fix(ci): add the Actions lockfile and re-pin stale reusables

[hyperpolymath]

Every governance and Hypatia run here is startup_failure — not failing, never starting. Two causes, and the second is invisible until the first is fixed.

1. No lockfile

Workflow-lockfile enforcement is active on this account and this repo had no .github/workflows/actions.lock, so every workflow was rejected before any job was created — no log, no check run, no row in gh pr checks.

2. Two stale reusable pins

81dbf2dd (2026-06-27) across 3 files, and e9c88887 across 2. Re-pinned to standards bd0df9ead7fa — the commit that made the governance check lockfile-aware.

Why this was misdiagnosed

Because the workflow never emitted its status context, the branch rule requiring governance / Validate Hypatia Baseline looked like a phantom. It isn't — the rule is correct and the workflow is broken. Rewriting the rule would have turned "this check is broken" into "this check is not required".

The cure, in order

Each step's failure is invisible until the previous one is fixed:

1. gh actions-lock — generates the lockfile, normalises pins to tags
2. Hoist SPDX back to line 1 — actions-lock puts its banner there and the linter requires SPDX first, so the tool that cures the startup failures would otherwise redden all 20 workflow files
3. Hand-author [] lockfile entries for the 5 reusable callers — actions-lock skips callers, so without this they stay startup_failure while everything else goes green
4. Re-pin the callers

Verified: all 20 workflows parse, SPDX on line 1, 5 caller entries in the lockfile.

Expect previously-unseen failures. Nothing here has been checked in a long time; the first green run is a starting point, not a result.

Found by the estate CI/CD census (hyperpolymath/standards#583).

🤖 Generated with Claude Code

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved

Adds the missing GitHub Actions lockfile and re-pins stale reusable workflows to resolve startup failures across governance and Hypatia runs. No issues found.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

---

Important

Your trial ends in 4 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)