Skip to content

Commit 805582f

Browse files
hyperpolymathhyperpolymath
authored
fix(ci): reconcile the workflows with actions.lock (gh-actions-lock) (#87)
fix(ci): reconcile the workflows with actions.lock (gh-actions-lock v0.1.6) `actions.lock` is authoritative: the workflows carry readable refs and the lock records the commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest make the whole repository unstartable — `startup_failure`, "Invalid lockfile". Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are reverted to their readable form here precisely because the lockfile, not the workflow, is what pins them.
1 parent ae6a50b commit 805582f

17 files changed

Lines changed: 51 additions & 36 deletions

‎.github/workflows/boj-build.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -18,7 +19,7 @@ jobs:
1819
runs-on: ubuntu-latest
1920
steps:
2021
- name: Checkout
21-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
22+
uses: actions/checkout@v7.0.1
2223
- name: Trigger BoJ Server (Casket/ssg-mcp)
2324
env:
2425
BOJ_URL: ${{ secrets.BOJ_SERVER_URL || vars.BOJ_SERVER_URL }}

‎.github/workflows/casket-pages.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -23,22 +24,22 @@ jobs:
2324
runs-on: ubuntu-latest
2425
steps:
2526
- name: Checkout
26-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
27+
uses: actions/checkout@v7.0.1
2728

2829
- name: Checkout casket-ssg
29-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
30+
uses: actions/checkout@v7.0.1
3031
with:
3132
repository: hyperpolymath/casket-ssg
3233
path: .casket-ssg
3334

3435
- name: Setup GHCup
35-
uses: haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d # v2.12.0
36+
uses: haskell-actions/setup@v2.12.0
3637
with:
3738
ghc-version: '9.8.2'
3839
cabal-version: '3.10'
3940

4041
- name: Cache Cabal
41-
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
42+
uses: actions/cache@v6.1.0
4243
with:
4344
path: |
4445
~/.cabal/packages
@@ -100,10 +101,10 @@ jobs:
100101
touch ../_site/.nojekyll
101102
102103
- name: Setup Pages
103-
uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
104+
uses: actions/configure-pages@v6.0.0
104105

105106
- name: Upload artifact
106-
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
107+
uses: actions/upload-pages-artifact@v5.0.0
107108
with:
108109
path: '_site'
109110

@@ -116,4 +117,4 @@ jobs:
116117
steps:
117118
- name: Deploy to GitHub Pages
118119
id: deployment
119-
uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
120+
uses: actions/deploy-pages@v5.0.1

‎.github/workflows/codeql.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,15 +38,15 @@ jobs:
3838
build-mode: none
3939
steps:
4040
- name: Checkout
41-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
41+
uses: actions/checkout@v7.0.1
4242

4343
- name: Initialize CodeQL
44-
uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
44+
uses: github/codeql-action/init@v4.38.0
4545
with:
4646
languages: ${{ matrix.language }}
4747
build-mode: ${{ matrix.build-mode }}
4848

4949
- name: Perform CodeQL Analysis
50-
uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
50+
uses: github/codeql-action/analyze@v4.38.0
5151
with:
5252
category: "/language:${{ matrix.language }}"

‎.github/workflows/dependabot-automerge.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -57,7 +58,7 @@ jobs:
5758
steps:
5859
- name: Fetch Dependabot metadata
5960
id: meta
60-
uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
61+
uses: dependabot/fetch-metadata@v3.1.0
6162
with:
6263
github-token: ${{ secrets.GITHUB_TOKEN }}
6364

‎.github/workflows/dogfood-gate.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -28,7 +29,7 @@ jobs:
2829

2930
steps:
3031
- name: Checkout repository
31-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
32+
uses: actions/checkout@v7.0.1
3233

3334
- name: Check for A2ML files
3435
id: detect
@@ -68,7 +69,7 @@ jobs:
6869

6970
steps:
7071
- name: Checkout repository
71-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
72+
uses: actions/checkout@v7.0.1
7273

7374
- name: Check for K9 files
7475
id: detect
@@ -113,7 +114,7 @@ jobs:
113114

114115
steps:
115116
- name: Checkout repository
116-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
117+
uses: actions/checkout@v7.0.1
117118

118119
- name: Scan for invisible characters
119120
id: lint
@@ -177,7 +178,7 @@ jobs:
177178

178179
steps:
179180
- name: Checkout repository
180-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
181+
uses: actions/checkout@v7.0.1
181182

182183
- name: Check for Groove manifest
183184
id: groove
@@ -237,7 +238,7 @@ jobs:
237238

238239
steps:
239240
- name: Checkout repository
240-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
241+
uses: actions/checkout@v7.0.1
241242

242243
- name: Generate dogfooding scorecard
243244
run: |

‎.github/workflows/governance.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.

‎.github/workflows/hypatia-scan.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.

‎.github/workflows/instant-sync.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -19,7 +20,7 @@ jobs:
1920
runs-on: ubuntu-latest
2021
steps:
2122
- name: Trigger Propagation
22-
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
23+
uses: peter-evans/repository-dispatch@v4.0.1
2324
with:
2425
token: ${{ secrets.FARM_DISPATCH_TOKEN }}
2526
repository: hyperpolymath/.git-private-farm

‎.github/workflows/label-triage.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
name: Label Triage
34

‎.github/workflows/labels.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
name: Labels
34

0 commit comments

Comments
 (0)