Repository navigation
fix(ci): regenerate actions.lock after the Dependabot actions bump (#110) - #112
Merged
Merged
Conversation
) #110 bumped four `uses:` refs and left actions.lock pinning the old ones: - github/codeql-action v4.38.2 -> v4.38.3 - hyperpolymath/smtp-notify-action v0.3.0 -> v0.5.0 - actions/upload-artifact v7.0.1 -> v7.0.2 - actions/download-artifact v8.0.1 -> v8.0.2 Since then "Governance / Actions lockfile verify" has been red on main. GitHub also refuses to start codeql.yml and static-analysis-gate.yml (startup_failure on every run), so the required "analyze (actions, none)" check never reports, and CodeQL has not scanned main since 11 Oct. Only actions.lock changes. It is the output of the estate repair order: gh actions-lock v0.2.0, relock-sha-keys, complete-job-refs, close-lock and prune-stale, run by `regen_lock` from standards scripts/regen-dependabot-locks.sh at ae36881b. GitHub Actions ran it on main e81d057, because Claude Code sessions cannot reach GitHub GraphQL. The lockfile schema moves v0.0.2 -> v0.0.3. Dependabot's lock support reads both versions. Verified: - in CI, check-actions-lock-gate.sh at this repo's governance pin (standards 8f2ee508): pass; - here, the decoded bytes match the CI job's SHA-256 (6a06b778...); - the same gate passes locally; - `gh actions-lock --verify-local` reports only the 7 known reusable-workflow false positives, which the gate accepts as coverage. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
Contributor
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
9 of 10 tasks
hyperpolymath
marked this pull request as ready for review
October 14, 2026 09:43
…w linter The copied "Verify immutable action lockfile" step pinned its own gh-actions-lock v0.1.6 binary. v0.1.6 cannot read lockfile v0.0.3, which every current `gh actions-lock` writes, so the step failed whenever a current tool refreshed the lock (proof-burrower#111/#112). It also kept a second version pin that drifts from the estate's. Governance already verifies the lock through standards scripts/update-actions-lock.sh. That is one tested implementation, with one pin, and it accepts reusable-workflow coverage. The step is removed and a comment points at the gate. No `uses:` changes, so actions.lock is untouched. Owner decision 2026-10-14: drop the lock step from copied linters; the estate moves to gh-actions-lock v0.2.0 in hyperpolymath/standards#1250. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
8 of 9 tasks
…on-th4e9w-lock Ports #113 (drop the copied pinned lock step) so lint-workflows stops failing on this PR's lockfile v0.0.3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
hyperpolymath
added a commit
that referenced
this pull request
Oct 14, 2026
…w linter (#113) ## Summary "Workflow Security Linter / lint-workflows" has failed on every `main` push since 2026-10-05, and now on #111/#112. It failed for two reasons, both caused by the copied "Verify immutable action lockfile" step: - **Version skew.** The step pins its own gh-actions-lock **v0.1.6**, which cannot read lockfile **v0.0.3**: ``` lockfile version v0.0.3 is newer than this binary supports (v0.0.2) ``` Every current `gh actions-lock` writes v0.0.3, including the regeneration in #112. - **Duplicate verifier.** It ran a second lock check beside governance's, with its own version pin. That pin drifts from the estate's, and the raw tool doesn't apply the reusable-workflow coverage rule that governance's verifier applies. Governance's **Actions lockfile verify** (standards `scripts/update-actions-lock.sh`) is the single tested implementation. This PR removes the duplicate step and leaves a comment pointing at the gate. Owner decision 2026-10-14 (selector): drop the lock step from copied linters, and move the estate to gh-actions-lock v0.2.0 (hyperpolymath/standards#1250). Pilot repos first: proof-burrower, echidna, echidnabot. The rest of the estate follows in the wave. ## Changes - `.github/workflows/workflow-linter.yml`: the pinned-binary lock step is replaced by a comment. The SPDX, permissions and duplicate-workflow checks are unchanged. - No `uses:` changes, so `actions.lock` is untouched. ## RSR Quality Checklist ### Required - [x] Tests pass: the remaining linter steps are unchanged. - [x] Code is formatted (n/a, YAML only). - [x] Linter is clean: actionlint v1.7.7 clean; the workflow duplicate-key check is clean. - [x] No banned language patterns. - [x] No `unsafe` blocks without `// SAFETY:` comments (n/a). - [x] No banned functions (n/a). - [x] SPDX license headers present on all new/modified source files. - [x] No secrets, credentials, or `.env` files included. ### As Applicable - [ ] `.machine_readable/descriptiles/STATE.a2ml` updated (n/a; A2ML is retired) ## Testing - Reproduced the failure locally with the release binaries: v0.1.6 `--rescan --no-fix` on #111's lock exits 2 with the message above. - Governance's verifier still covers this repo: governance.yml pins standards 8f2ee508, whose `actions-lock-verify` job passed on #111/#112. - This repo's `main` lock is stale (#110). It stays red under governance's gate until #112 lands, which is the intended behaviour. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- _Generated by [Claude Code](https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Oct 14, 2026
…YAML / I-JSON+JCS / UUID v8 (#111) ## Summary Adds a root `CLAUDE.md` that records the owner's norms of 2026-10-14 for agent sessions in this repository. It goes at the root because `.claude/` is gitignored here. echidna and echidnabot carry the same text. ## Changes - `CLAUDE.md` (new): - decisions are asked with the selector tool; - work lands as stacked PRs; - findings are fixed at source. The exemption ratchet admits ledger growth only with a `Ratchet-exception:` line naming that ledger. - The format standards point at their normative source in `hyperpolymath/standards` rather than restating it: - `3-practice/YAML-POLICY.adoc` §3.4: KYAML, `.kyaml` (D280, D307, D293); - the workflow gate in standards#1025; - `3-practice/JSON-POLICY.adoc`: I-JSON as JCS plus a final LF (D306); - ADR-008: UUID v8. It is scoped as the owner accepted from review: v7 records and v8 JCS content ids until the `crates/burrower-core/src/ids.rs` migration lands. The `actions.lock` regeneration this PR used to carry (ported from #112) is now on `main` via #113, together with the workflow-linter change. Since the merge of `main` (ae9a0a9), this PR changes `CLAUDE.md` only. ## RSR Quality Checklist ### Required - [x] Tests pass (docs only) - [x] Code is formatted (n/a) - [x] Linter is clean (n/a) - [x] No banned language patterns - [x] No `unsafe` blocks without `// SAFETY:` comments - [x] No banned functions - [x] SPDX license headers present on all new/modified source files - [x] No secrets, credentials, or `.env` files included ### As Applicable - [x] Documentation updated for user-facing changes - [ ] Others: n/a The repo's migration to these formats follows in its own stacked PRs. That includes the `ids.rs` move to profiles T and C, with the shared `proof-goal` domain from standards#1246, and the ledger `goal_id` migration. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This turns main's red "Governance / Actions lockfile verify" green, and lets CodeQL and the static-analysis gate start again. The same commit is ported into #111.
#110 bumped four
uses:refs but leftactions.lockpinning the old ones:github/codeql-actionv4.38.2 → v4.38.3hyperpolymath/smtp-notify-actionv0.3.0 → v0.5.0actions/upload-artifactv7.0.1 → v7.0.2actions/download-artifactv8.0.1 → v8.0.2GitHub refuses to start a workflow whose refs disagree with the lock. So
codeql.ymlandstatic-analysis-gate.ymlhave ended instartup_failureon every run since 11 Oct. The requiredanalyze (actions, none)check waits forever, and CodeQL has not scanned main since then.Changes
.github/workflows/actions.lockonly. Lockfile schema v0.0.2 → v0.0.3; Dependabot's lock support reads both versions.How it was produced
regen_lockin standardsscripts/regen-dependabot-locks.shatae36881b:gh actions-lockv0.2.0, thenrelock-sha-keys,complete-job-refs,close-lockandprune-stale.e81d057(run 38543818637). Claude Code cloud sessions cannot reach GitHub GraphQL, whichgh actions-lockneeds, so the tool could not run locally.uses:steps, wrote nothing back, and is deleted.Verification
check-actions-lock-gate.shat this repo's governance pin (standards8f2ee508) passes (GATE_RC=0).6a06b778…ba02;gh actions-lock --verify-localreports only the 7 known reusable-workflowstalefalse positives, which the gate accepts as coverage.ref-changedfindings and the stale Dependabot entries are gone.Keeping it fixed
standards'
dependabot-lock-regen.ymlregenerates the lock on every Dependabot PR. It is inert until the pin-applier App (APP_ID/APP_PRIVATE_KEY) exists, and it has been disabled since 9 Oct. The owner has chosen to set the App up and re-enable it. "Actions lockfile verify" then becomes a required check, so drift like #110 can't land through automerge again.🤖 Generated with Claude Code
https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
Generated by Claude Code