fix(ci): declare the six reusable-workflow callers in actions.lock - #12
Closed
hyperpolymath wants to merge 3 commits into
Closed
fix(ci): declare the six reusable-workflow callers in actions.lock#12hyperpolymath wants to merge 3 commits into
hyperpolymath wants to merge 3 commits into
Conversation
Four active workflows here fail with startup_failure — rejected before any job runs, so no check run and no logs. Cause: actions.lock's workflows map has no entry for six workflows that call a reusable workflow from hyperpolymath/standards: governance.yml -> governance-reusable.yml@81dbf2dd hypatia-scan.yml -> hypatia-scan-reusable.yml@81dbf2dd mirror.yml -> mirror-reusable.yml@d135b05b rust-ci.yml -> rust-ci-reusable.yml@412a7031 scorecard.yml -> scorecard-reusable.yml@81dbf2dd secret-scanner.yml -> secret-scanner-reusable.yml@c65436ee A reusable-workflow CALLER needs its own key in the lock even when it pins no third-party actions. An absent key and an under-declared one both kill the run at startup. 'gh actions-lock' does not add caller keys, so regenerating the lock — which fixed the codeql drift elsewhere in this estate — does not fix this shape. The entries have to be hand-added. Each of the six was checked for non-reusable 'uses:' first; all six have none, so '[]' is the correct value rather than a populated list. Verified: the file still parses as YAML and the workflows map now has 32 keys, matching the 32 workflow files in .github/workflows/. Distinct from the Dependabot lock-drift class fixed across eight repos yesterday (IDApTIK#99, burble#198, cadastra#35, canonical-ums#17, chronicles-of-slavia#75, gossamer#157, progblocks#25, stapeln#37).
Correcting the previous commit on this branch. It declared the six
reusable-workflow callers as '[]', which does NOT clear startup_failure.
Established by paired control against a repo where the same workflow now
runs. metadatastician/gossamer, Governance = 'failure' (i.e. it executes):
'.github/workflows/governance.yml':
- 'hyperpolymath/standards@6208833f327ea18f58f558762dbed9bc0effc049'
and gossamer's governance.yml calls
governance-reusable.yml@6208833f327ea18f58f558762dbed9bc0effc049 - so the
lock entry MIRRORS THE PIN.
Against metadatastician/harvard-dehallucinator, Governance = startup_failure,
whose lock has exactly '.github/workflows/governance.yml': []. Freshly
dispatched runs there still startup_failure, so this is a live difference and
not a stale latest-run artefact.
So the rule is: a reusable-workflow caller's lock entry must list
'<owner>/<repo>@<sha>' of the called workflow's source repository, matching
the pin in the workflow file. '[]' is only correct for a workflow that calls
nothing at all.
Each of the six now names hyperpolymath/standards at the SHA its own workflow
pins - three distinct SHAs across the six, not one.
|
|
|
Contributor
Author
|
Closing: the theory behind this PR was disproved by measurement. I proposed that reusable-workflow caller entries in So the lockfile is not the cause for this shape, and this change would have been churn. The genuine lock-drift class is separate and is fixed and merged (8 repos yesterday, plus paint-type and svalinn today). The remaining diagnostic for this shape is the GitHub web-UI red banner on a failing run, which is the one channel known to state the reason. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Four active workflows fail with
startup_failure— rejected before any job runs, so no check run and no logs.Cause:
actions.lock'sworkflowsmap has no key for six workflows that call a reusable workflow fromhyperpolymath/standards(governance,hypatia-scan,mirror,rust-ci,scorecard,secret-scanner).A reusable-workflow caller needs its own key even when it pins no third-party actions. An absent key and an under-declared one both kill the run at startup.
⚠
gh actions-lockdoes not add caller keys — so regenerating the lock, which fixed the codeql drift across eight other repos here, does not fix this shape. These have to be hand-added.Each of the six was checked for non-reusable
uses:first; all six have none, so[]is correct rather than a populated list.Verified: the file still parses as YAML, and the
workflowsmap now has 32 keys matching the 32 files in.github/workflows/.