diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c884cea..d18d73b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -18,19 +18,14 @@ updates: update-types: - "minor" - "patch" - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - groups: - actions: - patterns: - - "*" - - package-ecosystem: "guix" - directory: "/" - schedule: - interval: "weekly" - package-ecosystem: "npm" directory: "/" schedule: - interval: "weekly" \ No newline at end of file + interval: "weekly" +# `github-actions` is deliberately absent: Dependabot bumps `uses:` pins +# without regenerating .github/workflows/actions.lock, which put every +# workflow using the bumped action into startup_failure ("Invalid +# lockfile") — #92 did exactly that to CodeQL on 2026-09-02. Action pin +# bumps come from the standards lock-refresh workflow, which regenerates +# the lock in the same PR (standards spec 2026-09-02-cicd-regularisation +# §6.4). `guix` was removed because it is not a Dependabot ecosystem. diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 863bef0..0105c1e 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -3,13 +3,6 @@ # Docs: https://gh.io/actions-lockfile version: 'v0.0.2' workflows: - '.github/workflows/governance.yml': [] - '.github/workflows/hypatia-scan.yml': [] - '.github/workflows/label-triage.yml': [] - '.github/workflows/labels.yml': [] - '.github/workflows/mirror.yml': [] - '.github/workflows/scorecard.yml': [] - '.github/workflows/secret-scanner.yml': [] '.github/workflows/boj-build.yml': - 'actions/checkout@v7.0.1' '.github/workflows/casket-pages.yml': @@ -30,22 +23,27 @@ workflows: - 'softprops/action-gh-release@v3.0.2' '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - - 'github/codeql-action@v4.37.8' + - 'github/codeql-action@v4.37.9' '.github/workflows/dependabot-automerge.yml': - 'dependabot/fetch-metadata@v3.1.0' '.github/workflows/dogfood-gate.yml': - 'actions/checkout@v7.0.1' - 'hyperpolymath/a2ml-ecosystem@main' - 'hyperpolymath/k9-ecosystem@main' + '.github/workflows/governance.yml': [] + '.github/workflows/hypatia-scan.yml': [] '.github/workflows/instant-sync.yml': - 'peter-evans/repository-dispatch@v4.0.1' + '.github/workflows/label-triage.yml': [] + '.github/workflows/labels.yml': [] '.github/workflows/makefile-blocker.yml': - 'actions/checkout@v7.0.1' - '.github/workflows/push-email-notify.yml': - - 'dawidd6/action-send-mail@v3.12.0' + '.github/workflows/mirror.yml': [] '.github/workflows/rescript-deno-ci.yml': - 'actions/checkout@v7.0.1' - 'denoland/setup-deno@v2.0.5' + '.github/workflows/scorecard.yml': [] + '.github/workflows/secret-scanner.yml': [] '.github/workflows/workflow-linter.yml': - 'actions/checkout@v7.0.1' dependencies: @@ -115,11 +113,6 @@ dependencies: repo_id: 200299178 uses: - 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd' - 'dawidd6/action-send-mail@v3.12.0': - ref: 'v3.12.0' - commit: 'sha1-94de994a9f6fffee200243214e17002e2920bb59' - owner_id: 9713907 - repo_id: 222439721 'denoland/setup-deno@v2.0.5': ref: 'v2.0.5' commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' @@ -135,9 +128,9 @@ dependencies: commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' owner_id: 1940490 repo_id: 260749683 - 'github/codeql-action@v4.37.8': - ref: 'v4.37.8' - commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' + 'github/codeql-action@v4.37.9': + ref: 'v4.37.9' + commit: 'sha1-cdf488f595d80d6e07e03d4674febd5ab45fa938' owner_id: 9919 repo_id: 259445878 'haskell-actions/setup@v2.12.0': diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index be5d5f2..68fa9e0 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -16,4 +16,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@c59f24f76e02a8d4ecd2aea4309d185d7ed13128 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 23785f3..436ec48 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -19,4 +19,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@c59f24f76e02a8d4ecd2aea4309d185d7ed13128 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index c2ba777..377ca66 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -14,5 +14,5 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@c59f24f76e02a8d4ecd2aea4309d185d7ed13128 secrets: inherit diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml deleted file mode 100644 index d2eeba4..0000000 --- a/.github/workflows/push-email-notify.yml +++ /dev/null @@ -1,36 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# This workflow is managed by gh actions-lock. -# This workflow is managed by gh actions-lock. -# Dormant push-email notification. ARMED by setting the repo variable -# PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; -# sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by -# new repos from the template; placed on existing repos by the farm sweep. -name: Push email notification -on: - push: {} -permissions: - actions: read - contents: read -jobs: - notify: - name: Email on push - if: ${{ vars.PUSH_EMAIL_ENABLED == 'true' }} - runs-on: ubuntu-latest - steps: - - name: Send push notification email - uses: dawidd6/action-send-mail@v18 - with: - server_address: ${{ secrets.SMTP_HOST }} - server_port: ${{ secrets.SMTP_PORT }} - secure: true - username: ${{ secrets.SMTP_USER }} - password: ${{ secrets.SMTP_PASS }} - from: "GitHub Push <${{ secrets.SMTP_USER }}>" - to: "jonathan.jewell@gmail.com j.d.a.jewell@open.ac.uk" - subject: "[${{ github.repository }}] push to ${{ github.ref_name }} by ${{ github.actor }}" - body: | - Repository: ${{ github.repository }} - Branch: ${{ github.ref_name }} - Pusher: ${{ github.actor }} - Compare: ${{ github.event.compare }} - Head msg: ${{ github.event.head_commit.message }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index dc2bb26..484d2a1 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -14,7 +14,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@c59f24f76e02a8d4ecd2aea4309d185d7ed13128 permissions: contents: read security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 3b1c5df..916c5b1 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -20,5 +20,5 @@ jobs: scan: permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c59f24f76e02a8d4ecd2aea4309d185d7ed13128 secrets: inherit diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 4be352d..68e5a86 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -12,7 +12,8 @@ on: paths: - '.github/workflows/**' -permissions: read-all +permissions: + contents: read actions: read jobs: