chore(ci): generate actions.lock ahead of the 2026-10-01 lock gate

[hyperpolymath]

Summary

• Adds .github/workflows/actions.lock. It was generated by gh actions-lock --no-narrow v0.1.6 from the refs already SHA-pinned here, so no uses: line changes.
• Moves the tool's banner to line 2 in each workflow, keeping SPDX on line 1.

Why

From 2026-10-01 the governance "Actions lockfile verify" gate fails any repo that lacks a lockfile. Changing the date on standards main would not help, because this repo pins the reusable workflow by SHA.

Verification

• The gate script at the pinned standards SHA passes with LOCK_TODAY=2026-10-01.
• This PR's own runs are the runtime test. Every workflow must create jobs, with no startup_failure.

🤖 Generated with Claude Code

https://claude.ai/code/session_019aa9y32JcBuZ85KXe2jb8R

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 7c723b7c-6c54-40ee-880b-3928a26181e1

📥 Commits

Reviewing files that changed from the base of the PR and between 4ffe058 and 8564aa5.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (16)

• .github/workflows/boj-build.yml
• .github/workflows/casket-pages.yml
• .github/workflows/codeql.yml
• .github/workflows/dogfood-gate.yml
• .github/workflows/elixir-ci.yml
• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/instant-sync.yml
• .github/workflows/label-triage.yml
• .github/workflows/labels.yml
• .github/workflows/mirror.yml
• .github/workflows/pages.yml
• .github/workflows/proofs.yml
• .github/workflows/push-email-notify.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (31)

• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: semgrep-cloud-platform/scan
• GitHub Check: governance / Workflow security linter
• GitHub Check: scan / shell-secrets
• GitHub Check: scan / gitleaks
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: scan / rust-secrets
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: governance / Debt ratchet
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: governance / Actions lockfile verify
• GitHub Check: trufflehog
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: Validate AI manifests (.deed + legacy .a2ml)
• GitHub Check: Validate K9 contracts
• GitHub Check: Groove manifest check
• GitHub Check: Test (Elixir 1.18 / OTP 27)
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Dialyzer
• GitHub Check: analyze (actions, none)
• GitHub Check: Test (Elixir 1.17 / OTP 27)
• GitHub Check: Test (Elixir 1.19 / OTP 27)
• GitHub Check: Idris2 type-check (contract layer)
• GitHub Check: Trusted-base audit (empty — no axioms)

🔇 Additional comments (16)

.github/workflows/boj-build.yml (1)

2-2: LGTM!

.github/workflows/casket-pages.yml (1)

2-2: LGTM!

.github/workflows/codeql.yml (1)

2-2: LGTM!

.github/workflows/dogfood-gate.yml (1)

2-2: LGTM!

.github/workflows/elixir-ci.yml (1)

2-2: LGTM!

.github/workflows/governance.yml (1)

2-2: LGTM!

.github/workflows/hypatia-scan.yml (1)

2-2: LGTM!

.github/workflows/instant-sync.yml (1)

2-2: LGTM!

.github/workflows/label-triage.yml (1)

2-2: LGTM!

.github/workflows/labels.yml (1)

2-2: LGTM!

.github/workflows/mirror.yml (1)

2-2: LGTM!

.github/workflows/pages.yml (1)

2-2: LGTM!

.github/workflows/proofs.yml (1)

2-2: LGTM!

.github/workflows/push-email-notify.yml (1)

2-2: LGTM!

.github/workflows/scorecard.yml (1)

2-2: LGTM!

.github/workflows/secret-scanner.yml (1)

2-2: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Added maintenance notes to automated workflows. These are documentation-only updates and do not change how the workflows run or affect the product’s functionality.

Walkthrough

The pull request adds comments identifying 16 GitHub Actions workflows as managed by gh actions-lock. It does not change workflow behaviour.

Changes

Workflow management annotations

Layer / File(s)	Summary
Add management comments .github/workflows/*.yml	Comments identify the workflows as managed by gh actions-lock. Executable workflow behaviour is unchanged.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 8564a

The workflow edits are comments only, and the lockfile matches the local action pins. No concrete lockfile or workflow failure is established, so the change presents minimal merge risk.

Architecture Summary

Architecture risk: 🔵 Low · up to 8564a

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/boj-build.yml: Added a comment identifying the workflow as managed by gh actions-lock.
• observed — Modified behavior in .github/workflows/casket-pages.yml: Added a comment stating that the workflow is managed by gh actions-lock.
• observed — Modified behavior in .github/workflows/codeql.yml: Added a comment identifying the workflow as managed by gh actions-lock.
• observed — Modified behavior in .github/workflows/dogfood-gate.yml: Added a comment declaring that gh actions-lock manages this workflow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: generating .github/workflows/actions.lock before the 2026-10-01 lock gate. It is concise and specific.
Description check	✅ Passed	The description directly explains the lockfile generation, workflow banner updates, reason for the change, and verification details. It is relevant to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit hops past workflow lines,
And spots a note where each one shines.
“Managed by actions-lock,” they say,
Then bound along their leafy way.
No workflow steps have changed today.}

_{Comment @coderabbitai help to get the list of available commands.}

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR