chore(ci): generate actions.lock ahead of the 2026-10-01 lock gate

[hyperpolymath]

Summary

• Adds .github/workflows/actions.lock. It was generated by gh actions-lock --no-narrow v0.1.6 from the refs already SHA-pinned here, so no uses: line changes.
• Moves the tool's banner to line 2 in each workflow, keeping SPDX on line 1.

Why

From 2026-10-01 the governance "Actions lockfile verify" gate fails any repo that lacks a lockfile. Changing the date on standards main would not help, because this repo pins the reusable workflow by SHA.

Verification

• The gate script at the pinned standards SHA passes with LOCK_TODAY=2026-10-01.
• This PR's own runs are the runtime test. Every workflow must create jobs, with no startup_failure.

🤖 Generated with Claude Code

https://claude.ai/code/session_019aa9y32JcBuZ85KXe2jb8R

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6ef6dd2c-2bbd-4009-9c7a-d8715275a367

📥 Commits

Reviewing files that changed from the base of the PR and between 4b73c7c and 9959665.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (16)

• .github/workflows/boj-build.yml
• .github/workflows/casket-pages.yml
• .github/workflows/codeql.yml
• .github/workflows/dependabot-automerge.yml
• .github/workflows/dogfood-gate.yml
• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/instant-sync.yml
• .github/workflows/label-triage.yml
• .github/workflows/labels.yml
• .github/workflows/mirror.yml
• .github/workflows/pages.yml
• .github/workflows/push-email-notify.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml
• .github/workflows/workflow-linter.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (24)

• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Debt ratchet
• GitHub Check: scan / shell-secrets
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: scan / rust-secrets
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Actions lockfile verify
• GitHub Check: scan / gitleaks
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Groove manifest check
• GitHub Check: Validate K9 contracts
• GitHub Check: Validate DEED manifests
• GitHub Check: analyze (actions, none)
• GitHub Check: semgrep-cloud-platform/scan

🔇 Additional comments (16)

.github/workflows/boj-build.yml (1)

2-2: LGTM!

.github/workflows/casket-pages.yml (1)

2-2: LGTM!

.github/workflows/codeql.yml (1)

2-2: LGTM!

.github/workflows/dependabot-automerge.yml (1)

2-2: LGTM!

.github/workflows/dogfood-gate.yml (1)

2-2: LGTM!

.github/workflows/governance.yml (1)

2-2: LGTM!

.github/workflows/hypatia-scan.yml (1)

2-2: LGTM!

.github/workflows/instant-sync.yml (1)

2-2: LGTM!

.github/workflows/label-triage.yml (1)

2-2: LGTM!

.github/workflows/labels.yml (1)

2-2: LGTM!

.github/workflows/mirror.yml (1)

2-2: LGTM!

.github/workflows/pages.yml (1)

2-2: LGTM!

.github/workflows/push-email-notify.yml (1)

2-2: LGTM!

.github/workflows/scorecard.yml (1)

2-2: LGTM!

.github/workflows/secret-scanner.yml (1)

2-2: LGTM!

.github/workflows/workflow-linter.yml (1)

2-2: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Added management notices to workflow configuration files. Workflow behaviour and settings are unchanged.

Walkthrough

Sixteen GitHub Actions workflow files now contain comments identifying them as managed by gh actions-lock. No workflow behaviour changed.

Changes

Workflow annotations

Layer / File(s)	Summary
Add workflow management comments .github/workflows/*	Added a comment identifying each workflow as managed by gh actions-lock. Workflow behaviour was not changed.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 99596

The workflow edits are comment-only, and the lock-verification failure remains unconfirmed.

Architecture Summary

Architecture risk: 🔵 Low · up to 99596

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/boj-build.yml: Adds a comment stating that the workflow is managed by gh actions-lock.
• observed — Modified behavior in .github/workflows/casket-pages.yml: Added a comment identifying the workflow as managed by gh actions-lock.
• observed — Modified behavior in .github/workflows/codeql.yml: Added a comment stating that the workflow is managed by gh actions-lock.
• observed — Modified behavior in .github/workflows/dependabot-automerge.yml: Adds a comment identifying the workflow as managed by gh actions-lock.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI lockfile generation and the 1 October 2026 lock gate. It accurately summarises the primary change.
Description check	✅ Passed	The description explains the new actions lockfile, workflow banner updates, reason for the change, and verification results. It is directly related to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow lines,
And finds new notes in tidy signs.
“Managed by the lock,” they say,
No steps have changed along the way.
Then hops away beneath the pines.}

_{Comment @coderabbitai help to get the list of available commands.}

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR