nullable=False),
-        sa.Column('is_active', sa.Boolean(), server_default=True),
-        sa.Column('created_at', sa.DateTime(), server_default=sa.func.now()),
+    op.create_table(
+        "users",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column("name", sa.String(100), nullable=False),
+        sa.Column("email", sa.String(255), nullable=False, unique=True),
+        sa.Column("role", sa.Enum("admin", "editor", "viewer"), nullable=False),
+        sa.Column("is_active", sa.Boolean(), server_default=True),
+        sa.Column("created_at", sa.DateTime(), server_default=sa.func.now()),
     )
 
 
 def downgrade() -> None:
-    op.drop_table('users')
+    op.drop_table("users")

tests/test_mcp_server.py

@@ -2,13 +2,17 @@
 
 from __future__ import annotations
 
-import pytest
+import pytest  # noqa: F401
 import sys
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).parent.parent / "src"))
 
-pytest.importorskip("mcp", reason="mcp is an optional dependency")
+# Skip if mcp.server.fastmcp is not importable — mcp may be installed
+# but FastMCP could still be unavailable (API changes, partial installs).
+# The mcp_server module catches ImportError and sets FastMCP=None, so
+# we must check the actual import path used by create_server().
+pytest.importorskip("mcp.server.fastmcp", reason="mcp.server.fastmcp is required for MCP server tests")
 
 from schemaforge.mcp_server import _FORMATS, create_server