fix(ci): adopt Actions dependency lockfile (estate startup_failure remediation) - #91
Conversation
…mediation) Estate-wide sweep applying the haec-proven template (haec#46/#48, echidna#341): actions.lock via gh actions-lock; SPDX kept on line 1 above the locker marker; hand-added lockfile entries for workflows the tool skips (reusable-only / zero-dep); standards reusables re-pinned to fcb8669169b4 (first standards ref carrying its own lockfile); illegal timeout-minutes stripped from reusable-caller jobs; SHA-pin lint made lockfile-aware. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedAdopts the Actions dependency lockfile across all workflows and re-pins reusable components to satisfy strict workflow enforcement. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 6 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
…lint) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
At standards >= fcb8669 the governance/hypatia/mirror/scorecard reusables declare actions: read (hypatia adds security-events: write; scorecard adds id-token/security-events write). A reusable requesting more than its caller grants is a startup_failure — the third enforcement layer after the lockfile and the caller entries. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Pull request was closed
…ermission union Computed from each called reusable's workflow+job permissions at bd0df9e — the previous pass only covered four wrapper names and missed e.g. spark-theatre-gate (requests actions: read). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 participant
Estate sweep: this repo's every workflow has been
startup_failureunder GitHub's workflow-lockfile enforcement. Applies the template proven on haec (#46/#48) and echidna (#341):actions.lock, SPDX-first header order, hand-added entries for tool-skipped workflows, standards reusables re-pinned past the standards lockfile boundary (5a597720), illegaltimeout-minutesstripped from reusable jobs, lockfile-aware SHA-pin lint.The PR's own check runs are the test: executing checks (even failures) = enforcement satisfied.
🤖 Generated with Claude Code