chore(ci): generate actions.lock ahead of the 2026-10-01 lock gate

[hyperpolymath]

Summary

• Adds .github/workflows/actions.lock. It was generated by gh actions-lock --no-narrow v0.1.6 from the refs already SHA-pinned here, so no uses: line changes.
• Moves the tool's banner to line 2 in each workflow, keeping SPDX on line 1.

Why

From 2026-10-01 the governance "Actions lockfile verify" gate fails any repo that lacks a lockfile. Changing the date on standards main would not help, because this repo pins the reusable workflow by SHA.

Verification

• The gate script at the pinned standards SHA passes with LOCK_TODAY=2026-10-01.
• This PR's own runs are the runtime test. Every workflow must create jobs, with no startup_failure.

🤖 Generated with Claude Code

https://claude.ai/code/session_019aa9y32JcBuZ85KXe2jb8R

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: f23a07f9-7c47-473e-b113-cd7d37dc7cd0

📥 Commits

Reviewing files that changed from the base of the PR and between 1a35f8f and 536f8d8.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (10)

• .github/workflows/codeql.yml
• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/label-triage.yml
• .github/workflows/labels.yml
• .github/workflows/mirror.yml
• .github/workflows/publish-container.yml
• .github/workflows/push-email-notify.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (19)

• GitHub Check: semgrep-cloud-platform/scan
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: governance / Actions lockfile verify
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Debt ratchet
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: scan / rust-secrets
• GitHub Check: scan / gitleaks
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: Analyze (actions)

⚠️ CI failures not shown inline (7)

GitHub Actions: Governance / 1_governance _ Well-Known (RFC 9116 + RSR).txt: chore(ci): generate actions.lock ahead of the 2026-10-01 lock gate

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

---

GitHub Actions: Governance / 3_governance _ Security policy checks.txt: chore(ci): generate actions.lock ahead of the 2026-10-01 lock gate

Conclusion: failure

View job details

##[group]Run FAILED=false
 �[36;1mFAILED=false�[0m
 �[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
 �[36;1m  echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
 �[36;1m  echo "$WEAK_CRYPTO"�[0m
 �[36;1mfi�[0m
 �[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
 �[36;1m  echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
 �[36;1m  echo "$HTTP_URLS"�[0m
 �[36;1mfi�[0m
 �[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
 �[36;1mif [ -n "$SECRETS" ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

---

GitHub Actions: Governance / 4_governance _ Language _ package anti-pattern policy.txt: chore(ci): generate actions.lock ahead of the 2026-10-01 lock gate

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
 �[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
 �[36;1m   && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-ts-allowlist.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

---

GitHub Actions: Governance / 6_governance _ Licence consistency.txt: chore(ci): generate actions.lock ahead of the 2026-10-01 lock gate

Conclusion: failure

View job details

##[group]Run bash standards/scripts/check-licence-consistency.sh caller
 �[36;1mbash standards/scripts/check-licence-consistency.sh caller�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 [OK] LICENSE file found: LICENSE
 [OK] LICENSE has no SPDX header, but its body is verbatim MPL-2.0 text — accepted as a canonical licence file.
 [OK] Manifest licence (mix.exs): PMPL-1.0-or-later
 [ERROR] Licence-vs-manifest mismatch: licence='MPL-2.0' manifest='PMPL-1.0-or-later' (mix.exs).
 [OK] No stray retired-estate SPDX headers (PMPL-1.0*/MPL-1.0*/MPL-1.1) in the tree.
 [ERROR] Licence consistency check failed. See messages above.
 ##[error]Process completed with exit code 1.

---

GitHub Actions: Governance / governance _ Licence consistency: chore(ci): generate actions.lock ahead of the 2026-10-01 lock gate

Conclusion: failure

View job details

##[group]Run bash standards/scripts/check-licence-consistency.sh caller
 �[36;1mbash standards/scripts/check-licence-consistency.sh caller�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 [OK] LICENSE file found: LICENSE
 [OK] LICENSE has no SPDX header, but its body is verbatim MPL-2.0 text — accepted as a canonical licence file.
 [OK] Manifest licence (mix.exs): PMPL-1.0-or-later
 [ERROR] Licence-vs-manifest mismatch: licence='MPL-2.0' manifest='PMPL-1.0-or-later' (mix.exs).
 [OK] No stray retired-estate SPDX headers (PMPL-1.0*/MPL-1.0*/MPL-1.1) in the tree.
 [ERROR] Licence consistency check failed. See messages above.
 ##[error]Process completed with exit code 1.

---

GitHub Actions: Governance / 11_governance _ Workflow security linter.txt: chore(ci): generate actions.lock ahead of the 2026-10-01 lock gate

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

---

GitHub Actions: Governance / 12_governance _ Actions lockfile verify.txt: chore(ci): generate actions.lock ahead of the 2026-10-01 lock gate

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at job.workflow_sha failed?)"�[0m

🔇 Additional comments (10)

.github/workflows/codeql.yml (1)

2-2: LGTM!

.github/workflows/governance.yml (1)

2-2: LGTM!

.github/workflows/hypatia-scan.yml (1)

2-2: LGTM!

.github/workflows/label-triage.yml (1)

2-2: LGTM!

.github/workflows/labels.yml (1)

2-2: LGTM!

.github/workflows/mirror.yml (1)

2-2: LGTM!

.github/workflows/publish-container.yml (1)

2-2: LGTM!

.github/workflows/push-email-notify.yml (1)

2-2: LGTM!

.github/workflows/scorecard.yml (1)

2-2: LGTM!

.github/workflows/secret-scanner.yml (1)

2-2: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Documentation
  • Added notes clarifying that automated repository workflows are managed by a locking tool. Workflow behaviour is unchanged.

Walkthrough

Ten GitHub Actions workflow files now include comments stating that gh actions-lock manages them. No executable workflow settings changed.

Changes

Workflow management comments

Layer / File(s)	Summary
Mark workflows as managed .github/workflows/codeql.yml, .github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/label-triage.yml, .github/workflows/labels.yml, .github/workflows/mirror.yml, .github/workflows/publish-container.yml, .github/workflows/push-email-notify.yml, .github/workflows/scorecard.yml, .github/workflows/secret-scanner.yml	Each workflow now has a comment identifying it as managed by gh actions-lock. Executable workflow configuration is unchanged.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Suggested reviewers: metadatastician

Merge Risk: ⚪ Minimal · up to 536f8

These changes do not alter workflow execution, and the lockfile omissions identified during review do not violate the inspected gate contract. No actionable merge-blocking issue remains.

Architecture Summary

Architecture risk: 🔵 Low · up to 536f8

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/codeql.yml: Added a comment identifying the workflow as managed by gh actions-lock.
• observed — Modified behavior in .github/workflows/governance.yml: Added a comment identifying the workflow as managed by gh actions-lock.
• observed — Modified behavior in .github/workflows/hypatia-scan.yml: Added a comment declaring that the workflow is managed by gh actions-lock.
• observed — Modified behavior in .github/workflows/label-triage.yml: Added a comment identifying the workflow as managed by gh actions-lock.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: generating actions.lock before the 2026-10-01 lock gate. It is concise and specific.
Description check	✅ Passed	The description directly explains the lockfile generation, workflow banner changes, deadline, rationale, and verification performed.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit reads the workflow page,
Ten comments mark the files with care.
No tasks have changed beneath the text,
The hare hops on, content and blessed.
The lock tool’s name is noted there.}

_{Comment @coderabbitai help to get the list of available commands.}