Symptom
code-hygiene-self-test.yml's test job dies in prepare, before a single
step runs:
Download action repository 'hyperpolymath/cicd-suite@c5270b0e0a0a7177d6ee77fc4451f38978b612f0'
##[error]lockfile missing pin for hyperpolymath/deed-ecosystem@f9d999b60cb5f383679ea19912bcdc49c944973a
Measured on run 35784511114 (branch fix/composite-shell-e-kills-valid-repos).
Cause
.github/workflows/actions.lock records the transitive edges of
hyperpolymath/cicd-suite@main:
'hyperpolymath/cicd-suite@main':
commit: 'sha1-9adb3908d60690dbd6a302f634b914a279f6812e'
uses:
- 'hyperpolymath/deed-ecosystem@f9d999b6...'
- 'hyperpolymath/k9-ecosystem@2155aa26...'Two things are wrong with that:
- The
@main pin is stale — it names 9adb3908, while main is at
6ff6057.
- The workflow does not resolve to
@main. Its steps use
$/actions/manifest-check, which GitHub resolves to
hyperpolymath/cicd-suite@<head SHA>. On a PR branch that head SHA is never
@main, so there is no lock entry for it, its transitive uses: are
unknown, and deed-ecosystem reads as unpinned.
This is why the workflow has been green on main and red or absent on branches:
the self-test is effectively only ever measured after merge, never on the PR
that changes it.
Why it matters beyond this workflow
The job dies before any step executes, so every control in it reports
nothing while looking like an ordinary red. That is the same shape as the defect
in #32: a failure upstream of the thing being measured. #32 therefore moves the
new shell-contract suite into its own job so it cannot be masked this way — but
the six controls still inside test remain unmeasured on every PR branch until
this is fixed.
Fix (not attempted here)
Regenerate the lockfile so it is transitively closed for the self-referential
$/actions/... form. Notes for whoever takes it:
- The file is machine generated.
gh actions-lock rewrite mode has a
recorded history in this estate of de-pinning SHAs to tags and inventing
invalid local refs, so verify its output rather than trusting rc=0 — and note
gh actions-lock --no-fix has been observed to exit 0 while printing
"lockfile is unreadable".
- Acceptance is a run, not a file: the
test job must reach and execute its
steps on a PR branch, not merely on main.
Refs: #787
Found while landing #32.
🤖 Generated with Claude Code
https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f
Symptom
code-hygiene-self-test.yml'stestjob dies inprepare, before a singlestep runs:
Measured on run
35784511114(branchfix/composite-shell-e-kills-valid-repos).Cause
.github/workflows/actions.lockrecords the transitive edges ofhyperpolymath/cicd-suite@main:Two things are wrong with that:
@mainpin is stale — it names9adb3908, whilemainis at6ff6057.@main. Its steps use$/actions/manifest-check, which GitHub resolves tohyperpolymath/cicd-suite@<head SHA>. On a PR branch that head SHA is never@main, so there is no lock entry for it, its transitiveuses:areunknown, and
deed-ecosystemreads as unpinned.This is why the workflow has been green on
mainand red or absent on branches:the self-test is effectively only ever measured after merge, never on the PR
that changes it.
Why it matters beyond this workflow
The job dies before any step executes, so every control in it reports
nothing while looking like an ordinary red. That is the same shape as the defect
in #32: a failure upstream of the thing being measured.
#32therefore moves thenew shell-contract suite into its own job so it cannot be masked this way — but
the six controls still inside
testremain unmeasured on every PR branch untilthis is fixed.
Fix (not attempted here)
Regenerate the lockfile so it is transitively closed for the self-referential
$/actions/...form. Notes for whoever takes it:gh actions-lockrewrite mode has arecorded history in this estate of de-pinning SHAs to tags and inventing
invalid local refs, so verify its output rather than trusting rc=0 — and note
gh actions-lock --no-fixhas been observed to exit 0 while printing"lockfile is unreadable".
testjob must reach and execute itssteps on a PR branch, not merely on
main.Refs: #787
Found while landing #32.
🤖 Generated with Claude Code
https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f