From 3efc5e936c7a2e31aba335107c975b234bb04c78 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 7 Aug 2026 14:21:47 +0100 Subject: [PATCH] =?UTF-8?q?fix(ci):=20regenerate=20actions.lock=20?= =?UTF-8?q?=E2=80=94=20workflow=20refs=20had=20drifted=20ahead=20of=20it?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Workflows reference action versions this lockfile does not pin. Actions were bumped in the workflows and `gh actions-lock` was never re-run, so the lockfile still records the older ref — and lockfile enforcement rejects a workflow whose refs it cannot resolve, before any job starts. Regenerated with `gh actions-lock` (v0.1.6) rather than hand-edited. Every entry needs a resolved commit SHA plus owner_id and repo_id, and hand-authoring those is exactly how the sibling defect happened — a caller entry written into the `dependencies:` map instead of `workflows:`, which made the whole file unparseable and killed every workflow in the repo at once. Verified before pushing, three ways: the hand-authored reusable-caller entries survive the regeneration (checked by count, because the tool does not generate them and deleting them would re-break the repo); every key under `dependencies:` still matches owner/repo@ref; and `gh actions-lock --no-fix` passes its own verification afterwards. One of 26 repos of 52 carrying a lockfile — half the estate — found by scanning after metadatastician/688-attack-hub#18. Co-Authored-By: Claude Opus 5 --- .github/workflows/actions.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index f74064c3..73134905 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -126,16 +126,16 @@ dependencies: commit: 'sha1-e9aba2c848f5ebd159c070c61ea2c4e2b122355e' owner_id: 44036562 repo_id: 192625525 - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f': - ref: 'v7.0.0' - commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' - owner_id: 44036562 - repo_id: 192625955 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a': ref: 'v7.0.1' commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' owner_id: 44036562 repo_id: 192625955 + 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f': + ref: 'v7.0.0' + commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + owner_id: 44036562 + repo_id: 192625955 'actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9': ref: 'v5.0.0' commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'