fix(ci): reconcile actions.lock with the refs dependabot bumped - #105
Merged
Merged
Conversation
CI, Publish Image and GitHub Pages have been failing at startup on main since PR #104 bumped the actions group but left the lockfile behind: `.github/workflows/actions.lock` is keyed by workflow path and enforced before any step runs, so a drifted ref rejects the whole workflow (`startup_failure`, 0 steps) — the failure mode already described in this repo's STATE.a2ml and in the label-triage.yml header. Registers the four bumped refs and their per-workflow entries: haskell-actions/setup@v2.12.0 -> v2.12.1 (ci.yml, casket-pages.yml) github/codeql-action@v4.38.0 -> v4.38.1 (ci.yml, upload-sarif) docker/setup-buildx-action@v4.3.0 -> v4.4.1 (publish-image.yml) docker/build-push-action@v7.3.0 -> v7.4.0 (publish-image.yml) Commits are resolved from the tag objects via the API (annotated tags are dereferenced; docker's are lightweight), mirroring the shape of the existing entries. Additive, following the same repair as #103: no entry is removed. Evidence: the two job-level gates that currently fail on this drift are the governance `Actions lockfile verify` job (runs the authoritative verifier) and `Workflow Security Linter`'s lockfile-coverage check; both are re-run by this PR's CI and the run is linked from the PR body. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
arena-ai-coding-agent
Bot
requested a review
from hyperpolymath
as a code owner
September 25, 2026 20:42
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
approved these changes
Sep 25, 2026
hyperpolymath
pushed a commit
that referenced
this pull request
Sep 25, 2026
) Fixes two of the three red workflows on main after #105 (evidence: docs/handoff/CI-EVIDENCE.md). - **Workflow Security Linter** (run 36187443576, exit 15): `gh actions-lock` moved the SPDX line off line 1 in all 15 workflows. Restored. Reproduced locally: 15 errors before, pass after. - **Governance / Actions lockfile verify** (run 36187444802): `codeql.yml` used `codeql-action@1c5b675…` (v4.38.1, mislabelled `# v3`) while the lock listed `@b96794…` (v4.38.0). It's now `@v4.38.1` like ci.yml; the lock list is fixed and 5 superseded entries are pruned. Reusable-workflow coverage entries are kept on purpose. - **Hypatia** (1 high finding, red since 09-20) is **not addressed**. We couldn't read the SARIF from the sandbox. Verified with `bash tools/ci/linter-verify.sh`. The real gate binary couldn't be downloaded here, so merging is the authoritative check (only owner merges trigger Actions). Also adds `docs/handoff/` (next-session prompt, issue bodies, DEED/K9 canon extract @ standards 2479cf76). --------- Co-authored-by: arena-agent <agent@arena.ai> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
mainis red — and has been since PR #104 — for a reason unrelated to any open issue:mainstartup_failure(0 steps)startup_failure(0 steps)startup_failure(0 steps)Actions lockfile verifyCheck actions lockfile coverage.github/workflows/actions.lockis keyed by workflow path and enforced at startup, so a workflow whose refs have drifted is rejected before a single step executes — exactly the failure mode this repo documents inSTATE.a2ml(actions-lockfile-enforcement) and in thelabel-triage.ymlheader. Dependabot bumped six actions in #104; the lockfile was not regenerated.This PR registers the four bumped refs:
haskell-actions/setupci.yml,casket-pages.ymlgithub/codeql-actionci.yml(upload-sarif)docker/setup-buildx-actionpublish-image.ymldocker/build-push-actionpublish-image.ymlCommit SHAs are resolved from the tag objects via the API (annotated tags dereferenced; docker's tags are lightweight), and the entries mirror the exact shape of the existing ones.
Why additive
The previous repair of this same class (#103) was purely additive — it added the transitive pins and completed the
workflows:map without deleting entries. This follows it: nothing is removed, so a verifier that tolerates extra entries keeps passing, and one that regenerates can be diffed from the re-run rather than from a guess.Evidence (this PR's own runs)
CI— must stop beingstartup_failureand reach a real conclusion.Governance / Actions lockfile verify— the authoritative verifier (gh actions-lock --verify-localvia the standards gate).Workflow Security Linter / Check actions lockfile coverage— the coverage check that names each uncovered ref.Publish Image/GitHub Pages— must stop beingstartup_failureon the merge commit.Until this lands, no other change in this repository can be validated by CI at all, which is why it goes first and alone.