You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(ci): unbreak workflow YAML and add a complete actions.lock - #89
Remediates GitHub Workflow Dependency Locking (public preview, no changelog entry), which rejects runs at startup_failure — zero jobs, no logs, nothing in REST or GraphQL. Full analysis: hyperpolymath/standards#657.
Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead → 0 startup_failure, 13 running.
Five steps, in order — each blocks the next
1. Unbreak the workflow YAML. Any permissions: carrying a scalar with an indented mapping under it:
permissions: read-allactions: read # <- mapping under a scalar. Unparseable.
This reaches past the one file: gh actions-lock refuses to run when any workflow in the repo fails to parse, so the repo can never acquire a lockfile and can never self-heal.
2. Repin standards reusables off commits with no actions.lock. The rejection requires the callee to be covered at the pinned SHA — unsatisfiable at a pre-lockfile commit.
3. Generate the lockfile with gh actions-lock.
4. Hand-add the reusable-caller entries the tool omits, as '<path>': [].
⚠️ Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without — because every workflow a lockfile omits is rejected. A partial lock is worse than none. Running gh actions-lock and stopping there is how this outage spread.
5. Restore SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps via head -1.
Verified before this PR was opened
0 unparseable workflows · lockfile covers every workflow, no omissions · SPDX on line 1 in every file. The script refuses to push if any of the three fails.
Remediates GitHub Workflow Dependency Locking (public preview), which
rejects runs at startup_failure with zero jobs and no logs. See
hyperpolymath/standards#657.
Five steps, in order, because each blocks the next:
1. Unbroke any workflow whose `permissions:` carried a scalar with an
indented mapping under it - blind-permissions-insertion damage. This
matters beyond the one file: gh actions-lock refuses to run when ANY
workflow in the repo fails to parse, so the repo could never acquire a
lockfile and could never self-heal.
2. Repinned hyperpolymath/standards reusables off commits that have no
actions.lock. The rejection requires the CALLEE to be covered at the
pinned SHA, which is unsatisfiable at a pre-lockfile commit.
3. Generated the lockfile with gh actions-lock.
4. Hand-added the reusable-workflow caller entries the tool omits, as
'<path>': []. Measured across 218 repos: P(startup_failure | has
lockfile) = 91.7% vs 15.8% without, because every workflow a lockfile
OMITS is rejected. A PARTIAL lock is worse than none - running
gh actions-lock and stopping there is how this outage spread.
5. Restored SPDX-License-Identifier to line 1, which the tool displaces
with its own banner and which the workflow-security linter greps with
head -1.
Verified before push: 0 unparseable workflows, lockfile covers every
workflow with no omissions, SPDX on line 1 in every file.
Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead -> 0
startup_failure, 13 running.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Reviewing files that changed from the base of the PR and between fb10baa and c991dde.
⛔ Files ignored due to path filters (1)
.github/workflows/actions.lock is excluded by !**/*.lock
📒 Files selected for processing (16)
.github/workflows/boj-build.yml
.github/workflows/casket-pages.yml
.github/workflows/ci.yml
.github/workflows/codeql.yml
.github/workflows/dependabot-automerge.yml
.github/workflows/dogfood-gate.yml
.github/workflows/governance.yml
.github/workflows/hypatia-scan.yml
.github/workflows/instant-sync.yml
.github/workflows/makefile-blocker.yml
.github/workflows/mirror.yml
.github/workflows/push-email-notify.yml
.github/workflows/rescript-deno-ci.yml
.github/workflows/scorecard.yml
.github/workflows/secret-scanner.yml
.github/workflows/workflow-linter.yml
📝 Walkthrough
Summary by CodeRabbit
Chores
Updated automated build, testing, security scanning and release workflows to use refreshed tooling and workflow definitions.
Improved workflow permissions for actions that require read access.
Updated email notification tooling to a supported version.
Standardised workflow management metadata across automation processes.
No changes to product functionality or the end-user experience.
Walkthrough
The pull request updates GitHub Actions workflow comments, permissions, reusable workflow pins, Rust toolchain references, and the mail action version.
A rabbit checks each workflow line
Pins and permissions now align
Comments hop into their place
Rust tools run at a tagged pace
Ears perk up at tidy YAML signs
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
Create stacked PR
Commit on current branch
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This pull request is currently not up to standards according to Codacy analysis, primarily due to security regressions and logic gaps. While the PR aims to unbreak CI workflows, it introduces significant supply-chain risks by replacing immutable commit SHAs with mutable version tags in several workflow files. Furthermore, the core 'actions.lock' file mentioned in the PR description and acceptance criteria is entirely missing from the changes, which prevents the verification of essential manual additions. There is also a systemic issue with duplicate header comments being added across all modified YAML files, suggesting a flaw in the automation tool used for these updates. These issues, particularly the security regressions and missing assets, should be addressed before merging.
About this PR
The 'actions.lock' file, described as a central part of this PR, is missing from the submitted changes. This prevents verification of the manual additions required for reusable-caller workflows.
Systemic duplication: The header comment '# This workflow is managed by gh actions-lock.' is redundantly added to line 3 in almost all modified files, while already existing on line 2.
Test suggestions
Verify all workflow files place '# SPDX-License-Identifier' on line 1.
Verify workflows calling reusables (Governance, Hypatia, Mirror, OSSF, Secrets) include 'actions: read' permission.
Verify 'standards' reusables are repinned to SHAs compatible with lockfile requirements.
Verify the 'actions.lock' file contains the manually added caller entries mentioned in the description.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify the 'actions.lock' file contains the manually added caller entries mentioned in the description.
Low confidence findings
The 'unbreaking' of YAML scalars is inconsistent; for example, 'workflow-linter.yml' still uses a scalar 'permissions: read-all' while other files were updated to mappings.
The reason will be displayed to describe this comment to others. Learn more.
🔴 HIGH RISK
Pin the dawidd6/action-send-mail action to a full-length commit SHA. Using a version tag like @v3.12.0 is mutable and exposes the CI environment to potential upstream changes.
The reason will be displayed to describe this comment to others. Learn more.
🔴 HIGH RISK
Pin this action to a full-length commit SHA to ensure immutability and protect against supply chain attacks. Replacing pinned SHAs with mutable tags (e.g., @v1) is a security regression and bypasses the protections of the actions-lock tool. This issue also occurs at lines 112, 157, 248, and 300.
The reason will be displayed to describe this comment to others. Learn more.
⚪ LOW RISK
Nitpick: Redundant duplicate comment: '# This workflow is managed by gh actions-lock.' already exists on line 2. Please remove the duplicate on line 3.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
Remediates GitHub Workflow Dependency Locking (public preview, no changelog entry), which rejects runs at
startup_failure— zero jobs, no logs, nothing in REST or GraphQL. Full analysis:hyperpolymath/standards#657.Proven on
hyperpolymath/anamnesis: 6 of 6 workflows dead → 0startup_failure, 13 running.Five steps, in order — each blocks the next
1. Unbreak the workflow YAML. Any
permissions:carrying a scalar with an indented mapping under it:This reaches past the one file:
gh actions-lockrefuses to run when any workflow in the repo fails to parse, so the repo can never acquire a lockfile and can never self-heal.2. Repin
standardsreusables off commits with noactions.lock. The rejection requires the callee to be covered at the pinned SHA — unsatisfiable at a pre-lockfile commit.3. Generate the lockfile with
gh actions-lock.4. Hand-add the reusable-caller entries the tool omits, as
'<path>': [].P(startup_failure | has lockfile) = 91.7%vs15.8%without — because every workflow a lockfile omits is rejected. A partial lock is worse than none. Runninggh actions-lockand stopping there is how this outage spread.5. Restore
SPDX-License-Identifierto line 1, which the tool displaces with its own banner and which the workflow-security linter greps viahead -1.Verified before this PR was opened
0unparseable workflows · lockfile covers every workflow, no omissions · SPDX on line 1 in every file. The script refuses to push if any of the three fails.🤖 Generated with Claude Code