From 2651a63bcf71cf6644c7c145a4bfa078a0d8b188 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 20 Sep 2026 02:03:10 +0000 Subject: [PATCH] fix(ci): reconcile the workflows with actions.lock (gh-actions-lock v0.1.6) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `actions.lock` is authoritative: the workflows carry readable refs and the lock records the commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest make the whole repository unstartable — `startup_failure`, "Invalid lockfile". Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are reverted to their readable form here precisely because the lockfile, not the workflow, is what pins them. --- .github/workflows/actions.lock | 37 +++++++++++-------- .github/workflows/boj-build.yml | 2 +- .github/workflows/casket-pages.yml | 16 ++++---- .github/workflows/codeql.yml | 6 +-- .github/workflows/dogfood-gate.yml | 14 +++---- .github/workflows/e2e.yml | 2 +- .github/workflows/hypatia-dispatch-intake.yml | 2 +- .github/workflows/inbox-steward.yml | 4 +- .github/workflows/instant-sync.yml | 2 +- .github/workflows/learning-loop.yml | 4 +- .github/workflows/pages.yml | 8 ++-- .github/workflows/panicbot-sweep.yml | 8 ++-- .github/workflows/push-email-notify.yml | 2 +- .github/workflows/repo-integrity-guard.yml | 2 +- .github/workflows/rust.yml | 6 +-- .github/workflows/supervised-fleet-scan.yml | 2 +- 16 files changed, 61 insertions(+), 56 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 9f5bfa31..263034fc 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -9,13 +9,13 @@ workflows: - 'actions/cache@v6.1.0' - 'actions/checkout@v7.0.1' - 'actions/configure-pages@v6.0.0' - - 'actions/deploy-pages@v5.0.0' + - 'actions/deploy-pages@v5.0.1' - 'actions/download-artifact@v8.0.1' - 'actions/upload-pages-artifact@v5.0.0' - 'haskell-actions/setup@v2.12.0' '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - - 'github/codeql-action@v4.37.8' + - 'github/codeql-action@v4.38.0' '.github/workflows/dogfood-gate.yml': - 'actions/checkout@v7.0.1' - 'hyperpolymath/deed-ecosystem@main' @@ -38,15 +38,15 @@ workflows: '.github/workflows/mirror.yml': [] '.github/workflows/pages.yml': - 'actions/checkout@v7.0.1' - - 'actions/deploy-pages@v5.0.0' + - 'actions/deploy-pages@v5.0.1' - 'actions/upload-pages-artifact@v5.0.0' '.github/workflows/panicbot-sweep.yml': - 'actions/checkout@v7.0.1' - 'actions/upload-artifact@v7.0.1' - - 'dtolnay/rust-toolchain@master' + - 'dtolnay/rust-toolchain@v1' - 'swatinem/rust-cache@v2.9.2' '.github/workflows/push-email-notify.yml': - - 'hyperpolymath/smtp-notify-action@v0.2.0' + - 'hyperpolymath/smtp-notify-action@v0.3.0' '.github/workflows/repo-integrity-guard.yml': - 'actions/checkout@v7.0.1' '.github/workflows/rust.yml': @@ -75,9 +75,9 @@ dependencies: commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d' owner_id: 44036562 repo_id: 513659658 - 'actions/deploy-pages@v5.0.0': - ref: 'v5.0.0' - commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128' + 'actions/deploy-pages@v5.0.1': + ref: 'v5.0.1' + commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346' owner_id: 44036562 repo_id: 438112499 'actions/download-artifact@v8.0.1': @@ -102,9 +102,9 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' - 'dtolnay/rust-toolchain@master': - ref: 'master' - commit: 'sha1-2c7215f132e9ebf062739d9130488b56d53c060c' + 'dtolnay/rust-toolchain@v1': + ref: 'v1' + commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de' owner_id: 1940490 repo_id: 260749683 'github/codeql-action@v4.37.8': @@ -112,6 +112,11 @@ dependencies: commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' owner_id: 9919 repo_id: 259445878 + 'github/codeql-action@v4.38.0': + ref: 'v4.38.0' + commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' + owner_id: 9919 + repo_id: 259445878 'haskell-actions/setup@v2.12.0': ref: 'v2.12.0' commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' @@ -119,17 +124,17 @@ dependencies: repo_id: 623796603 'hyperpolymath/deed-ecosystem@main': ref: 'main' - commit: 'sha1-f7a40a4d5cc82b2e73f861119baa6818d77a448d' + commit: 'sha1-ed83d6927e8fb21431e403dbf6d7a4af96772746' owner_id: 6759885 repo_id: 1275649586 'hyperpolymath/k9-ecosystem@main': ref: 'main' - commit: 'sha1-2155aa26a21758f2ba119f61bc7e0e1981c106fb' + commit: 'sha1-c1a34884054fabf0e9de81dbf68f4ba7874e85f1' owner_id: 6759885 repo_id: 1275650185 - 'hyperpolymath/smtp-notify-action@v0.2.0': - ref: 'v0.2.0' - commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7' + 'hyperpolymath/smtp-notify-action@v0.3.0': + ref: 'v0.3.0' + commit: 'sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be' owner_id: 6759885 repo_id: 1352485172 'ossf/scorecard-action@v2.4.4': diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index fbaa56fc..08c1a970 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -13,7 +13,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Trigger BoJ Server (Casket/ssg-mcp) run: | # Send a secure trigger to boj-server to build this repository diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index d0cc2aef..7024bf75 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -25,12 +25,12 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Checkout casket-ssg - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/casket-ssg ref: cec3c20d80ea1dc93660b69a4e7b38aa49f2a56b # standalone build; optional liblol bridge @@ -38,7 +38,7 @@ jobs: persist-credentials: false - name: Cache Cabal - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6.1.0 with: path: | ~/.cabal/packages @@ -48,7 +48,7 @@ jobs: # Explicitly allowed by repository policy; actions.lock pins its commit. - name: Select tested Haskell toolchain - uses: haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d # v2.12.0 + uses: haskell-actions/setup@v2.12.0 with: ghc-version: '9.6.6' cabal-version: '3.10.3.0' @@ -116,10 +116,10 @@ jobs: touch ../_site/.nojekyll - name: Setup Pages - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 + uses: actions/configure-pages@v6.0.0 - name: Upload artifact - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 + uses: actions/upload-pages-artifact@v5.0.0 with: path: '_site' @@ -134,7 +134,7 @@ jobs: contents: read steps: - name: Download Pages artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@v8.0.1 with: name: github-pages path: .pages-preview @@ -203,4 +203,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 + uses: actions/deploy-pages@v5.0.1 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7411d63f..775f6814 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -45,15 +45,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 + uses: github/codeql-action/init@v4.38.0 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 + uses: github/codeql-action/analyze@v4.38.0 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 5f9cd583..364ee867 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -30,7 +30,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Check for A2ML files id: detect @@ -47,7 +47,7 @@ jobs: - name: Validate A2ML manifests if: steps.detect.outputs.count > 0 - uses: hyperpolymath/deed-ecosystem/validate-action@ed83d6927e8fb21431e403dbf6d7a4af96772746 # main + uses: hyperpolymath/deed-ecosystem/validate-action@main with: path: '.' strict: 'false' @@ -92,7 +92,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Check for K9 files id: detect @@ -109,7 +109,7 @@ jobs: - name: Validate K9 contracts if: steps.detect.outputs.k9_count > 0 - uses: hyperpolymath/k9-ecosystem/validate-action@c1a34884054fabf0e9de81dbf68f4ba7874e85f1 # main + uses: hyperpolymath/k9-ecosystem/validate-action@main with: path: '.' strict: 'false' @@ -142,7 +142,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Scan for invisible characters id: lint @@ -207,7 +207,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Check for Groove manifest id: groove @@ -268,7 +268,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Generate dogfooding scorecard run: | diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index db0e762b..ea6cd245 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: Install PyYAML (for workflow YAML validation) run: pip install pyyaml --quiet - name: Run E2E tests diff --git a/.github/workflows/hypatia-dispatch-intake.yml b/.github/workflows/hypatia-dispatch-intake.yml index a6833012..4a2d6c0d 100644 --- a/.github/workflows/hypatia-dispatch-intake.yml +++ b/.github/workflows/hypatia-dispatch-intake.yml @@ -25,7 +25,7 @@ jobs: contents: write # push received events to the findings-submissions inbox branch steps: - name: Checkout gitbot-fleet - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/inbox-steward.yml b/.github/workflows/inbox-steward.yml index 154dc014..7900afba 100644 --- a/.github/workflows/inbox-steward.yml +++ b/.github/workflows/inbox-steward.yml @@ -291,7 +291,7 @@ jobs: steps: - name: Checkout gitbot-fleet - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 @@ -380,7 +380,7 @@ jobs: steps: - name: Checkout gitbot-fleet - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Send dispatch to Hypatia env: diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 51aa220c..7fb72702 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -29,7 +29,7 @@ jobs: steps: - name: Trigger Propagation if: env.HAS_TOKEN == 'true' - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 + uses: peter-evans/repository-dispatch@v4.0.1 with: token: ${{ secrets.FARM_DISPATCH_TOKEN }} repository: hyperpolymath/.git-private-farm diff --git a/.github/workflows/learning-loop.yml b/.github/workflows/learning-loop.yml index a8718714..c99eaabb 100644 --- a/.github/workflows/learning-loop.yml +++ b/.github/workflows/learning-loop.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Checkout gitbot-fleet - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: lfs: true # shared-context/learning/*.jsonl is LFS-tracked (Item 60) @@ -42,7 +42,7 @@ jobs: - name: Upload rule proposals if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@v7.0.1 with: name: rule-proposals path: shared-context/learning/rule-proposals/*.lgt diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 1b95e7a6..cd078a1c 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -23,9 +23,9 @@ jobs: image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff steps: - name: Checkout Site - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Checkout Ddraig SSG - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/ddraig-ssg path: .ddraig-ssg @@ -42,7 +42,7 @@ jobs: fi ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/} - name: Upload artifact - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 + uses: actions/upload-pages-artifact@v5.0.0 with: path: '_site' deploy: @@ -55,4 +55,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 + uses: actions/deploy-pages@v5.0.1 diff --git a/.github/workflows/panicbot-sweep.yml b/.github/workflows/panicbot-sweep.yml index 5ee549d5..b8b3da9c 100644 --- a/.github/workflows/panicbot-sweep.yml +++ b/.github/workflows/panicbot-sweep.yml @@ -42,17 +42,17 @@ jobs: steps: - name: Checkout gitbot-fleet - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master + uses: dtolnay/rust-toolchain@v1 with: toolchain: master with: toolchain: stable - name: Cache Rust dependencies - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + uses: Swatinem/rust-cache@v2.9.2 with: workspaces: | bots/panicbot -> target @@ -130,7 +130,7 @@ jobs: - name: Upload findings artifact if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@v7.0.1 with: name: panicbot-sweep-findings path: shared-context/findings/ diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 5d5272ff..8a96bf98 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -41,7 +41,7 @@ jobs: timeout-minutes: 5 steps: - name: Send push notification email - uses: hyperpolymath/smtp-notify-action@22e7bdb322c430c1d0dac6b3bb307f4bb139d0be # NOSONAR — pin authority is actions.lock (sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7) + uses: hyperpolymath/smtp-notify-action@v0.3.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/repo-integrity-guard.yml b/.github/workflows/repo-integrity-guard.yml index d0224cc8..b0fc5733 100644 --- a/.github/workflows/repo-integrity-guard.yml +++ b/.github/workflows/repo-integrity-guard.yml @@ -38,7 +38,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout (full history) - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 lfs: true # shared-context/learning/*.jsonl is LFS-tracked (Item 60) diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 8c059f3a..c034b328 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -49,7 +49,7 @@ jobs: run: working-directory: ${{ matrix.dir }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: Canon pin drift (rhodibot) # The rule set is copied from hyperpolymath/standards and pinned by # digest. This fails when the canon has moved since that pin, so a rule @@ -79,7 +79,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - run: bash scripts/tests/dispatch-paths.sh @@ -92,7 +92,7 @@ jobs: run: working-directory: bots/gsbot steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Install native TLS build dependencies diff --git a/.github/workflows/supervised-fleet-scan.yml b/.github/workflows/supervised-fleet-scan.yml index d24bd456..cb06008e 100644 --- a/.github/workflows/supervised-fleet-scan.yml +++ b/.github/workflows/supervised-fleet-scan.yml @@ -35,7 +35,7 @@ jobs: steps: - name: Checkout gitbot-fleet - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: lfs: true # shared-context/learning/*.jsonl is LFS-tracked (Item 60)