From ca8de26b78279ccb430fe726cf8dcdfde04bf355 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 20 Sep 2026 02:09:57 +0000 Subject: [PATCH] fix(ci): reconcile the workflows with actions.lock (gh-actions-lock v0.1.6) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `actions.lock` is authoritative: the workflows carry readable refs and the lock records the commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest make the whole repository unstartable — `startup_failure`, "Invalid lockfile". Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are reverted to their readable form here precisely because the lockfile, not the workflow, is what pins them. --- .github/workflows/actions.lock | 19 +++++-- .github/workflows/boj-build.yml | 3 +- .github/workflows/codeql.yml | 7 +-- .github/workflows/dependabot-automerge.yml | 3 +- .github/workflows/dogfood-gate.yml | 17 ++++--- .github/workflows/governance.yml | 1 + .github/workflows/guix-nix-policy.yml | 3 +- .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 3 +- .github/workflows/label-triage.yml | 1 + .github/workflows/labels.yml | 1 + .github/workflows/main-estate-audit.yml | 55 +++++++++++---------- .github/workflows/mirror.yml | 1 + .github/workflows/openssf-compliance.yml | 3 +- .github/workflows/pages.yml | 9 ++-- .github/workflows/proof-safety.yml | 7 +-- .github/workflows/push-email-notify.yml | 3 +- .github/workflows/quality.yml | 7 +-- .github/workflows/release.yml | 11 +++-- .github/workflows/rhodibot.yml | 2 +- .github/workflows/runtime-policy.yml | 3 +- .github/workflows/rust-ci.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/security-policy.yml | 3 +- .github/workflows/static-analysis-gate.yml | 23 ++++----- .github/workflows/wellknown-enforcement.yml | 3 +- .github/workflows/workflow-linter.yml | 3 +- 28 files changed, 117 insertions(+), 78 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 77386a0..be3b069 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -124,17 +124,30 @@ dependencies: repo_id: 259445878 'hyperpolymath/a2ml-ecosystem@main': ref: 'main' - commit: 'sha1-aa4b836bd969df2bc58128cb8e3d20bbc88d5e79' + commit: 'sha1-ed83d6927e8fb21431e403dbf6d7a4af96772746' owner_id: 6759885 repo_id: 1275649586 'hyperpolymath/cicd-suite@main': ref: 'main' - commit: 'sha1-fc64172aa53e85289d5d7d6e15c2435a867cc1c9' + commit: 'sha1-180b419825d238f8b606584c970a81dfa7cb6f81' owner_id: 6759885 repo_id: 1326697643 + uses: + - 'hyperpolymath/deed-ecosystem@f9d999b60cb5f383679ea19912bcdc49c944973a' + - 'hyperpolymath/k9-ecosystem@2155aa26a21758f2ba119f61bc7e0e1981c106fb' + 'hyperpolymath/deed-ecosystem@f9d999b60cb5f383679ea19912bcdc49c944973a': + ref: 'main' + commit: 'sha1-f9d999b60cb5f383679ea19912bcdc49c944973a' + owner_id: 6759885 + repo_id: 1275649586 + 'hyperpolymath/k9-ecosystem@2155aa26a21758f2ba119f61bc7e0e1981c106fb': + ref: 'main' + commit: 'sha1-2155aa26a21758f2ba119f61bc7e0e1981c106fb' + owner_id: 6759885 + repo_id: 1275650185 'hyperpolymath/k9-ecosystem@main': ref: 'main' - commit: 'sha1-89f3c2702f4f650a92aa7411502f38da06abd562' + commit: 'sha1-c1a34884054fabf0e9de81dbf68f4ba7874e85f1' owner_id: 6759885 repo_id: 1275650185 'hyperpolymath/smtp-notify-action@v0.2.0': diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 68f212b..3623739 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # @@ -20,7 +21,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Trigger BoJ Server (Casket/ssg-mcp) env: BOJ_URL: ${{ secrets.BOJ_SERVER_URL || vars.BOJ_SERVER_URL }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d899040..e802094 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: CodeQL Security Analysis @@ -37,13 +38,13 @@ jobs: build-mode: none steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Initialize CodeQL - uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0 + uses: github/codeql-action/init@v4.34.0 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0 + uses: github/codeql-action/analyze@v4.34.0 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index efebd62..5e66e56 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # @@ -53,7 +54,7 @@ jobs: steps: - name: Fetch Dependabot metadata id: meta - uses: dependabot/fetch-metadata@dbb049abf0d677abbd7f7eee0375145b417fdd34 # v2.2.0 + uses: dependabot/fetch-metadata@v2.2.0 with: github-token: ${{ secrets.GITHUB_TOKEN }} # --- Policy gate ------------------------------------------------------- diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index d2a3e0a..7b9ddb1 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) @@ -28,7 +29,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@v4.3.1 - name: Check for A2ML files id: detect @@ -41,7 +42,7 @@ jobs: - name: Validate A2ML manifests if: steps.detect.outputs.count > 0 - uses: hyperpolymath/a2ml-ecosystem/validate-action@ed83d6927e8fb21431e403dbf6d7a4af96772746 # main + uses: hyperpolymath/a2ml-ecosystem/validate-action@main with: path: '.' strict: 'false' @@ -73,7 +74,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@v4.3.1 - name: Check for K9 files id: detect @@ -90,7 +91,7 @@ jobs: - name: Validate K9 contracts if: steps.detect.outputs.k9_count > 0 - uses: hyperpolymath/k9-ecosystem/validate-action@c1a34884054fabf0e9de81dbf68f4ba7874e85f1 # main + uses: hyperpolymath/k9-ecosystem/validate-action@main with: path: '.' strict: 'false' @@ -123,7 +124,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@v4.3.1 - name: Scan for invisible characters id: lint @@ -188,7 +189,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@v4.3.1 - name: Check for Groove manifest id: groove @@ -247,7 +248,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@v4.3.1 - name: Check and validate eclexiaiser manifest id: eclex @@ -313,7 +314,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@v4.3.1 - name: Generate dogfooding scorecard run: | diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index bf5aae0..974aaf8 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Governance diff --git a/.github/workflows/guix-nix-policy.yml b/.github/workflows/guix-nix-policy.yml index cddc0f3..5c51255 100644 --- a/.github/workflows/guix-nix-policy.yml +++ b/.github/workflows/guix-nix-policy.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Guix/Nix Package Policy @@ -21,7 +22,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Enforce Guix primary / Nix fallback run: | # Check for package manager files diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 97371f0..8ca260f 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Hypatia Security Scan diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index b480bd2..74c6ba9 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Instant Forge Sync - Triggers propagation to all forges on push/release @@ -16,7 +17,7 @@ jobs: timeout-minutes: 15 steps: - name: Trigger Propagation - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 + uses: peter-evans/repository-dispatch@v4.0.1 with: token: ${{ secrets.FARM_DISPATCH_TOKEN }} repository: hyperpolymath/.git-private-farm diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml index fc79947..da34fac 100644 --- a/.github/workflows/label-triage.yml +++ b/.github/workflows/label-triage.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Label Triage diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index af34c6b..be2ff5c 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Labels diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml index 7d4dd9b..6bd2a60 100755 --- a/.github/workflows/main-estate-audit.yml +++ b/.github/workflows/main-estate-audit.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. @@ -17,82 +18,82 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: actions/checkout@v4.4.0 - name: Required Files Gate - uses: hyperpolymath/cicd-suite/actions/required-files-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/required-files-check@main - name: Code Hygiene Gate - uses: hyperpolymath/cicd-suite/actions/code-hygiene-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/code-hygiene-check@main - name: Manifest Validation Gate - uses: hyperpolymath/cicd-suite/actions/manifest-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/manifest-check@main - name: Idris2 ABI Purity Gate - uses: hyperpolymath/cicd-suite/actions/idris2-abi-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/idris2-abi-check@main - name: Zig Hexadeca API Gate - uses: hyperpolymath/cicd-suite/actions/zig-hexadeca-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/zig-hexadeca-check@main - name: Contractile Validation Gate - uses: hyperpolymath/cicd-suite/actions/contractile-validation-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/contractile-validation-check@main - name: Recipes Set Validation Gate - uses: hyperpolymath/cicd-suite/actions/recipes-set-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/recipes-set-check@main - name: Affirmation Document Gate - uses: hyperpolymath/cicd-suite/actions/affirmation-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/affirmation-check@main - name: Academic Referencing Gate - uses: hyperpolymath/cicd-suite/actions/referencing-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/referencing-check@main - name: Semantic Audit Gate - uses: hyperpolymath/cicd-suite/actions/semantic-audit-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/semantic-audit-check@main - name: SPDX License Gate - uses: hyperpolymath/cicd-suite/actions/spdx-license-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/spdx-license-check@main - name: Proof Runner Gate - uses: hyperpolymath/cicd-suite/actions/proof-runner-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/proof-runner-check@main - name: PRAT Testing Gate - uses: hyperpolymath/cicd-suite/actions/prat-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/prat-check@main - name: Panic Attack & Pons Gate - uses: hyperpolymath/cicd-suite/actions/custom-tools-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/custom-tools-check@main - name: WWW & Well-Known Compliance Gate - uses: hyperpolymath/cicd-suite/actions/www-compliance-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/www-compliance-check@main - name: BoJ Cartridge Validation Gate - uses: hyperpolymath/cicd-suite/actions/boj-cartridge-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/boj-cartridge-check@main - name: Formatting Validation Gate - uses: hyperpolymath/cicd-suite/actions/formatting-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/formatting-check@main - name: Accreditations & Badges Gate - uses: hyperpolymath/cicd-suite/actions/badges-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/badges-check@main - name: Metrics Extraction Gate - uses: hyperpolymath/cicd-suite/actions/metrics-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/metrics-check@main - name: Linguist & Banned Languages Gate - uses: hyperpolymath/cicd-suite/actions/linguist-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/linguist-check@main - name: Test & Benchmarks Dashboard Gate - uses: hyperpolymath/cicd-suite/actions/tests-benches-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/tests-benches-check@main - name: Hosting & Site Status Gate - uses: hyperpolymath/cicd-suite/actions/hosting-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/hosting-check@main - name: Git-Sea Analytics Gate - uses: hyperpolymath/cicd-suite/actions/gitsea-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/gitsea-check@main - name: Trust & Humans Validation Gate - uses: hyperpolymath/cicd-suite/actions/trust-humans-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/trust-humans-check@main - name: Are We UnAPI Gate (Secret Scanning) - uses: hyperpolymath/cicd-suite/actions/secrets-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/secrets-check@main - name: Reasonably Good Token Validation Gate - uses: hyperpolymath/cicd-suite/actions/vaulted-tokens-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/vaulted-tokens-check@main diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 42884ab..b50baec 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Mirror to Git Forges diff --git a/.github/workflows/openssf-compliance.yml b/.github/workflows/openssf-compliance.yml index 58ef9e4..a9c7f1d 100644 --- a/.github/workflows/openssf-compliance.yml +++ b/.github/workflows/openssf-compliance.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # OpenSSF Best Practices compliance gate — blocks PRs and pushes that lack @@ -19,7 +20,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@v4.3.1 with: persist-credentials: false - name: Check SECURITY.md exists and has substance diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 99b9221..67cdc84 100755 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: GitHub Pages (Ddraig SSG) @@ -20,11 +21,11 @@ jobs: image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff steps: - name: Checkout Site - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@v4.4.0 with: persist-credentials: false - name: Checkout Ddraig SSG - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@v4.4.0 with: repository: hyperpolymath/ddraig-ssg ref: 43e1b9c4c970994bc32313c3e2e21a5e0bba8f77 @@ -45,7 +46,7 @@ jobs: ./.ddraig-ssg/build/exec/ddraig build .site-src _site https://hyperpolymath.github.io/proof-burrower/ test -s _site/index.html - name: Upload artifact - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 + uses: actions/upload-pages-artifact@v3.0.1 with: path: '_site' deploy: @@ -62,4 +63,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 + uses: actions/deploy-pages@v4.0.5 diff --git a/.github/workflows/proof-safety.yml b/.github/workflows/proof-safety.yml index 26d1688..743bbe2 100644 --- a/.github/workflows/proof-safety.yml +++ b/.github/workflows/proof-safety.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Proof Safety @@ -16,16 +17,16 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 45 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/echidna ref: 556d64687a8872026c81e4689ac3d574c7acc6ce path: _echidna persist-credentials: false - - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + - uses: Swatinem/rust-cache@v2.9.2 with: workspaces: | . -> target diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index d1bfa36..579479c 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable @@ -40,7 +41,7 @@ jobs: timeout-minutes: 5 steps: - name: Send push notification email - uses: hyperpolymath/smtp-notify-action@ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7 # v0.2.0 + uses: hyperpolymath/smtp-notify-action@v0.2.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index c6d3766..068b6a8 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Code Quality @@ -21,7 +22,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Check file permissions run: | find . -type f -perm /111 -name "*.sh" | head -10 || true @@ -33,7 +34,7 @@ jobs: run: | find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files" - name: EditorConfig check - uses: editorconfig-checker/action-editorconfig-checker@4b6cd6190d435e7e084fb35e36a096e98506f7b9 # v2.1.0 + uses: editorconfig-checker/action-editorconfig-checker@v2.1.0 continue-on-error: true docs: runs-on: ubuntu-latest @@ -41,7 +42,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Check documentation run: | MISSING="" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 79a1931..bbaa6f6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) @@ -21,7 +22,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Detect project type and build id: build run: | @@ -82,7 +83,7 @@ jobs: changelog: ${{ steps.cliff.outputs.content }} version: ${{ steps.version.outputs.version }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - name: Extract version from tag @@ -107,7 +108,7 @@ jobs: run: | git cliff --output CHANGELOG.md - name: Upload updated CHANGELOG.md - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@v4.6.2 with: name: changelog path: CHANGELOG.md @@ -120,14 +121,14 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 # TODO: Download build artifacts if uploading to the release # - uses: actions/download-artifact@v4 # with: # name: release-artifacts # path: artifacts/ - name: Create GitHub Release - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 + uses: softprops/action-gh-release@v2.5.0 with: body: ${{ needs.changelog.outputs.changelog }} draft: false diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml index 255ddea..29dc13e 100644 --- a/.github/workflows/rhodibot.yml +++ b/.github/workflows/rhodibot.yml @@ -34,7 +34,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: fetch-depth: 1 - name: Rhodibot — detect drift (no mutations) diff --git a/.github/workflows/runtime-policy.yml b/.github/workflows/runtime-policy.yml index 7582446..aacf073 100644 --- a/.github/workflows/runtime-policy.yml +++ b/.github/workflows/runtime-policy.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Runtime and package-manager policy check. @@ -37,7 +38,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Report runtime tier and reject mixed toolchains run: | diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index e7ca3a3..6e47e02 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Rust CI — thin wrapper calling the shared estate reusable in diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 646c698..f65fb84 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: OSSF Scorecard diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index c9f62b3..f5b5e7a 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Secret Scanner diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml index f99aa8c..50057ce 100644 --- a/.github/workflows/security-policy.yml +++ b/.github/workflows/security-policy.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Security Policy @@ -21,7 +22,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Security checks run: | FAILED=false diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml index f07f925..ffb0467 100644 --- a/.github/workflows/static-analysis-gate.yml +++ b/.github/workflows/static-analysis-gate.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Static Analysis Gate — Required by branch protection rules. @@ -21,7 +22,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - name: Install panic-attack (if available) @@ -118,7 +119,7 @@ jobs: echo "" >> "$GITHUB_STEP_SUMMARY" echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload panic-attack findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@v4.6.2 with: name: panic-attack-findings path: panic-attack-findings.json @@ -137,13 +138,13 @@ jobs: timeout-minutes: 15 steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - name: Setup Elixir for Hypatia scanner id: beam continue-on-error: true - uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.20.4 + uses: erlef/setup-beam@v1.20.4 with: elixir-version: '1.19.4' otp-version: '28.3' @@ -244,7 +245,7 @@ jobs: echo "" >> "$GITHUB_STEP_SUMMARY" echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload hypatia findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@v4.6.2 with: name: hypatia-findings path: hypatia-findings.json @@ -263,7 +264,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - name: Install panic-attack (if available) @@ -325,7 +326,7 @@ jobs: echo "" >> "$GITHUB_STEP_SUMMARY" echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload bridge report - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@v4.6.2 with: name: bridge-report path: bridge-report.json @@ -347,17 +348,17 @@ jobs: if: always() steps: - name: Download panic-attack findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 + uses: actions/download-artifact@v4.1.8 with: name: panic-attack-findings path: findings/ - name: Download hypatia findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 + uses: actions/download-artifact@v4.1.8 with: name: hypatia-findings path: findings/ - name: Download bridge report - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 + uses: actions/download-artifact@v4.1.8 with: name: bridge-report path: findings/ @@ -417,7 +418,7 @@ jobs: echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" echo "low=$LOW" >> "$GITHUB_OUTPUT" - name: Upload unified findings (fleet scanner picks these up) - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@v4.6.2 with: name: unified-findings path: findings/unified-findings.json diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml index 9526ddb..5b2ce3f 100644 --- a/.github/workflows/wellknown-enforcement.yml +++ b/.github/workflows/wellknown-enforcement.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Well-Known Standards (RFC 9116 + RSR) @@ -24,7 +25,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: RFC 9116 security.txt validation run: | SECTXT="" diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 8771979..bac95b1 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # workflow-linter.yml - Validates GitHub workflows against RSR security standards @@ -26,7 +27,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Check SPDX Headers run: |