hypatia invalid_actions_lock: asana/push-signed-commits floats setup-python@v2 transitive

[hyperpolymath]

The finding

Hypatia workflow_audit parses .github/workflows/actions.lock and fails closed with transitive_dependencies_missing:

• asana/push-signed-commits@d615ca88 (our pin: immutable, ref: v1.3) declares transitive actions/setup-python@v2
• @v2 floats upstream and can never be a lockfile key, so the lock never parses clean under Hypatia's rule (added hypatia#741)
• gh actions-lock verify says valid:true on the same file — Hypatia is stricter than the authoritative tool here

Verified from Hypatia source (lib/rules/actions_lock.ex validate_transitive_dependencies, lib/rules/workflow_audit.ex parse_actions_lock): exactly one finding fires (workflow_audit/invalid_actions_lock on actions.lock).

Accepted

Acknowledged in .hypatia-baseline.json (round-2 fix-forward). Our direct pin is immutable; the exposure is upstream's float.

Exit criteria (any one)

1. Upstream Asana pins setup-python to a SHA (checked 2026-09-22: still @v2 on main) — then re-key the transitive and drop the ack.
2. We replace asana/push-signed-commits with a maintained signer (e.g. GitHub App token + createCommitOnBranch inline).
3. Hypatia downgrades dangling float-transitives to advisory.

History

• fix(main-red): repair the post-#899 red main (code + baseline triage + regen) #947 deleted the lock metadata to silence the scanner (wrong — hid a real signal); round 2 restored it verbatim and acked honestly.