From 68a498282fd888c5722b6c4b68a94928be34d26d Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 2 Sep 2026 13:20:18 +0100 Subject: [PATCH] =?UTF-8?q?fix(ci):=20regenerate=20actions.lock;=20Dependa?= =?UTF-8?q?bot=20stops=20bumping=20action=20pins;=20standards=20pins=20?= =?UTF-8?q?=E2=86=92=20c59f24f7?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Root cause of the CodeQL outage: Dependabot #92 bumped github/codeql-action to v4.37.9 without regenerating .github/workflows/actions.lock, so every CodeQL run since 2026-09-02 11:54Z died in startup_failure ("Invalid lockfile") and the two required CodeQL contexts could never report on any PR. Nobody could have regenerated the lock either: `gh actions-lock` refuses to run while any workflow is unparseable, and workflow-linter.yml had `permissions: read-all` followed by an indented `actions: read` (invalid YAML). Fixed to a mapping. - actions.lock: codeql-action v4.37.9 (cdf488f) pinned; stale dawidd6/action-send-mail entry pruned. - push-email-notify.yml deleted: disabled_manually, last run skipped 2026-07-20, references a tag the lock could not resolve; replaced estate-wide by smtp-notify-action (standards spec §5.5). - dependabot.yml: `github-actions` ecosystem removed — pin bumps come from the standards lock-refresh workflow, which regenerates the lock in the same PR (spec §6.4). `guix` removed: not a Dependabot ecosystem, and an invalid entry disables the whole config. - standards reusables pinned 84355587 → c59f24f7 (PR #718): the lock check is now its own job that fetches its scripts from standards instead of the consumer cwd, which is why "Workflow security linter" exited 127 here on every run. Verified locally: all 17 workflows parse (yq); `update-actions-lock.sh --verify-local` valid; `check-actions-lock-gate.sh` exit 0. --- .github/dependabot.yml | 21 ++++++--------- .github/workflows/actions.lock | 29 ++++++++------------ .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/push-email-notify.yml | 36 ------------------------- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- .github/workflows/workflow-linter.yml | 3 ++- 9 files changed, 26 insertions(+), 73 deletions(-) delete mode 100644 .github/workflows/push-email-notify.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c884cea..d18d73b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -18,19 +18,14 @@ updates: update-types: - "minor" - "patch" - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - groups: - actions: - patterns: - - "*" - - package-ecosystem: "guix" - directory: "/" - schedule: - interval: "weekly" - package-ecosystem: "npm" directory: "/" schedule: - interval: "weekly" \ No newline at end of file + interval: "weekly" +# `github-actions` is deliberately absent: Dependabot bumps `uses:` pins +# without regenerating .github/workflows/actions.lock, which put every +# workflow using the bumped action into startup_failure ("Invalid +# lockfile") — #92 did exactly that to CodeQL on 2026-09-02. Action pin +# bumps come from the standards lock-refresh workflow, which regenerates +# the lock in the same PR (standards spec 2026-09-02-cicd-regularisation +# §6.4). `guix` was removed because it is not a Dependabot ecosystem. diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 863bef0..0105c1e 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -3,13 +3,6 @@ # Docs: https://gh.io/actions-lockfile version: 'v0.0.2' workflows: - '.github/workflows/governance.yml': [] - '.github/workflows/hypatia-scan.yml': [] - '.github/workflows/label-triage.yml': [] - '.github/workflows/labels.yml': [] - '.github/workflows/mirror.yml': [] - '.github/workflows/scorecard.yml': [] - '.github/workflows/secret-scanner.yml': [] '.github/workflows/boj-build.yml': - 'actions/checkout@v7.0.1' '.github/workflows/casket-pages.yml': @@ -30,22 +23,27 @@ workflows: - 'softprops/action-gh-release@v3.0.2' '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - - 'github/codeql-action@v4.37.8' + - 'github/codeql-action@v4.37.9' '.github/workflows/dependabot-automerge.yml': - 'dependabot/fetch-metadata@v3.1.0' '.github/workflows/dogfood-gate.yml': - 'actions/checkout@v7.0.1' - 'hyperpolymath/a2ml-ecosystem@main' - 'hyperpolymath/k9-ecosystem@main' + '.github/workflows/governance.yml': [] + '.github/workflows/hypatia-scan.yml': [] '.github/workflows/instant-sync.yml': - 'peter-evans/repository-dispatch@v4.0.1' + '.github/workflows/label-triage.yml': [] + '.github/workflows/labels.yml': [] '.github/workflows/makefile-blocker.yml': - 'actions/checkout@v7.0.1' - '.github/workflows/push-email-notify.yml': - - 'dawidd6/action-send-mail@v3.12.0' + '.github/workflows/mirror.yml': [] '.github/workflows/rescript-deno-ci.yml': - 'actions/checkout@v7.0.1' - 'denoland/setup-deno@v2.0.5' + '.github/workflows/scorecard.yml': [] + '.github/workflows/secret-scanner.yml': [] '.github/workflows/workflow-linter.yml': - 'actions/checkout@v7.0.1' dependencies: @@ -115,11 +113,6 @@ dependencies: repo_id: 200299178 uses: - 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd' - 'dawidd6/action-send-mail@v3.12.0': - ref: 'v3.12.0' - commit: 'sha1-94de994a9f6fffee200243214e17002e2920bb59' - owner_id: 9713907 - repo_id: 222439721 'denoland/setup-deno@v2.0.5': ref: 'v2.0.5' commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' @@ -135,9 +128,9 @@ dependencies: commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' owner_id: 1940490 repo_id: 260749683 - 'github/codeql-action@v4.37.8': - ref: 'v4.37.8' - commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' + 'github/codeql-action@v4.37.9': + ref: 'v4.37.9' + commit: 'sha1-cdf488f595d80d6e07e03d4674febd5ab45fa938' owner_id: 9919 repo_id: 259445878 'haskell-actions/setup@v2.12.0': diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index be5d5f2..68fa9e0 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -16,4 +16,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@c59f24f76e02a8d4ecd2aea4309d185d7ed13128 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 23785f3..436ec48 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -19,4 +19,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@c59f24f76e02a8d4ecd2aea4309d185d7ed13128 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index c2ba777..377ca66 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -14,5 +14,5 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@c59f24f76e02a8d4ecd2aea4309d185d7ed13128 secrets: inherit diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml deleted file mode 100644 index d2eeba4..0000000 --- a/.github/workflows/push-email-notify.yml +++ /dev/null @@ -1,36 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# This workflow is managed by gh actions-lock. -# This workflow is managed by gh actions-lock. -# Dormant push-email notification. ARMED by setting the repo variable -# PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; -# sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by -# new repos from the template; placed on existing repos by the farm sweep. -name: Push email notification -on: - push: {} -permissions: - actions: read - contents: read -jobs: - notify: - name: Email on push - if: ${{ vars.PUSH_EMAIL_ENABLED == 'true' }} - runs-on: ubuntu-latest - steps: - - name: Send push notification email - uses: dawidd6/action-send-mail@v18 - with: - server_address: ${{ secrets.SMTP_HOST }} - server_port: ${{ secrets.SMTP_PORT }} - secure: true - username: ${{ secrets.SMTP_USER }} - password: ${{ secrets.SMTP_PASS }} - from: "GitHub Push <${{ secrets.SMTP_USER }}>" - to: "jonathan.jewell@gmail.com j.d.a.jewell@open.ac.uk" - subject: "[${{ github.repository }}] push to ${{ github.ref_name }} by ${{ github.actor }}" - body: | - Repository: ${{ github.repository }} - Branch: ${{ github.ref_name }} - Pusher: ${{ github.actor }} - Compare: ${{ github.event.compare }} - Head msg: ${{ github.event.head_commit.message }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index dc2bb26..484d2a1 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -14,7 +14,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@c59f24f76e02a8d4ecd2aea4309d185d7ed13128 permissions: contents: read security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 3b1c5df..916c5b1 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -20,5 +20,5 @@ jobs: scan: permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c59f24f76e02a8d4ecd2aea4309d185d7ed13128 secrets: inherit diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 4be352d..68e5a86 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -12,7 +12,8 @@ on: paths: - '.github/workflows/**' -permissions: read-all +permissions: + contents: read actions: read jobs: