chore(ci): generate actions.lock ahead of the 2026-10-01 lock gate

[hyperpolymath]

Summary

• Adds .github/workflows/actions.lock. It was generated by gh actions-lock --no-narrow v0.1.6 from the refs already SHA-pinned here, so no uses: line changes.
• Moves the tool's banner to line 2 in each workflow, keeping SPDX on line 1.

Why

From 2026-10-01 the governance "Actions lockfile verify" gate fails any repo that lacks a lockfile. Changing the date on standards main would not help, because this repo pins the reusable workflow by SHA.

Verification

• The gate script at the pinned standards SHA passes with LOCK_TODAY=2026-10-01.
• This PR's own runs are the runtime test. Every workflow must create jobs, with no startup_failure.

🤖 Generated with Claude Code

https://claude.ai/code/session_019aa9y32JcBuZ85KXe2jb8R

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 6 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ea071473-1d2b-4b64-8920-e3d81cbd84f0

📥 Commits

Reviewing files that changed from the base of the PR and between 1efd1d8 and 73f3d03.

⛔ Files ignored due to path filters (2)

• .github/workflows/actions.lock is excluded by !**/*.lock
• ffi/zig/src/testdata/toc.pdf is excluded by !**/*.pdf

📒 Files selected for processing (21)

• .github/workflows/boj-build.yml
• .github/workflows/casket-pages.yml
• .github/workflows/codeql.yml
• .github/workflows/dogfood-gate.yml
• .github/workflows/governance.yml
• .github/workflows/hpc-ci.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/instant-sync.yml
• .github/workflows/label-triage.yml
• .github/workflows/labels.yml
• .github/workflows/mirror.yml
• .github/workflows/push-email-notify.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml
• .github/workflows/workflow-linter.yml
• ffi/zig/src/gpu_ocr.zig
• ffi/zig/src/ml_inference.zig
• ffi/zig/src/stages.zig
• ffi/zig/test/integration_test.zig
• src/chapel/FFIBridge.chpl
• src/chapel/smoke.chpl

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6583fe30-0a8b-4d02-97fb-e7c2106f70e4

📥 Commits

Reviewing files that changed from the base of the PR and between fcb2767 and 1efd1d8.

⛔ Files ignored due to path filters (2)

• .github/workflows/actions.lock is excluded by !**/*.lock
• ffi/zig/src/testdata/toc.pdf is excluded by !**/*.pdf

📒 Files selected for processing (2)

• src/chapel/FFIBridge.chpl
• src/chapel/smoke.chpl

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (26)

• GitHub Check: scan / shell-secrets
• GitHub Check: scan / rust-secrets
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: scan / gitleaks
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Debt ratchet
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Actions lockfile verify
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: Zig FFI Build & Test
• GitHub Check: Validate DEED manifests
• GitHub Check: Validate K9 contracts
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: analyze (actions, none)
• GitHub Check: lint-workflows
• GitHub Check: Groove manifest check
• GitHub Check: semgrep-cloud-platform/scan

🔇 Additional comments (2)

src/chapel/FFIBridge.chpl (1)

15-17: LGTM!

Also applies to: 188-188, 254-254, 256-256, 287-287, 351-351, 354-354

src/chapel/smoke.chpl (1)

42-60: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • Improved PDF outline handling, including nested titles and PDFs without outlines.
• Documentation
  • Added notes clarifying that automated workflows are managed by a workflow-locking tool. Workflow behaviour is unchanged.
• Compatibility
  • Improved consistency between application records and their C counterparts, with additional checks to verify record sizes and padding values.

Walkthrough

Added management comments to 15 GitHub Actions workflows. Updated Zig FFI declarations and TOC iterator handling, integration-test path usage, and Chapel FFI padding bindings and smoke checks.

Changes

Workflow management markers

Layer / File(s)	Summary
Mark workflows as managed .github/workflows/*.yml	Added a comment identifying each of the 15 workflows as managed by gh actions-lock. No executable workflow behaviour changed.

Zig FFI updates

Layer / File(s)	Summary
Update exported declarations ffi/zig/src/gpu_ocr.zig, ffi/zig/src/ml_inference.zig	Changed four C-ABI declarations from export fn to pub export fn. Signatures and implementations remain unchanged.
Handle nullable TOC iterators ffi/zig/src/stages.zig	Updated TOC iterator handling to use optional binding. Added a test for nested outline titles and depths, and for a PDF without outlines.
Pass null-terminated paths directly ffi/zig/test/integration_test.zig	Updated integration tests to pass null-terminated paths directly to filesystem functions instead of converting them with std.mem.span.

Chapel FFI layout checks

Layer / File(s)	Summary
Bind Chapel padding fields to C members src/chapel/FFIBridge.chpl	Mapped Chapel padding fields to C members _pad and _pad2. Field types and sizes remain unchanged.
Check FFI record sizes and defaults src/chapel/smoke.chpl	Added checks that four Chapel record sizes match their C sizes and that selected padding fields are zero.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 1efd1

The reviewed changes preserve workflow behavior and the examined FFI bindings and paths match their contracts. No identified issue warrants delaying merge.

Architecture Summary

Architecture risk: 🔵 Low · up to 1efd1

The change affects 2 systems.

Changed systems: ffi, src

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — ffi (service) was modified; 4 changed files map to changed impact.
• observed — src (service) was modified; 2 changed files map to changed impact.

Before / after behavior

• observed — Modified behavior in ffi/zig/src/gpu_ocr.zig: ddac_gpu_ocr_flush changes its declaration from export fn to pub export fn; its signature is otherwise unchanged.
• observed — Modified behavior in ffi/zig/src/gpu_ocr.zig: ddac_gpu_ocr_results_ready changes its declaration from export fn to pub export fn; its signature is otherwise unchanged.
• observed — Modified behavior in ffi/zig/src/gpu_ocr.zig: ddac_gpu_ocr_collect changes its declaration from export fn to pub export fn; its signature is otherwise unchanged.
• observed — Modified behavior in ffi/zig/src/ml_inference.zig: ddac_ml_run_stage is now declared pub export instead of export; its signature parameters and function body are unchanged.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI lockfile change and its purpose of meeting the 2026-10-01 lock gate.
Description check	✅ Passed	The description explains the lockfile generation, workflow banner updates, gate requirement, and verification steps. It is directly related to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🛠️ Fix failing CI checks

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks each workflow line,
And marks the lock with care.
Four exports take their public form,
TOC tests trace titles there.
FFI sizes match; the fields sit right,
Then hops away beneath the moon.}

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Autopilot could not be updated. Open Coding to check access and billing.

[coderabbitai]

ℹ️ Nothing to fix from this PR. All 1 failing check(s) are already failing on main, so they aren't caused by your changes.

⏭️ 1 check(s) skipped — already failing on `main` (not caused by this PR)

• GitHub Actions: Hypatia Security Scan / 0_hypatia _ Hypatia Neurosymbolic Analysis.txt

These need to be addressed on main (or by whoever owns them), not in this PR.