Skip to content

fix(ci): unbreak workflow YAML and add a complete actions.lock #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 1 commit into from
Aug 27, 2026
Merged

fix(ci): unbreak workflow YAML and add a complete actions.lock #57

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions .github/workflows/abi-ffi-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# abi-ffi-gate.yml — enforce that the Zig FFI conforms to the Idris2 ABI.
#
# The Idris2 ABI (src/interface/abi) is the source of truth. This gate fails if
Expand All @@ -20,15 +21,15 @@ jobs:
name: ABI ↔ FFI structural conformance
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@v7.0.1
- name: Run ABI-FFI gate
run: python3 scripts/abi-ffi-gate.py

zig-build:
name: Zig FFI builds + tests (Zig 0.14.0)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@v7.0.1
- name: Install Zig 0.14.0
run: |
curl -fsSL https://ziglang.org/download/0.14.0/zig-linux-x86_64-0.14.0.tar.xz -o /tmp/zig.tar.xz
Expand Down
26 changes: 17 additions & 9 deletions .github/workflows/actions.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,14 @@
# Docs: https://gh.io/actions-lockfile
version: 'v0.0.2'
workflows:
'.github/workflows/governance.yml': []
'.github/workflows/hypatia-scan.yml': []
'.github/workflows/mirror.yml': []
'.github/workflows/rust-ci.yml': []
'.github/workflows/scorecard.yml': []
'.github/workflows/secret-scanner.yml': []
'.github/workflows/abi-ffi-gate.yml':
- 'actions/checkout@v7.0.1'
'.github/workflows/boj-build.yml':
- 'actions/checkout@v7.0.1'
'.github/workflows/casket-pages.yml':
Expand All @@ -11,10 +19,10 @@ workflows:
- 'actions/configure-pages@v6.0.0'
- 'actions/deploy-pages@v5.0.0'
- 'actions/upload-pages-artifact@v5.0.0'
- 'haskell-actions/setup@v2.11.0'
- 'haskell-actions/setup@v2.12.0'
'.github/workflows/codeql.yml':
- 'actions/checkout@v7.0.1'
- 'github/codeql-action@v4.37.3'
- 'github/codeql-action@v4.37.7'
'.github/workflows/dogfood-gate.yml':
- 'actions/checkout@v7.0.1'
'.github/workflows/instant-sync.yml':
Expand Down Expand Up @@ -77,22 +85,22 @@ dependencies:
- 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
'dawidd6/action-send-mail@v3.12.0':
ref: 'v3.12.0'
commit: 'sha1-12335b969ae3fb71bee5f2c6b829744261aec34c'
commit: 'sha1-0bbdab096651ee93f37ec02383e088183d41ff0b'
owner_id: 9713907
repo_id: 222439721
'erlef/setup-beam@v1.24.1':
ref: 'v1.24.1'
commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
owner_id: 47606891
repo_id: 331103973
'github/codeql-action@v4.37.3':
ref: 'v4.37.3'
commit: 'sha1-e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81'
'github/codeql-action@v4.37.7':
ref: 'v4.37.7'
commit: 'sha1-ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd'
owner_id: 9919
repo_id: 259445878
'haskell-actions/setup@v2.11.0':
ref: 'v2.11.0'
commit: 'sha1-cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553'
'haskell-actions/setup@v2.12.0':
ref: 'v2.12.0'
commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d'
owner_id: 75048950
repo_id: 623796603
'peter-evans/repository-dispatch@v4.0.1':
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/boj-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.

@codacy-production codacy-production Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚪ LOW RISK

Nitpick: Line 2 already contains this management comment; this addition is redundant. Please remove the duplicate line.

Suggested change
# This workflow is managed by gh actions-lock.

name: BoJ Server Build Trigger
on:
push:
Expand All @@ -10,7 +11,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v7
uses: actions/checkout@v7.0.1
- name: Trigger BoJ Server (Casket/ssg-mcp)
run: |
# Send a secure trigger to boj-server to build this repository
Expand Down
5 changes: 3 additions & 2 deletions .github/workflows/casket-pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.
name: GitHub Pages

on:
Expand All @@ -21,10 +22,10 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v7
uses: actions/checkout@v7.0.1

- name: Checkout casket-ssg
uses: actions/checkout@v7
uses: actions/checkout@v7.0.1
with:
repository: hyperpolymath/casket-ssg
path: .casket-ssg
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.
name: CodeQL Security Analysis

on:
Expand Down Expand Up @@ -36,7 +37,7 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v7
uses: actions/checkout@v7.0.1

- name: Initialize CodeQL
uses: github/codeql-action/init@v4.37.7
Expand Down
13 changes: 7 additions & 6 deletions .github/workflows/dogfood-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.

@codacy-production codacy-production Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚪ LOW RISK

Nitpick: Line 2 already contains this management comment; this addition is redundant.

# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
#
# dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate
Expand All @@ -26,7 +27,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v7
uses: actions/checkout@v7.0.1

- name: Check for A2ML files
id: detect
Expand Down Expand Up @@ -66,7 +67,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v7
uses: actions/checkout@v7.0.1

- name: Check for K9 files
id: detect
Expand Down Expand Up @@ -111,7 +112,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v7
uses: actions/checkout@v7.0.1

- name: Scan for invisible characters
id: lint
Expand Down Expand Up @@ -175,7 +176,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v7
uses: actions/checkout@v7.0.1

- name: Check for Groove manifest
id: groove
Expand Down Expand Up @@ -233,7 +234,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v7
uses: actions/checkout@v7.0.1

- name: Check and validate eclexiaiser manifest
id: eclex
Expand Down Expand Up @@ -298,7 +299,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v7
uses: actions/checkout@v7.0.1

- name: Generate dogfooding scorecard
run: |
Expand Down
4 changes: 3 additions & 1 deletion .github/workflows/governance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.
name: Governance

on:
Expand All @@ -10,8 +11,9 @@ on:
workflow_dispatch:

permissions:
actions: read
contents: read

jobs:
governance:
uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
4 changes: 3 additions & 1 deletion .github/workflows/hypatia-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.
name: Hypatia Security Scan

on:
Expand All @@ -12,9 +13,10 @@ on:
workflow_dispatch:

permissions:
actions: read
contents: read
security-events: write

jobs:
scan:
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
1 change: 1 addition & 0 deletions .github/workflows/instant-sync.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.
# Instant Forge Sync - Triggers propagation to all forges on push/release
name: Instant Sync

Expand Down
4 changes: 3 additions & 1 deletion .github/workflows/mirror.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.

@codacy-production codacy-production Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚪ LOW RISK

Nitpick: Line 2 already contains this management comment; this addition is redundant.

name: Mirror to Git Forges

on:
Expand All @@ -8,9 +9,10 @@ on:
workflow_dispatch:

permissions:
actions: read
contents: read

jobs:
mirror:
uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
secrets: inherit
3 changes: 2 additions & 1 deletion .github/workflows/push-email-notify.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# Dormant push-email notification. ARMED by setting the repo variable
# PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
# sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by
Expand All @@ -15,7 +16,7 @@
runs-on: ubuntu-latest
steps:
- name: Send push notification email
uses: dawidd6/action-send-mail@0bbdab096651ee93f37ec02383e088183d41ff0b # pinned
uses: dawidd6/action-send-mail@v3.12.0

Check failure on line 19 in .github/workflows/push-email-notify.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=hyperpolymath_halideiser&issues=AaBBoOWp8eb3pDCGsia-&open=AaBBoOWp8eb3pDCGsia-&pullRequest=57

Check warning on line 19 in .github/workflows/push-email-notify.yml

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

.github/workflows/push-email-notify.yml#L19 

An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.

@codacy-production codacy-production Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 HIGH RISK

Reverting from a commit SHA to a version tag reduces the security of the workflow. While version tags are human-readable, they are mutable; pinning to a full-length SHA ensures that the workflow remains immutable and protects against potential supply-chain attacks where a tag could be redirected to malicious code.

See Issue in Codacy

with:
server_address: ${{ secrets.SMTP_HOST }}
server_port: ${{ secrets.SMTP_PORT }}
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
#
# Release workflow — triggered by version tags (v*).
Expand All @@ -22,7 +23,7 @@ jobs:
permissions:
contents: read
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@v7.0.1

- name: Build
run: |
Expand All @@ -49,7 +50,7 @@ jobs:
changelog: ${{ steps.cliff.outputs.content }}
version: ${{ steps.version.outputs.version }}
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@v7.0.1
with:
fetch-depth: 0

Expand Down Expand Up @@ -92,7 +93,7 @@ jobs:
permissions:
contents: write
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@v7.0.1

# TODO: Download build artifacts if uploading to the release
# - uses: actions/download-artifact@v4
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/rhodibot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.
# rhodibot.yml — Automated RSR compliance enforcement
#
# Reads root-hygiene rules and auto-fixes what it can:
Expand Down Expand Up @@ -30,7 +31,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v7
uses: actions/checkout@v7.0.1
with:
fetch-depth: 1

Expand Down
4 changes: 3 additions & 1 deletion .github/workflows/rust-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.

@codacy-production codacy-production Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚪ LOW RISK

Nitpick: Line 2 already contains this management comment; this addition is redundant.

# Rust CI — thin wrapper calling the shared estate reusable in
# hyperpolymath/standards. Configure once, propagate everywhere.
# See: docs/CI-REUSABLE-WORKFLOWS.adoc in standards.
Expand All @@ -11,8 +12,9 @@ on:
pull_request:

permissions:
actions: read
contents: read

jobs:
rust-ci:
uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
4 changes: 3 additions & 1 deletion .github/workflows/scorecard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.
name: OSSF Scorecard

on:
Expand All @@ -8,8 +9,9 @@ on:
workflow_dispatch:

permissions:
actions: read
contents: read

jobs:
scorecard:
uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
4 changes: 3 additions & 1 deletion .github/workflows/secret-scanner.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.
name: Secret Scanner

on:
Expand All @@ -12,9 +13,10 @@ concurrency:
cancel-in-progress: true

permissions:
actions: read
contents: read

jobs:
scan:
uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
secrets: inherit
Loading
Loading