fix(ci): regenerate actions.lock + repoint a nonexistent ruby pin - #16
Merged
Conversation
Two causes, both diagnosed against metadatastician-governance#24. 1. LOCKFILE VERSION DRIFT (12 entries). Dependabot bumped actions in the workflows; actions.lock was never regenerated, so each workflow requested a version the lock did not record and died at startup_failure with zero jobs. The drift detector's output named exactly the workflows that were dead -- ts-blocker.yml, guix-nix-policy.yml, npm-bun-blocker.yml, jekyll-gh-pages.yml -- which is what identified the cause rather than guessing at it. 2. A PHANTOM ACTION SHA. jekyll.yml pinned ruby/setup-ruby@f8cf14e (commented '# v1.210.0'). That commit DOES NOT EXIST in ruby/setup-ruby -- 'gh api .../commits/<sha>' returns 422, and gh actions-lock refused to resolve it. A workflow that cannot resolve an action can never start. Repointed to v1.321.0 (95ef2b04...), verified to exist. Same class as the standards phantom SHA 5b1d0022 fixed estate-wide on 2026-08-25: a plausible-looking 40-hex string that resolves to nothing. After both fixes: 32/32 lockfile coverage, drift detector clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| steps: | ||
| - uses: actions/checkout@v7.0.1 | ||
| - uses: ruby/setup-ruby@f8cf14e635c2ba2c0f287d9b0c5f442c52c91bee # v1.210.0 | ||
| - uses: ruby/setup-ruby@v1.321.0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two causes, both diagnosed against metadatastician/metadatastician-governance#24.
1. Lockfile version drift — 12 entries
Dependabot bumped actions in the workflows;
actions.lockwas never regenerated. Each affected workflow then requested a version the lock did not record and died atstartup_failurewith zero jobs.The detector named exactly the workflows that were dead —
ts-blocker.yml,guix-nix-policy.yml,npm-bun-blocker.yml,jekyll-gh-pages.yml. That match is what identified the cause rather than guessing at it.2. A phantom action SHA
jekyll.ymlpinned:That commit does not exist.
gh api repos/ruby/setup-ruby/commits/<sha>returns 422, andgh actions-lockrefused to resolve it. A workflow that cannot resolve an action can never start.Repointed to v1.321.0 (
95ef2b04…), verified present.Same class as the
standardsphantom SHA5b1d0022fixed estate-wide on 2026-08-25 — a plausible-looking 40-hex string that resolves to nothing.After
🤖 Generated with Claude Code