actions.lock desync (taiki-e v2.87.24, smtp-notify v0.5.0) turns lockfile-verify and Hypatia Baseline red on main #914

Activity

1. coderabbitai commented on Oct 8, 2026

   

   coderabbitaibot

   on Oct 8, 2026 – with coderabbitai

   Contributor

   More actions

   🔗 Related PRs

   #823 - chore(ci): refresh actions.lock so the lockfile gate goes green (#818) [merged]

   ---

   📝 Issue Planner

   _{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

   • Create Plan

   ---

   🧪 Issue enrichment is currently in open beta.

   You can configure auto-planning by selecting labels in the issue_enrichment configuration.

   To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

   issue_enrichment:
     auto_enrich:
       enabled: false

   💬 Have feedback or questions? Drop into our discord!
2. coderabbitai

   added

   cicdCI/CD: workflows, actions, lockfiles, pins, runners, release gatesCI/CD: workflows, actions, lockfiles, pins, runners, release gates

   testingTests, benchmarks, fuzzing, property checks, coverageTests, benchmarks, fuzzing, property checks, coverage

   on Oct 8, 2026
3. hyperpolymath

   added a commit that references this issue on Oct 8, 2026

   fix(dispatch): send echidnabot proof obligations as GraphQL variables (…

   ...

   cce505d
4. hyperpolymath commented on Oct 8, 2026

   

   hyperpolymath

   on Oct 8, 2026

   OwnerAuthor

   More actions

   Correction to item 2 above. I wrote that the Validate Hypatia Baseline failure "is not fixed by a relock", and that clearing it needed either inline SHA pins or re-keyed ACKs. That was wrong.

   lib/rules/workflow_audit.ex:317-333 treats any ref the lock vouches for as pinned (ActionsLock.pinned?). #908 measured this: 9 × unpinned_action cleared with a relock alone. The same comment records that inline SHA-pinning is a regression under lockfile enforcement: on 2026-08-07, 40 inline pins put 14 workflows into startup_failure.

   So the relock in #915 should clear all 5 findings with no inline pins and no baseline change. #915's CI on its head is the test of that.
5. hyperpolymath

   closed this as completedin 69cf5caon Oct 8, 2026
6. hyperpolymath

   reopened this on Oct 8, 2026
7. hyperpolymath commented on Oct 9, 2026

   

   hyperpolymath

   on Oct 9, 2026

   OwnerAuthor

   More actions

   Verification before close (2026-10-09)

   #915 (merged as 69cf5cad) fixed this issue, and the merge auto-closed it. It was reopened for two reasons. Both are now resolved:

   1. ACs 2, 4 and 5 need evidence from a main push run. That could not exist at merge time, and all six boxes were unticked. The evidence is below. Every AC is now ticked, with its evidence inline.
   2. fix(ci): relock actions.lock for Dependabot-bumped refs; codeql to v4.38.2 symbolic (#914, #901) #915's codeql change exceeds AC1 and AC6 as worded. The owner ruled that both ACs be amended to name the accepted codeql.yml uses a bare commit the lock does not vouch for, and mislabels it as v4.38.0 #901 scope, then ticked. The amendments are marked (Amended 2026-10-09 …) in the body.

   AC	Evidence
   1	Regenerated with standards scripts/update-actions-lock.sh. Peeled tags (git ls-remote) match the lock: taiki-e v2.87.24 = e407f7ba (lightweight tag), smtp-notify v0.5.0^{} = c1c9fa07, codeql v4.38.2^{} = 2892aa5e. The codeql entry is the amended #901 scope.
   2	governance / Actions lockfile verify: job 113509146074 (Governance run 37834845333, push, 69cf5cad) success. Re-confirmed by job 113560800560 (run 37850159347, push, 4be38c80).
   3	The relock alone resolved the findings (ActionsLock.pinned?, lib/rules/workflow_audit.ex:317-333; see the correction comment above). #915 changed only actions.lock, codeql.yml and security-policy.yml: no inline SHA pins, no baseline change, no blanket entry.
   4	governance / Validate Hypatia Baseline: job 113509896859 (69cf5cad) success with 3 findings, all acknowledged, 0 new, 0 unpinned_action. Re-confirmed by job 113560967990 (4be38c80). Before the fix, run 37829065650 (#913 head 11cb915, pull_request) had 8 findings, 5 of them new.
   5	Push runs at 69cf5cad: CI 37834844329 success, 9 jobs. Tests 37834844475 success, 10 jobs. Security 37834844328 started, 9 jobs; its 3 job failures (Rust Dependency Audit, Rust License & Ban Check, Security Status) predate this issue and are tracked in #916. Build Gossamer GUI has a paths: filter, so no push since the fix has triggered it. Instead, workflow_dispatch at main ran as run 37923173066 at 4be38c80: 3/3 jobs succeeded. Its last main push run, 37755241662 at 297e70c, was startup_failure.
   6	Apart from the lock, #915's workflow diff is exactly 5 github/codeql-action/* lines (init/analyze in codeql.yml; init/analyze/upload-sarif in security-policy.yml), changed from @2892aa5e… to @v4.38.2. That is the same commit, now pinned by the lock. No other uses: line changed.

   Scope of this evidence: main push runs at 69cf5cad and 4be38c80, plus one workflow_dispatch at main (4be38c80) for Build Gossamer GUI. A push that touches the GUI's paths: has not yet run on main.

   Closing as completed. The Security job failures continue in #916.
8. hyperpolymath

   closed this as completedon Oct 9, 2026