Skip to content

Commit 8726aae

Browse files
hyperpolymathArena Agent
hyperpolymath
and
Arena Agent
authored
fix(ci): reconcile actions.lock so the lockfile validates (#61)
Workflows fail at creation with `The lockfile could not be validated. Regenerate it by running gh actions-lock` / `Workflow must use a lockfile`. This regenerates the manifest with the official extension (`github/gh-actions-lock`), completes the `workflows:` map so every workflow file has an entry, and pins the SHA-form transitive deps reached via called reusables. Proof before push: every workflow re-parses, `gh actions-lock --verify` rc=0, and every `uses:` ref resolves to a pin. Co-authored-by: Arena Agent <agent@arena.ai>
1 parent 71cab83 commit 8726aae

20 files changed

Lines changed: 274 additions & 40 deletions

‎.github/workflows/actions.lock‎

Lines changed: 216 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,216 @@
1+
# This file is machine-generated by `gh actions-lock`.
2+
# Do not edit by hand; run `gh actions-lock` to update.
3+
# Docs: https://gh.io/actions-lockfile
4+
version: 'v0.0.2'
5+
workflows:
6+
'.github/workflows/boj-build.yml':
7+
- 'actions/checkout@v6.0.2'
8+
'.github/workflows/casket-pages.yml':
9+
- 'actions/cache@v4.3.0'
10+
- 'actions/checkout@v4.1.1'
11+
- 'actions/configure-pages@v5.0.0'
12+
- 'actions/deploy-pages@v4.0.5'
13+
- 'actions/upload-pages-artifact@v3.0.1'
14+
- 'haskell-actions/setup@v2.7.5'
15+
'.github/workflows/codeql.yml':
16+
- 'actions/checkout@v6.0.2'
17+
- 'github/codeql-action@v4.34.0'
18+
'.github/workflows/dependabot-automerge.yml':
19+
- 'dependabot/fetch-metadata@v2.2.0'
20+
'.github/workflows/dogfood-gate.yml':
21+
- 'actions/checkout@v4.3.1'
22+
- 'hyperpolymath/deed-ecosystem@main'
23+
- 'hyperpolymath/k9-ecosystem@main'
24+
'.github/workflows/governance.yml': []
25+
'.github/workflows/hypatia-scan.yml': []
26+
'.github/workflows/instant-sync.yml':
27+
- 'peter-evans/repository-dispatch@v4.0.1'
28+
'.github/workflows/label-triage.yml': []
29+
'.github/workflows/labels.yml': []
30+
'.github/workflows/mirror.yml': []
31+
'.github/workflows/openssf-compliance.yml':
32+
- 'actions/checkout@v4.3.1'
33+
'.github/workflows/push-email-notify.yml':
34+
- 'hyperpolymath/smtp-notify-action@v0.2.0'
35+
'.github/workflows/release.yml':
36+
- 'actions/checkout@v6.0.2'
37+
- 'actions/upload-artifact@v4.6.2'
38+
- 'softprops/action-gh-release@v2.5.0'
39+
'.github/workflows/rhodibot.yml':
40+
- 'actions/checkout@v7.0.1'
41+
'.github/workflows/rust-ci.yml': []
42+
'.github/workflows/scorecard.yml': []
43+
'.github/workflows/secret-scanner.yml': []
44+
'.github/workflows/static-analysis-gate.yml':
45+
- 'actions/checkout@v6.0.2'
46+
- 'actions/download-artifact@v4.1.8'
47+
- 'actions/upload-artifact@v4.6.2'
48+
- 'erlef/setup-beam@v1.20.4'
49+
dependencies:
50+
'actions/cache@v4.3.0':
51+
ref: 'v4.3.0'
52+
commit: 'sha1-0057852bfaa89a56745cba8c7296529d2fc39830'
53+
owner_id: 44036562
54+
repo_id: 215566462
55+
'actions/checkout@v4.1.1':
56+
ref: 'v4.1.1'
57+
commit: 'sha1-b4ffde65f46336ab88eb53be808477a3936bae11'
58+
owner_id: 44036562
59+
repo_id: 197814629
60+
'actions/checkout@v4.3.1':
61+
ref: 'v4.3.1'
62+
commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5'
63+
owner_id: 44036562
64+
repo_id: 197814629
65+
'actions/checkout@v6.0.2':
66+
ref: 'v6.0.2'
67+
commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
68+
owner_id: 44036562
69+
repo_id: 197814629
70+
'actions/checkout@v7.0.1':
71+
ref: 'v7.0.1'
72+
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
73+
owner_id: 44036562
74+
repo_id: 197814629
75+
'actions/configure-pages@v5.0.0':
76+
ref: 'v5.0.0'
77+
commit: 'sha1-983d7736d9b0ae728b81ab479565c72886d7745b'
78+
owner_id: 44036562
79+
repo_id: 513659658
80+
'actions/deploy-pages@v4.0.5':
81+
ref: 'v4.0.5'
82+
commit: 'sha1-d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e'
83+
owner_id: 44036562
84+
repo_id: 438112499
85+
'actions/download-artifact@v4.1.8':
86+
ref: 'v4.1.8'
87+
commit: 'sha1-fa0a91b85d4f404e444e00e005971372dc801d16'
88+
owner_id: 44036562
89+
repo_id: 192626254
90+
'actions/upload-artifact@v4':
91+
ref: 'v4'
92+
commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
93+
owner_id: 44036562
94+
repo_id: 192625955
95+
'actions/upload-artifact@v4.6.2':
96+
ref: 'v4.6.2'
97+
commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
98+
owner_id: 44036562
99+
repo_id: 192625955
100+
'actions/upload-pages-artifact@v3.0.1':
101+
ref: 'v3.0.1'
102+
commit: 'sha1-56afc609e74202658d3ffba0e8f6dda462b719fa'
103+
owner_id: 44036562
104+
repo_id: 496012378
105+
uses:
106+
- 'actions/upload-artifact@v4'
107+
'dependabot/fetch-metadata@v2.2.0':
108+
ref: 'v2.2.0'
109+
commit: 'sha1-dbb049abf0d677abbd7f7eee0375145b417fdd34'
110+
owner_id: 27347476
111+
repo_id: 371068214
112+
'erlef/setup-beam@v1.20.4':
113+
ref: 'v1.20.4'
114+
commit: 'sha1-e6d7c94229049569db56a7ad5a540c051a010af9'
115+
owner_id: 47606891
116+
repo_id: 331103973
117+
'github/codeql-action@v4.34.0':
118+
ref: 'v4.34.0'
119+
commit: 'sha1-c6f931105cb2c34c8f901cc885ba1e2e259cf745'
120+
owner_id: 9919
121+
repo_id: 259445878
122+
'haskell-actions/setup@v2.7.5':
123+
ref: 'v2.7.5'
124+
commit: 'sha1-ec49483bfc012387b227434aba94f59a6ecd0900'
125+
owner_id: 75048950
126+
repo_id: 623796603
127+
'hyperpolymath/deed-ecosystem@main':
128+
ref: 'main'
129+
commit: 'sha1-aa4b836bd969df2bc58128cb8e3d20bbc88d5e79'
130+
owner_id: 6759885
131+
repo_id: 1275649586
132+
'hyperpolymath/k9-ecosystem@main':
133+
ref: 'main'
134+
commit: 'sha1-89f3c2702f4f650a92aa7411502f38da06abd562'
135+
owner_id: 6759885
136+
repo_id: 1275650185
137+
'hyperpolymath/smtp-notify-action@v0.2.0':
138+
ref: 'v0.2.0'
139+
commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7'
140+
owner_id: 6759885
141+
repo_id: 1352485172
142+
'peter-evans/repository-dispatch@v4.0.1':
143+
ref: 'v4.0.1'
144+
commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
145+
owner_id: 18365890
146+
repo_id: 220359305
147+
'softprops/action-gh-release@v2.5.0':
148+
ref: 'v2.5.0'
149+
commit: 'sha1-a06a81a03ee405af7f2048a818ed3f03bbf83c7b'
150+
owner_id: 2242
151+
repo_id: 204253808
152+
'Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6':
153+
ref: 'v2'
154+
commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
155+
owner_id: 580492
156+
repo_id: 298565987
157+
'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
158+
ref: 'v6.1.0'
159+
commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
160+
owner_id: 44036562
161+
repo_id: 215566462
162+
'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
163+
ref: 'v7.0.1'
164+
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
165+
owner_id: 44036562
166+
repo_id: 197814629
167+
'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a':
168+
ref: 'v7.0.1'
169+
commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
170+
owner_id: 44036562
171+
repo_id: 192625955
172+
'actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08':
173+
ref: 'v4.6.0'
174+
commit: 'sha1-65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08'
175+
owner_id: 44036562
176+
repo_id: 192625955
177+
'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
178+
ref: 'v2.0.5'
179+
commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
180+
owner_id: 42048915
181+
repo_id: 356423100
182+
'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772':
183+
ref: 'stable'
184+
commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
185+
owner_id: 1940490
186+
repo_id: 260749683
187+
'editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c':
188+
ref: 'v2.2.0'
189+
commit: 'sha1-840e866d93b8e032123c23bac69dece044d4d84c'
190+
owner_id: 26415196
191+
repo_id: 297874902
192+
'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
193+
ref: 'v1.24.1'
194+
commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
195+
owner_id: 47606891
196+
repo_id: 331103973
197+
'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406':
198+
ref: 'v2.2.1'
199+
commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406'
200+
owner_id: 1006268
201+
repo_id: 212984112
202+
'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc':
203+
ref: 'v2.4.4'
204+
commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
205+
owner_id: 67707773
206+
repo_id: 421101922
207+
'softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda':
208+
ref: 'v2.2.1'
209+
commit: 'sha1-c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda'
210+
owner_id: 2242
211+
repo_id: 204253808
212+
'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555':
213+
ref: 'v0.10.0'
214+
commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555'
215+
owner_id: 135788
216+
repo_id: 208510314

‎.github/workflows/boj-build.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
#
34
# OPTIONAL: BoJ Server Build Trigger
@@ -16,7 +17,7 @@ jobs:
1617
runs-on: ubuntu-latest
1718
steps:
1819
- name: Checkout
19-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
20+
uses: actions/checkout@v6.0.2
2021
- name: Trigger BoJ Server (Casket/ssg-mcp)
2122
env:
2223
BOJ_URL: ${{ secrets.BOJ_SERVER_URL || vars.BOJ_SERVER_URL }}

‎.github/workflows/casket-pages.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
name: GitHub Pages
34

@@ -21,22 +22,22 @@ jobs:
2122
runs-on: ubuntu-latest
2223
steps:
2324
- name: Checkout
24-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
25+
uses: actions/checkout@v4.1.1
2526

2627
- name: Checkout casket-ssg
27-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
28+
uses: actions/checkout@v4.1.1
2829
with:
2930
repository: hyperpolymath/casket-ssg
3031
path: .casket-ssg
3132

3233
- name: Setup GHCup
33-
uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2
34+
uses: haskell-actions/setup@v2.7.5
3435
with:
3536
ghc-version: '9.8.2'
3637
cabal-version: '3.10'
3738

3839
- name: Cache Cabal
39-
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
40+
uses: actions/cache@v4.3.0
4041
with:
4142
path: |
4243
~/.cabal/packages
@@ -98,10 +99,10 @@ jobs:
9899
touch ../_site/.nojekyll
99100
100101
- name: Setup Pages
101-
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
102+
uses: actions/configure-pages@v5.0.0
102103

103104
- name: Upload artifact
104-
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
105+
uses: actions/upload-pages-artifact@v3.0.1
105106
with:
106107
path: '_site'
107108

@@ -114,4 +115,4 @@ jobs:
114115
steps:
115116
- name: Deploy to GitHub Pages
116117
id: deployment
117-
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
118+
uses: actions/deploy-pages@v4.0.5

‎.github/workflows/codeql.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
name: CodeQL Security Analysis
34

@@ -37,15 +38,15 @@ jobs:
3738
build-mode: none
3839
steps:
3940
- name: Checkout
40-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
41+
uses: actions/checkout@v6.0.2
4142

4243
- name: Initialize CodeQL
43-
uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
44+
uses: github/codeql-action/init@v4.34.0
4445
with:
4546
languages: ${{ matrix.language }}
4647
build-mode: ${{ matrix.build-mode }}
4748

4849
- name: Perform CodeQL Analysis
49-
uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
50+
uses: github/codeql-action/analyze@v4.34.0
5051
with:
5152
category: "/language:${{ matrix.language }}"

‎.github/workflows/dependabot-automerge.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
#
34
# dependabot-automerge.yml — enable GitHub's native auto-merge on
@@ -55,7 +56,7 @@ jobs:
5556
steps:
5657
- name: Fetch Dependabot metadata
5758
id: meta
58-
uses: dependabot/fetch-metadata@dbb049abf0d677abbd7f7eee0375145b417fdd34 # v2.2.0
59+
uses: dependabot/fetch-metadata@v2.2.0
5960
with:
6061
github-token: ${{ secrets.GITHUB_TOKEN }}
6162

‎.github/workflows/dogfood-gate.yml‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
34
#
@@ -26,7 +27,7 @@ jobs:
2627

2728
steps:
2829
- name: Checkout repository
29-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
30+
uses: actions/checkout@v4.3.1
3031

3132
- name: Check for manifest files (.a2ml/.deed)
3233
id: detect
@@ -39,7 +40,7 @@ jobs:
3940
4041
- name: Validate DEED manifests
4142
if: steps.detect.outputs.count > 0
42-
uses: hyperpolymath/deed-ecosystem/validate-action@aa4b836bd969df2bc58128cb8e3d20bbc88d5e79 # main
43+
uses: hyperpolymath/deed-ecosystem/validate-action@main
4344
with:
4445
path: '.'
4546
strict: 'false'
@@ -70,7 +71,7 @@ jobs:
7071

7172
steps:
7273
- name: Checkout repository
73-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
74+
uses: actions/checkout@v4.3.1
7475

7576
- name: Check for K9 files
7677
id: detect
@@ -87,7 +88,7 @@ jobs:
8788
8889
- name: Validate K9 contracts
8990
if: steps.detect.outputs.k9_count > 0
90-
uses: hyperpolymath/k9-ecosystem/validate-action@89f3c2702f4f650a92aa7411502f38da06abd562 # main
91+
uses: hyperpolymath/k9-ecosystem/validate-action@main
9192
with:
9293
path: '.'
9394
strict: 'false'
@@ -119,7 +120,7 @@ jobs:
119120

120121
steps:
121122
- name: Checkout repository
122-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
123+
uses: actions/checkout@v4.3.1
123124

124125
- name: Scan for invisible characters
125126
id: lint
@@ -183,7 +184,7 @@ jobs:
183184

184185
steps:
185186
- name: Checkout repository
186-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
187+
uses: actions/checkout@v4.3.1
187188

188189
- name: Check for Groove manifest
189190
id: groove
@@ -241,7 +242,7 @@ jobs:
241242

242243
steps:
243244
- name: Checkout repository
244-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
245+
uses: actions/checkout@v4.3.1
245246

246247
- name: Check and validate eclexiaiser manifest
247248
id: eclex
@@ -312,7 +313,7 @@ jobs:
312313

313314
steps:
314315
- name: Checkout repository
315-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
316+
uses: actions/checkout@v4.3.1
316317

317318
- name: Generate dogfooding scorecard
318319
run: |

0 commit comments

Comments
 (0)