From 6ce44421fea467a175172189d949c9d92c35e1a4 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 6 Aug 2026 08:42:29 +0100 Subject: [PATCH] fix(ci): add the Actions lockfile and re-pin stale reusables MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every governance and Hypatia run here is `startup_failure` — not failing, never starting. Two causes, and the second is invisible until the first is fixed. NO LOCKFILE. Workflow-lockfile enforcement is active on this account and this repository had no .github/workflows/actions.lock, so every workflow was rejected before any job was created: no log, no check run, no row in `gh pr checks`. TWO STALE REUSABLE PINS — 81dbf2dd (2026-06-27) across 3 files and e9c88887 across 2. Re-pinned to standards bd0df9ead7fa, the commit that made the governance check lockfile-aware. That combination also explains a misdiagnosis worth recording. Because the workflow never emitted its status context, the branch rule requiring `governance / Validate Hypatia Baseline` looked like a PHANTOM — a rule naming something that does not exist. It is not: the rule is correct and the workflow is broken. Rewriting the rule would have turned "this check is broken" into "this check is not required". Applied the four-step cure proven across this campaign, in order, because each step's failure is invisible until the previous one is fixed: 1. gh actions-lock generates the lockfile and normalises pins to tags. 2. Hoist SPDX back to line 1 — actions-lock inserts its own banner there and the workflow linter requires SPDX first, so the tool that cures the startup failures reddens all 20 workflow files unless this is undone. 3. Hand-author an empty [] lockfile entry for each of the 5 reusable-workflow callers. gh actions-lock SKIPS callers, so without this they stay startup_failure while everything else goes green. 4. Re-pin the callers. Verified: all 20 workflows parse, SPDX is on line 1, and the lockfile carries 5 caller entries. Expect previously-unseen failures — nothing here has been checked in a long time, so the first green run is a starting point rather than a result. Found by the estate CI/CD census (hyperpolymath/standards#583). Co-Authored-By: Claude Fable 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/workflows/actions.lock | 132 ++++++++++++++++++ .github/workflows/boj-build.yml | 3 +- .github/workflows/casket-pages.yml | 15 +- .github/workflows/codeql.yml | 7 +- .github/workflows/dogfood-gate.yml | 15 +- .github/workflows/e2e.yml | 3 +- .github/workflows/governance.yml | 3 +- .github/workflows/hypatia-dispatch-intake.yml | 3 +- .github/workflows/hypatia-scan.yml | 3 +- .github/workflows/inbox-steward.yml | 5 +- .github/workflows/instant-sync.yml | 3 +- .github/workflows/learning-loop.yml | 5 +- .github/workflows/mirror.yml | 3 +- .github/workflows/pages.yml | 9 +- .github/workflows/panicbot-sweep.yml | 9 +- .github/workflows/push-email-notify.yml | 3 +- .github/workflows/repo-integrity-guard.yml | 3 +- .github/workflows/rust.yml | 3 +- .github/workflows/scorecard.yml | 3 +- .github/workflows/secret-scanner.yml | 3 +- .github/workflows/supervised-fleet-scan.yml | 3 +- 21 files changed, 194 insertions(+), 42 deletions(-) create mode 100644 .github/workflows/actions.lock diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 00000000..fdc6aacd --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,132 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/boj-build.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/casket-pages.yml': + - 'actions/cache@v6.1.0' + - 'actions/checkout@v7.0.1' + - 'actions/configure-pages@v6.0.0' + - 'actions/deploy-pages@v5.0.0' + - 'actions/upload-pages-artifact@v5.0.0' + - 'haskell-actions/setup@v2.11.0' + '.github/workflows/codeql.yml': + - 'actions/checkout@v7.0.1' + - 'github/codeql-action@v4.37.3' + '.github/workflows/dogfood-gate.yml': + - 'actions/checkout@v7.0.1' + - 'hyperpolymath/a2ml-ecosystem@main' + - 'hyperpolymath/k9-ecosystem@main' + '.github/workflows/e2e.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/governance.yml': [] + '.github/workflows/hypatia-dispatch-intake.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/hypatia-scan.yml': [] + '.github/workflows/inbox-steward.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/instant-sync.yml': + - 'peter-evans/repository-dispatch@v4.0.1' + '.github/workflows/learning-loop.yml': + - 'actions/checkout@v7.0.1' + - 'actions/upload-artifact@v7.0.1' + '.github/workflows/mirror.yml': [] + '.github/workflows/pages.yml': + - 'actions/checkout@v7.0.1' + - 'actions/deploy-pages@v5.0.0' + - 'actions/upload-pages-artifact@v5.0.0' + '.github/workflows/panicbot-sweep.yml': + - 'actions/checkout@v7.0.1' + - 'actions/upload-artifact@v7.0.1' + - 'dtolnay/rust-toolchain@master' + - 'swatinem/rust-cache@v2.9.1' + '.github/workflows/push-email-notify.yml': + - 'dawidd6/action-send-mail@v3.12.0' + '.github/workflows/repo-integrity-guard.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/rust.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/scorecard.yml': [] + '.github/workflows/secret-scanner.yml': [] + '.github/workflows/supervised-fleet-scan.yml': + - 'actions/checkout@v7.0.1' +dependencies: + 'actions/cache@v6.1.0': + ref: 'v6.1.0' + commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' + owner_id: 44036562 + repo_id: 215566462 + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/configure-pages@v6.0.0': + ref: 'v6.0.0' + commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d' + owner_id: 44036562 + repo_id: 513659658 + 'actions/deploy-pages@v5.0.0': + ref: 'v5.0.0' + commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128' + owner_id: 44036562 + repo_id: 438112499 + 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f': + ref: 'v7.0.0' + commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-artifact@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-pages-artifact@v5.0.0': + ref: 'v5.0.0' + commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9' + owner_id: 44036562 + repo_id: 496012378 + uses: + - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + 'dawidd6/action-send-mail@v3.12.0': + ref: 'v3.12.0' + commit: 'sha1-12335b969ae3fb71bee5f2c6b829744261aec34c' + owner_id: 9713907 + repo_id: 222439721 + 'dtolnay/rust-toolchain@master': + ref: 'master' + commit: 'sha1-2c7215f132e9ebf062739d9130488b56d53c060c' + owner_id: 1940490 + repo_id: 260749683 + 'github/codeql-action@v4.37.3': + ref: 'v4.37.3' + commit: 'sha1-e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81' + owner_id: 9919 + repo_id: 259445878 + 'haskell-actions/setup@v2.11.0': + ref: 'v2.11.0' + commit: 'sha1-cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553' + owner_id: 75048950 + repo_id: 623796603 + 'hyperpolymath/a2ml-ecosystem@main': + ref: 'main' + commit: 'sha1-aa4b836bd969df2bc58128cb8e3d20bbc88d5e79' + owner_id: 6759885 + repo_id: 1275649586 + 'hyperpolymath/k9-ecosystem@main': + ref: 'main' + commit: 'sha1-89f3c2702f4f650a92aa7411502f38da06abd562' + owner_id: 6759885 + repo_id: 1275650185 + 'peter-evans/repository-dispatch@v4.0.1': + ref: 'v4.0.1' + commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697' + owner_id: 18365890 + repo_id: 220359305 + 'swatinem/rust-cache@v2.9.1': + ref: 'v2.9.1' + commit: 'sha1-c19371144df3bb44fab255c43d04cbc2ab54d1c4' + owner_id: 580492 + repo_id: 298565987 diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 1fcf862b..e26d67bf 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: BoJ Server Build Trigger on: push: @@ -10,7 +11,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Trigger BoJ Server (Casket/ssg-mcp) run: | # Send a secure trigger to boj-server to build this repository diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index 57be5794..a7d337f5 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: GitHub Pages on: @@ -22,22 +23,22 @@ jobs: timeout-minutes: 30 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 - name: Checkout casket-ssg - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/casket-ssg path: .casket-ssg - name: Setup GHCup - uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2 + uses: haskell-actions/setup@v2.11.0 with: ghc-version: '9.8.2' cabal-version: '3.10' - name: Cache Cabal - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6.1.0 with: path: | ~/.cabal/packages @@ -99,10 +100,10 @@ jobs: touch ../_site/.nojekyll - name: Setup Pages - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 + uses: actions/configure-pages@v6.0.0 - name: Upload artifact - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 + uses: actions/upload-pages-artifact@v5.0.0 with: path: '_site' @@ -116,4 +117,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 + uses: actions/deploy-pages@v5.0.0 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 52295994..56487848 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: CodeQL Security Analysis on: @@ -42,15 +43,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3 + uses: github/codeql-action/init@v4.37.3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3 + uses: github/codeql-action/analyze@v4.37.3 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index d9c31739..4f69d714 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate @@ -27,7 +28,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Check for A2ML files id: detect @@ -44,7 +45,7 @@ jobs: - name: Validate A2ML manifests if: steps.detect.outputs.count > 0 - uses: hyperpolymath/a2ml-ecosystem/validate-action@aa4b836bd969df2bc58128cb8e3d20bbc88d5e79 # main + uses: hyperpolymath/a2ml-ecosystem/validate-action@main with: path: '.' strict: 'false' @@ -89,7 +90,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Check for K9 files id: detect @@ -106,7 +107,7 @@ jobs: - name: Validate K9 contracts if: steps.detect.outputs.k9_count > 0 - uses: hyperpolymath/k9-ecosystem/validate-action@89f3c2702f4f650a92aa7411502f38da06abd562 # main + uses: hyperpolymath/k9-ecosystem/validate-action@main with: path: '.' strict: 'false' @@ -139,7 +140,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Scan for invisible characters id: lint @@ -204,7 +205,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Check for Groove manifest id: groove @@ -265,7 +266,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Generate dogfooding scorecard run: | diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 059c6c1a..61508936 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: E2E Tests on: push: @@ -14,7 +15,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: Install PyYAML (for workflow YAML validation) run: pip install pyyaml --quiet - name: Run E2E tests diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index c396eb79..f786b538 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # governance.yml — single wrapper calling the shared estate governance bundle # in hyperpolymath/standards instead of carrying per-repo copies. # @@ -32,4 +33,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 # main 2026-06-27 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 # main 2026-06-27 diff --git a/.github/workflows/hypatia-dispatch-intake.yml b/.github/workflows/hypatia-dispatch-intake.yml index 6b56fd6f..5d815ee4 100644 --- a/.github/workflows/hypatia-dispatch-intake.yml +++ b/.github/workflows/hypatia-dispatch-intake.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Intake pipeline for cross-repo Hypatia/Gitbot dispatch events. name: Hypatia Dispatch Intake @@ -22,7 +23,7 @@ jobs: contents: write # push received events to the findings-submissions inbox branch steps: - name: Checkout gitbot-fleet - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index f058a2cf..9f6c10c2 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml. # See standards#191 for the reusable's purpose and design. @@ -28,7 +29,7 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 secrets: inherit # Total caller-side wall-clock cap for the reusable. Matches # Hypatia's `missing_timeout_minutes` rule expectation. The scan is diff --git a/.github/workflows/inbox-steward.yml b/.github/workflows/inbox-steward.yml index 679adc36..8a50aae2 100644 --- a/.github/workflows/inbox-steward.yml +++ b/.github/workflows/inbox-steward.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Inbox Steward — Automated PR processing through CICD gate # # This workflow: @@ -288,7 +289,7 @@ jobs: steps: - name: Checkout gitbot-fleet - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 @@ -377,7 +378,7 @@ jobs: steps: - name: Checkout gitbot-fleet - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 - name: Send dispatch to Hypatia env: diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 779601af..bb1370c6 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync @@ -26,7 +27,7 @@ jobs: steps: - name: Trigger Propagation if: env.HAS_TOKEN == 'true' - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3 + uses: peter-evans/repository-dispatch@v4.0.1 with: token: ${{ secrets.FARM_DISPATCH_TOKEN }} repository: hyperpolymath/.git-private-farm diff --git a/.github/workflows/learning-loop.yml b/.github/workflows/learning-loop.yml index 44335b8c..ed5d7db2 100644 --- a/.github/workflows/learning-loop.yml +++ b/.github/workflows/learning-loop.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Hypatia Learning Loop - Auto-generate rules from observed patterns name: Learning Loop @@ -23,7 +24,7 @@ jobs: steps: - name: Checkout gitbot-fleet - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 with: lfs: true # shared-context/learning/*.jsonl is LFS-tracked (Item 60) @@ -39,7 +40,7 @@ jobs: - name: Upload rule proposals if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@v7.0.1 with: name: rule-proposals path: shared-context/learning/rule-proposals/*.lgt diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 8d214aaf..5a1be217 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Mirror to Git Forges on: @@ -12,5 +13,5 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e9c8888769a703924cc3c0d717900960d78aea00 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 secrets: inherit diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 50092a45..c458477a 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: GitHub Pages (Ddraig SSG) on: push: @@ -20,9 +21,9 @@ jobs: image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff steps: - name: Checkout Site - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 - name: Checkout Ddraig SSG - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/ddraig-ssg path: .ddraig-ssg @@ -39,7 +40,7 @@ jobs: fi ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/} - name: Upload artifact - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5 + uses: actions/upload-pages-artifact@v5.0.0 with: path: '_site' deploy: @@ -52,4 +53,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5 + uses: actions/deploy-pages@v5.0.0 diff --git a/.github/workflows/panicbot-sweep.yml b/.github/workflows/panicbot-sweep.yml index 1f86b565..427fd189 100644 --- a/.github/workflows/panicbot-sweep.yml +++ b/.github/workflows/panicbot-sweep.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Panicbot Sweep — weekly batch scan of all repos via panic-attack. # # Catches drift in dormant repos that don't get per-PR scans. @@ -39,15 +40,15 @@ jobs: steps: - name: Checkout gitbot-fleet - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable + uses: dtolnay/rust-toolchain@master with: toolchain: stable - name: Cache Rust dependencies - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 + uses: Swatinem/rust-cache@v2.9.1 with: workspaces: | bots/panicbot -> target @@ -125,7 +126,7 @@ jobs: - name: Upload findings artifact if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@v7.0.1 with: name: panicbot-sweep-findings path: shared-context/findings/ diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 9285cdef..20caab16 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by @@ -17,7 +18,7 @@ jobs: timeout-minutes: 10 steps: - name: Send push notification email - uses: dawidd6/action-send-mail@12335b969ae3fb71bee5f2c6b829744261aec34c # pinned + uses: dawidd6/action-send-mail@v3.12.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/repo-integrity-guard.yml b/.github/workflows/repo-integrity-guard.yml index 065ac4d6..a3ef87b6 100644 --- a/.github/workflows/repo-integrity-guard.yml +++ b/.github/workflows/repo-integrity-guard.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Repo Integrity Guard — prevents a stale-base squash-merge (or any push/PR) # from silently mass-deleting gitbot-fleet again. # @@ -35,7 +36,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout (full history) - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 lfs: true # shared-context/learning/*.jsonl is LFS-tracked (Item 60) diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 1fdf84d0..b396c45c 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Rust # Build + test + clippy gate for the three standalone Rust crates. # Added after a non-compiling crate (robot-repo-automaton) reached `main` @@ -31,7 +32,7 @@ jobs: run: working-directory: ${{ matrix.crate }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: Ensure clippy + rustfmt components run: rustup component add clippy rustfmt - name: Build (all targets) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 2d9ea22d..3efc3d0b 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Scorecards supply-chain security on: @@ -15,5 +16,5 @@ jobs: permissions: security-events: write id-token: write - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 secrets: inherit diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 1d695091..43c86b36 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Secret Scanner on: @@ -20,5 +21,5 @@ jobs: contents: read pull-requests: write actions: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@e9c8888769a703924cc3c0d717900960d78aea00 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 secrets: inherit diff --git a/.github/workflows/supervised-fleet-scan.yml b/.github/workflows/supervised-fleet-scan.yml index a7a1304f..2f539938 100644 --- a/.github/workflows/supervised-fleet-scan.yml +++ b/.github/workflows/supervised-fleet-scan.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Scheduled/dispatch pipeline for supervised-repo scanning via Hypatia + gitbot-fleet. name: Supervised Fleet Scan @@ -32,7 +33,7 @@ jobs: steps: - name: Checkout gitbot-fleet - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 with: lfs: true # shared-context/learning/*.jsonl is LFS-tracked (Item 60)