From f9685442d56a59e119de1fd8324ebc16be5df4ee Mon Sep 17 00:00:00 2001 From: Arena Agent Date: Fri, 25 Sep 2026 20:42:10 +0000 Subject: [PATCH] fix(ci): reconcile actions.lock with the refs dependabot bumped MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI, Publish Image and GitHub Pages have been failing at startup on main since PR #104 bumped the actions group but left the lockfile behind: `.github/workflows/actions.lock` is keyed by workflow path and enforced before any step runs, so a drifted ref rejects the whole workflow (`startup_failure`, 0 steps) — the failure mode already described in this repo's STATE.a2ml and in the label-triage.yml header. Registers the four bumped refs and their per-workflow entries: haskell-actions/setup@v2.12.0 -> v2.12.1 (ci.yml, casket-pages.yml) github/codeql-action@v4.38.0 -> v4.38.1 (ci.yml, upload-sarif) docker/setup-buildx-action@v4.3.0 -> v4.4.1 (publish-image.yml) docker/build-push-action@v7.3.0 -> v7.4.0 (publish-image.yml) Commits are resolved from the tag objects via the API (annotated tags are dereferenced; docker's are lightweight), mirroring the shape of the existing entries. Additive, following the same repair as #103: no entry is removed. Evidence: the two job-level gates that currently fail on this drift are the governance `Actions lockfile verify` job (runs the authoritative verifier) and `Workflow Security Linter`'s lockfile-coverage check; both are re-run by this PR's CI and the run is linked from the PR body. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> --- .github/workflows/actions.lock | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 7ef5f14..e1bec15 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -9,13 +9,13 @@ workflows: - 'actions/configure-pages@v6.0.0' - 'actions/deploy-pages@v5.0.1' - 'actions/upload-pages-artifact@v5.0.0' - - 'haskell-actions/setup@v2.12.0' + - 'haskell-actions/setup@v2.12.1' '.github/workflows/ci.yml': - 'actions/cache@v6.1.0' - 'actions/checkout@v7.0.1' - 'aquasecurity/trivy-action@v0.36.0' - - 'github/codeql-action@v4.38.0' - - 'haskell-actions/setup@v2.12.0' + - 'github/codeql-action@v4.38.1' + - 'haskell-actions/setup@v2.12.1' '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' @@ -33,10 +33,10 @@ workflows: '.github/workflows/publish-image.yml': - 'actions/attest-build-provenance@v4.2.2' - 'actions/checkout@v7.0.1' - - 'docker/build-push-action@v7.3.0' + - 'docker/build-push-action@v7.4.0' - 'docker/login-action@v4.6.0' - 'docker/metadata-action@v6.2.0' - - 'docker/setup-buildx-action@v4.3.0' + - 'docker/setup-buildx-action@v4.4.1' '.github/workflows/scorecard.yml': [] '.github/workflows/secret-scanner.yml': [] '.github/workflows/workflow-linter.yml': @@ -127,6 +127,11 @@ dependencies: commit: 'sha1-53b7df96c91f9c12dcc8a07bcb9ccacbed38856a' owner_id: 5429470 repo_id: 241092383 + 'docker/build-push-action@v7.4.0': + ref: 'v7.4.0' + commit: 'sha1-c3c9e263c25d99ce0380d002d59b67737d91b0dc' + owner_id: 5429470 + repo_id: 241092383 'docker/login-action@v4.6.0': ref: 'v4.6.0' commit: 'sha1-dbcb813823bdd20940b903addbd779551569679f' @@ -142,6 +147,11 @@ dependencies: commit: 'sha1-37fe631027851001ddb9b187196cc803df7f5f0e' owner_id: 5429470 repo_id: 288485773 + 'docker/setup-buildx-action@v4.4.1': + ref: 'v4.4.1' + commit: 'sha1-f87e5991a6d7451dcb8d9637bfbc97413f497069' + owner_id: 5429470 + repo_id: 288485773 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63': ref: 'v4.38.0' commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' @@ -152,11 +162,21 @@ dependencies: commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' owner_id: 9919 repo_id: 259445878 + 'github/codeql-action@v4.38.1': + ref: 'v4.38.1' + commit: 'sha1-1c5b675653bb5c22dbe9b12b556ec555138e09fd' + owner_id: 9919 + repo_id: 259445878 'haskell-actions/setup@v2.12.0': ref: 'v2.12.0' commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' owner_id: 75048950 repo_id: 623796603 + 'haskell-actions/setup@v2.12.1': + ref: 'v2.12.1' + commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d' + owner_id: 75048950 + repo_id: 623796603 'peter-evans/repository-dispatch@v4.0.1': ref: 'v4.0.1' commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'