diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 7806adad..caded0b1 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -3,6 +3,10 @@ # Docs: https://gh.io/actions-lockfile version: 'v0.0.2' workflows: + '.github/workflows/governance.yml': [] + '.github/workflows/mirror.yml': [] + '.github/workflows/scorecard.yml': [] + '.github/workflows/secret-scanner.yml': [] '.github/workflows/boj-trigger.yml': - 'actions/checkout@v7.0.1' '.github/workflows/casket-pages.yml': @@ -11,10 +15,10 @@ workflows: - 'actions/configure-pages@v6.0.0' - 'actions/deploy-pages@v5.0.0' - 'actions/upload-pages-artifact@v5.0.0' - - 'haskell-actions/setup@v2.11.0' + - 'haskell-actions/setup@v2.12.0' '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - - 'github/codeql-action@v4.37.4' + - 'github/codeql-action@v4.37.6' '.github/workflows/dependabot-automerge.yml': - 'dependabot/fetch-metadata@v3.1.0' '.github/workflows/dogfood-checks.yml': @@ -26,15 +30,18 @@ workflows: - 'actions/upload-artifact@v7.0.1' - 'dtolnay/rust-toolchain@stable' - 'goto-bus-stop/setup-zig@v2.2.1' - - 'swatinem/rust-cache@v2.9.1' + - 'swatinem/rust-cache@v2.9.2' '.github/workflows/hypatia-scan.yml': - 'actions/checkout@v7.0.1' - 'actions/github-script@v9.0.0' - 'actions/upload-artifact@v7.0.1' - 'erlef/setup-beam@v1.24.1' - - 'github/codeql-action@v4.37.4' + - 'github/codeql-action@v4.37.6' '.github/workflows/instant-sync-dispatch.yml': - 'peter-evans/repository-dispatch@v4.0.1' + '.github/workflows/main-estate-audit.yml': + - 'actions/checkout@v4.4.0' + - 'hyperpolymath/cicd-suite@main' '.github/workflows/pages.yml': - 'actions/checkout@v7.0.1' - 'actions/deploy-pages@v5.0.0' @@ -43,7 +50,7 @@ workflows: - 'actions/checkout@v7.0.1' - 'actions/upload-artifact@v7.0.1' - 'dtolnay/rust-toolchain@stable' - - 'swatinem/rust-cache@v2.9.1' + - 'swatinem/rust-cache@v2.9.2' '.github/workflows/push-email-notify.yml': - 'dawidd6/action-send-mail@v3.12.0' '.github/workflows/release.yml': @@ -56,6 +63,11 @@ dependencies: commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' owner_id: 44036562 repo_id: 215566462 + 'actions/checkout@v4.4.0': + ref: 'v4.4.0' + commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262' + owner_id: 44036562 + repo_id: 197814629 'actions/checkout@v7.0.1': ref: 'v7.0.1' commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' @@ -113,9 +125,9 @@ dependencies: commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' owner_id: 47606891 repo_id: 331103973 - 'github/codeql-action@v4.37.4': - ref: 'v4.37.4' - commit: 'sha1-f205ea1c3313d32999d8d6a48b4f6530d4437b38' + 'github/codeql-action@v4.37.6': + ref: 'v4.37.6' + commit: 'sha1-5595ccaf912efad79be6eef63a5619ff05969be3' owner_id: 9919 repo_id: 259445878 'goto-bus-stop/setup-zig@v2.2.1': @@ -123,9 +135,9 @@ dependencies: commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406' owner_id: 1006268 repo_id: 212984112 - 'haskell-actions/setup@v2.11.0': - ref: 'v2.11.0' - commit: 'sha1-cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553' + 'haskell-actions/setup@v2.12.0': + ref: 'v2.12.0' + commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' owner_id: 75048950 repo_id: 623796603 'hyperpolymath/a2ml-ecosystem@main': @@ -133,6 +145,11 @@ dependencies: commit: 'sha1-aa4b836bd969df2bc58128cb8e3d20bbc88d5e79' owner_id: 6759885 repo_id: 1275649586 + 'hyperpolymath/cicd-suite@main': + ref: 'main' + commit: 'sha1-a3cd79fba541444c619902330d0b618eb1612634' + owner_id: 6759885 + repo_id: 1326697643 'hyperpolymath/k9-ecosystem@main': ref: 'main' commit: 'sha1-89f3c2702f4f650a92aa7411502f38da06abd562' @@ -148,8 +165,8 @@ dependencies: commit: 'sha1-3d0d9888cb7fd7b750713d6e236d1fcb99157228' owner_id: 2242 repo_id: 204253808 - 'swatinem/rust-cache@v2.9.1': - ref: 'v2.9.1' - commit: 'sha1-c19371144df3bb44fab255c43d04cbc2ab54d1c4' + 'swatinem/rust-cache@v2.9.2': + ref: 'v2.9.2' + commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' owner_id: 580492 repo_id: 298565987 diff --git a/.github/workflows/boj-trigger.yml b/.github/workflows/boj-trigger.yml index ea22db11..427c25cf 100644 --- a/.github/workflows/boj-trigger.yml +++ b/.github/workflows/boj-trigger.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # # OPTIONAL: BoJ Server Build Trigger # This workflow notifies a BoJ Server instance when code is pushed. diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index c77f85ae..39866e84 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: GitHub Pages on: push: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 26a90d25..e75cccf2 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: CodeQL Security Analysis on: push: diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index f6669051..7bd97774 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # # dependabot-automerge.yml — enable GitHub's native auto-merge on # Dependabot pull requests that match a declared severity / ecosystem diff --git a/.github/workflows/dogfood-checks.yml b/.github/workflows/dogfood-checks.yml index 26c70c62..eb9b4298 100644 --- a/.github/workflows/dogfood-checks.yml +++ b/.github/workflows/dogfood-checks.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index e0ecb36a..dde53d7e 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # proven-servers — E2E + Safety + Bench @@ -24,7 +24,7 @@ on: pull_request: branches: [main, master] workflow_dispatch: -permissions: read-all +permissions: actions: read concurrency: group: e2e-${{ github.ref }} diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index acfe231d..8e29d532 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # governance.yml — single wrapper calling the shared estate governance bundle # in hyperpolymath/standards instead of carrying per-repo copies. # @@ -31,4 +31,4 @@ permissions: contents: read jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 1bc90b32..ad50d447 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan on: diff --git a/.github/workflows/instant-sync-dispatch.yml b/.github/workflows/instant-sync-dispatch.yml index 1ccdfacd..5235a83c 100644 --- a/.github/workflows/instant-sync-dispatch.yml +++ b/.github/workflows/instant-sync-dispatch.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml index b602e975..341bb552 100755 --- a/.github/workflows/main-estate-audit.yml +++ b/.github/workflows/main-estate-audit.yml @@ -1,3 +1,6 @@ +# SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. + name: Central Estate CI/CD Audit on: @@ -10,7 +13,7 @@ jobs: estate-audit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 - name: Required Files Gate uses: hyperpolymath/cicd-suite/actions/required-files-check@main diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 0ac4fd0a..a30e53e7 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Mirror to Git Forges on: push: @@ -12,5 +12,5 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a secrets: inherit diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 20e2ac24..ab0c5db7 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: GitHub Pages (Ddraig SSG) on: push: diff --git a/.github/workflows/panic-attack-hexadeca.yml b/.github/workflows/panic-attack-hexadeca.yml index d2a996a3..1fe0d530 100644 --- a/.github/workflows/panic-attack-hexadeca.yml +++ b/.github/workflows/panic-attack-hexadeca.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # panic-attack hexadeca surface scan for proven-nesy-solver-api. # # Scans the zig hexadeca connector (all 16 protocol surfaces) with diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 76574e9e..f27f7315 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 50494014..9abbb00f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Release workflow — triggered by version tags (v*). diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index e0e85089..a3694f0c 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Scorecards supply-chain security on: @@ -9,12 +9,12 @@ on: schedule: - cron: '23 4 * * 1' -permissions: read-all +permissions: actions: read jobs: analysis: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a permissions: contents: read security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 8fe7af09..13dc797a 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,7 +1,7 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Calls the estate's shared secret scanner (gitleaks + rust-secrets + # shell-secrets). Replaces an inline trufflehog job: trufflehog was retired # estate-wide as redundant, and this repo had no other leak scanning, so the