Skip to content

Commit e207381

Browse files
hyperpolymathhyperpolymath
committed
chore(ci): SPDX headers on line 1 and Actions lockfile minted
Two estate gates, one change. **SPDX.** `governance / Workflow security linter` checks `head -1 | grep`, so a workflow carrying its identifier below a managed-by comment reports as missing one. Each file's OWN identifier is moved to line 1 — nothing is imposed, because repositories here are variously MPL-2.0, PMPL-1.0-or-later and AGPL-3.0-or-later and a default would mis-declare the minority. Licences seen here: MPL-2.0. **Lockfile.** `gh actions-lock` resolves each symbolic ref to a verified commit plus owner_id, repo_id and the transitive dependencies of composite actions — which is what OSSF Scorecard's Pinned-Dependencies check is asking for, and what an inline SHA cannot express. ⚠ Do NOT additionally SHA-pin inline. The mechanisms are mutually exclusive: `gh actions-lock` refuses a ref no tag or branch contains, so inline pinning REMOVES actions from the lockfile. Measured on hypatia 2026-08-07 — 40 inline pins caused 14 startup_failures and dropped 7 lockfile entries. Verified: all workflows parse, no duplicate identifiers, lockfile verify says "Run without --verify-local to resolve and pin missing actions.".
1 parent 774dceb commit e207381

22 files changed

Lines changed: 205 additions & 63 deletions

‎.github/workflows/actions.lock‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
# This file is machine-generated by `gh actions-lock`.
2+
# Do not edit by hand; run `gh actions-lock` to update.
3+
# Docs: https://gh.io/actions-lockfile
4+
version: 'v0.0.2'
5+
workflows:
6+
'.github/workflows/boj-build.yml':
7+
- 'actions/checkout@v4.1.7'
8+
'.github/workflows/bridge-gate.yml':
9+
- 'actions/checkout@v4.3.1'
10+
'.github/workflows/cargo-audit.yml': []
11+
'.github/workflows/casket-pages.yml':
12+
- 'actions/cache@v4.3.0'
13+
- 'actions/checkout@v4.1.1'
14+
- 'actions/configure-pages@v5.0.0'
15+
- 'actions/deploy-pages@v4.0.5'
16+
- 'actions/upload-pages-artifact@v3.0.1'
17+
- 'haskell-actions/setup@v2.7.5'
18+
'.github/workflows/chapel-ci.yml': []
19+
'.github/workflows/codeql.yml':
20+
- 'actions/checkout@v6.0.2'
21+
- 'github/codeql-action@v4.34.0'
22+
'.github/workflows/coverage.yml': []
23+
'.github/workflows/dependency-review.yml':
24+
- 'actions/checkout@v5.0.1'
25+
- 'actions/dependency-review-action@v4.3.4'
26+
'.github/workflows/dogfood-gate.yml':
27+
- 'actions/checkout@v4.3.1'
28+
'.github/workflows/e2e.yml': []
29+
'.github/workflows/instant-sync.yml':
30+
- 'peter-evans/repository-dispatch@v4.0.1'
31+
'.github/workflows/pages.yml':
32+
- 'actions/checkout@v4.4.0'
33+
- 'actions/deploy-pages@v4.0.5'
34+
- 'actions/upload-pages-artifact@v3.0.1'
35+
'.github/workflows/push-email-notify.yml':
36+
- 'dawidd6/action-send-mail@v3.12.0'
37+
'.github/workflows/release.yml': []
38+
'.github/workflows/scan-and-report.yml': []
39+
dependencies:
40+
'actions/cache@v4.3.0':
41+
ref: 'v4.3.0'
42+
commit: 'sha1-0057852bfaa89a56745cba8c7296529d2fc39830'
43+
owner_id: 44036562
44+
repo_id: 215566462
45+
'actions/checkout@v4.1.1':
46+
ref: 'v4.1.1'
47+
commit: 'sha1-b4ffde65f46336ab88eb53be808477a3936bae11'
48+
owner_id: 44036562
49+
repo_id: 197814629
50+
'actions/checkout@v4.1.7':
51+
ref: 'v4.1.7'
52+
commit: 'sha1-692973e3d937129bcbf40652eb9f2f61becf3332'
53+
owner_id: 44036562
54+
repo_id: 197814629
55+
'actions/checkout@v4.3.1':
56+
ref: 'v4.3.1'
57+
commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5'
58+
owner_id: 44036562
59+
repo_id: 197814629
60+
'actions/checkout@v4.4.0':
61+
ref: 'v4.4.0'
62+
commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
63+
owner_id: 44036562
64+
repo_id: 197814629
65+
'actions/checkout@v5.0.1':
66+
ref: 'v5.0.1'
67+
commit: 'sha1-93cb6efe18208431cddfb8368fd83d5badbf9bfd'
68+
owner_id: 44036562
69+
repo_id: 197814629
70+
'actions/checkout@v6.0.2':
71+
ref: 'v6.0.2'
72+
commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
73+
owner_id: 44036562
74+
repo_id: 197814629
75+
'actions/configure-pages@v5.0.0':
76+
ref: 'v5.0.0'
77+
commit: 'sha1-983d7736d9b0ae728b81ab479565c72886d7745b'
78+
owner_id: 44036562
79+
repo_id: 513659658
80+
'actions/dependency-review-action@v4.3.4':
81+
ref: 'v4.3.4'
82+
commit: 'sha1-5a2ce3f5b92ee19cbb1541a4984c76d921601d7c'
83+
owner_id: 44036562
84+
repo_id: 476372928
85+
'actions/deploy-pages@v4.0.5':
86+
ref: 'v4.0.5'
87+
commit: 'sha1-d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e'
88+
owner_id: 44036562
89+
repo_id: 438112499
90+
'actions/upload-artifact@v4':
91+
ref: 'v4'
92+
commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
93+
owner_id: 44036562
94+
repo_id: 192625955
95+
'actions/upload-pages-artifact@v3.0.1':
96+
ref: 'v3.0.1'
97+
commit: 'sha1-56afc609e74202658d3ffba0e8f6dda462b719fa'
98+
owner_id: 44036562
99+
repo_id: 496012378
100+
uses:
101+
- 'actions/upload-artifact@v4'
102+
'dawidd6/action-send-mail@v3.12.0':
103+
ref: 'v3.12.0'
104+
commit: 'sha1-6e502825a508b867ab2954ad6343b68787624c01'
105+
owner_id: 9713907
106+
repo_id: 222439721
107+
'github/codeql-action@v4.34.0':
108+
ref: 'v4.34.0'
109+
commit: 'sha1-c6f931105cb2c34c8f901cc885ba1e2e259cf745'
110+
owner_id: 9919
111+
repo_id: 259445878
112+
'haskell-actions/setup@v2.7.5':
113+
ref: 'v2.7.5'
114+
commit: 'sha1-ec49483bfc012387b227434aba94f59a6ecd0900'
115+
owner_id: 75048950
116+
repo_id: 623796603
117+
'peter-evans/repository-dispatch@v4.0.1':
118+
ref: 'v4.0.1'
119+
commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
120+
owner_id: 18365890
121+
repo_id: 220359305

‎.github/workflows/boj-build.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
name: BoJ Server Build Trigger
34
on:
@@ -12,7 +13,7 @@ jobs:
1213
timeout-minutes: 10
1314
steps:
1415
- name: Checkout
15-
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
16+
uses: actions/checkout@v4.1.7
1617
- name: Trigger BoJ Server (Casket/ssg-mcp)
1718
run: |
1819
# Send a secure trigger to boj-server to build this repository

‎.github/workflows/bridge-gate.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
34
#
@@ -29,7 +30,7 @@ jobs:
2930
runs-on: ubuntu-latest
3031
timeout-minutes: 25
3132
steps:
32-
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
33+
- uses: actions/checkout@v4.3.1
3334

3435
- name: B3 gate -- nix bumps (no network)
3536
env:

‎.github/workflows/cargo-audit.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
name: Security Audit
34

@@ -19,7 +20,7 @@ jobs:
1920
timeout-minutes: 20
2021
steps:
2122
- name: Checkout code
22-
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
23+
uses: actions/checkout@v5.0.1
2324

2425
- name: Install Rust toolchain
2526
uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable

‎.github/workflows/casket-pages.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
name: GitHub Pages
34

@@ -21,22 +22,22 @@ jobs:
2122
timeout-minutes: 20
2223
steps:
2324
- name: Checkout
24-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
25+
uses: actions/checkout@v4.1.1
2526

2627
- name: Checkout casket-ssg
27-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
28+
uses: actions/checkout@v4.1.1
2829
with:
2930
repository: hyperpolymath/casket-ssg
3031
path: .casket-ssg
3132

3233
- name: Setup GHCup
33-
uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2
34+
uses: haskell-actions/setup@v2.7.5
3435
with:
3536
ghc-version: '9.8.2'
3637
cabal-version: '3.10'
3738

3839
- name: Cache Cabal
39-
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
40+
uses: actions/cache@v4.3.0
4041
with:
4142
path: |
4243
~/.cabal/packages
@@ -98,10 +99,10 @@ jobs:
9899
touch ../_site/.nojekyll
99100
100101
- name: Setup Pages
101-
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
102+
uses: actions/configure-pages@v5.0.0
102103

103104
- name: Upload artifact
104-
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
105+
uses: actions/upload-pages-artifact@v3.0.1
105106
with:
106107
path: '_site'
107108

@@ -115,4 +116,4 @@ jobs:
115116
steps:
116117
- name: Deploy to GitHub Pages
117118
id: deployment
118-
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
119+
uses: actions/deploy-pages@v4.0.5

‎.github/workflows/chapel-ci.yml‎

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
#
34
# chapel-ci — strict CI gates for the OPTIONAL Chapel mass-panic harness.
@@ -69,7 +70,7 @@ jobs:
6970
outputs:
7071
relevant: ${{ steps.f.outputs.relevant }}
7172
steps:
72-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
73+
- uses: actions/checkout@v6.0.2
7374
with:
7475
fetch-depth: 2
7576
- id: f
@@ -102,7 +103,7 @@ jobs:
102103
runs-on: ubuntu-22.04
103104
timeout-minutes: 45
104105
steps:
105-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
106+
- uses: actions/checkout@v6.0.2
106107
- name: Install Chapel ${{ env.CHAPEL_VERSION }}
107108
run: |
108109
set -euo pipefail
@@ -125,7 +126,7 @@ jobs:
125126
runs-on: ubuntu-22.04
126127
timeout-minutes: 45
127128
steps:
128-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
129+
- uses: actions/checkout@v6.0.2
129130
- name: Install Chapel ${{ env.CHAPEL_VERSION }}
130131
run: |
131132
set -euo pipefail
@@ -141,7 +142,7 @@ jobs:
141142
chpl src/MassPanic.chpl src/Protocol.chpl src/Imaging.chpl src/Temporal.chpl -o mass-panic
142143
chpl smoke/two_repo_smoke.chpl src/Protocol.chpl src/Imaging.chpl -o smoke/two_repo_smoke
143144
- name: Upload Chapel artefacts
144-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
145+
uses: actions/upload-artifact@v4.6.2
145146
with:
146147
name: chapel-binaries
147148
path: |
@@ -156,7 +157,7 @@ jobs:
156157
runs-on: ubuntu-22.04
157158
timeout-minutes: 45
158159
steps:
159-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
160+
- uses: actions/checkout@v6.0.2
160161
- name: Install Chapel ${{ env.CHAPEL_VERSION }}
161162
run: |
162163
set -euo pipefail
@@ -165,7 +166,7 @@ jobs:
165166
curl -fsSL --retry 3 -o /tmp/chapel.deb "${{ env.CHAPEL_DEB_URL }}"
166167
sudo apt-get install -y /tmp/chapel.deb
167168
- name: Download Chapel artefacts
168-
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
169+
uses: actions/download-artifact@v4.1.8
169170
with:
170171
name: chapel-binaries
171172
path: chapel/
@@ -181,7 +182,7 @@ jobs:
181182
runs-on: ubuntu-22.04
182183
timeout-minutes: 45
183184
steps:
184-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
185+
- uses: actions/checkout@v6.0.2
185186
- name: Install Chapel ${{ env.CHAPEL_VERSION }}
186187
run: |
187188
set -euo pipefail
@@ -190,7 +191,7 @@ jobs:
190191
curl -fsSL --retry 3 -o /tmp/chapel.deb "${{ env.CHAPEL_DEB_URL }}"
191192
sudo apt-get install -y /tmp/chapel.deb
192193
- name: Download Chapel artefacts
193-
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
194+
uses: actions/download-artifact@v4.1.8
194195
with:
195196
name: chapel-binaries
196197
path: chapel/
@@ -218,9 +219,9 @@ jobs:
218219
runs-on: ubuntu-22.04
219220
timeout-minutes: 45
220221
steps:
221-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
222+
- uses: actions/checkout@v6.0.2
222223
- uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
223-
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
224+
- uses: actions/cache@v4.3.0
224225
with:
225226
path: |
226227
~/.cargo/registry
@@ -239,9 +240,9 @@ jobs:
239240
runs-on: ubuntu-22.04
240241
timeout-minutes: 45
241242
steps:
242-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
243+
- uses: actions/checkout@v6.0.2
243244
- uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
244-
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
245+
- uses: actions/cache@v4.3.0
245246
with:
246247
path: |
247248
~/.cargo/registry
@@ -256,7 +257,7 @@ jobs:
256257
curl -fsSL --retry 3 -o /tmp/chapel.deb "${{ env.CHAPEL_DEB_URL }}"
257258
sudo apt-get install -y /tmp/chapel.deb
258259
- name: Download Chapel artefacts
259-
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
260+
uses: actions/download-artifact@v4.1.8
260261
with:
261262
name: chapel-binaries
262263
path: chapel/
@@ -276,15 +277,15 @@ jobs:
276277
env:
277278
CHPL_HOME: /opt/chapel-multilocale
278279
steps:
279-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
280+
- uses: actions/checkout@v6.0.2
280281

281282
# Cache the entire built-from-source Chapel tree. Key is stable across
282283
# PRs as long as the version, conduit, launcher and cache-gen marker
283284
# don't change. Cold build is ~30-40 min on a 2-core runner; warm
284285
# restore is ~30s.
285286
- name: Cache multilocale Chapel ($CHPL_HOME)
286287
id: chapel-cache
287-
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
288+
uses: actions/cache@v4.3.0
288289
with:
289290
path: ${{ env.CHAPEL_MULTILOCALE_HOME }}
290291
key: ${{ runner.os }}-chapel-multilocale-${{ env.CHAPEL_VERSION }}-gasnet-smp-${{ env.CHAPEL_MULTILOCALE_CACHE_GEN }}

‎.github/workflows/codeql.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
name: CodeQL Security Analysis
34

@@ -40,15 +41,15 @@ jobs:
4041

4142
steps:
4243
- name: Checkout
43-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
44+
uses: actions/checkout@v6.0.2
4445

4546
- name: Initialize CodeQL
46-
uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
47+
uses: github/codeql-action/init@v4.34.0
4748
with:
4849
languages: ${{ matrix.language }}
4950
build-mode: ${{ matrix.build-mode }}
5051

5152
- name: Perform CodeQL Analysis
52-
uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
53+
uses: github/codeql-action/analyze@v4.34.0
5354
with:
5455
category: "/language:${{ matrix.language }}"

‎.github/workflows/coverage.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
name: Code Coverage
34

@@ -17,7 +18,7 @@ jobs:
1718
timeout-minutes: 20
1819
steps:
1920
- name: Checkout code
20-
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
21+
uses: actions/checkout@v5.0.1
2122

2223
- name: Install Rust toolchain
2324
uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
@@ -32,7 +33,7 @@ jobs:
3233
run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info
3334

3435
- name: Upload to codecov
35-
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5
36+
uses: codecov/codecov-action@v5.5.2
3637
with:
3738
files: lcov.info
3839
fail_ci_if_error: false

0 commit comments

Comments
 (0)