fix(ci): resync actions.lock with the workflow refs Dependabot bumped (#746) - #754
Merged
Merged
Conversation
PR #746 ("bump the actions group across 1 directory with 2 updates") changed the pinned refs inside governance-reusable.yml, pages.yml and casket-pages.yml but did not regenerate .github/workflows/actions.lock. The lockfile therefore disagreed with the workflows, and GitHub refuses to parse a workflow whose actions are absent from its lockfile. The consequence reached the whole estate: ANY repo pinning a standards reusable at main HEAD (257869d) got HTTP 422 - failed to parse workflow: error parsing called workflow Invalid dependency lockfile ...: workflow ".github/workflows/governance-reusable.yml" references actions not present in the lockfile: editorconfig-checker/action-editorconfig-checker@51f63319... so the run died at startup with zero jobs and zero check runs - the gate went ABSENT, not red, and main looked green. This blocked the consolidation pin-bump campaign. Resynced both stale entries to the shas the workflows actually reference: editorconfig-checker/action-editorconfig-checker 840e866d (v2.2.0) -> 51f63319 (v3.0.0) actions/deploy-pages cd2ce8fc -> 368f8252 (v5.0.1) owner_id/repo_id are unchanged; both shas verified to exist and to carry those tags. Audited every non-standards `uses:` ref in .github/workflows against the lockfile (matching on sha, case-insensitively, and on the action root for subpath actions such as github/codeql-action/init): zero remaining mismatches. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QMTyDv9CoJo5PfeNzyp519
Contributor
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
hyperpolymath
added a commit
to hyperpolymath/bofig
that referenced
this pull request
Sep 8, 2026
standards main HEAD (257869d3) cannot be parsed by a caller: its actions.lock is out of sync with governance-reusable.yml after Dependabot PR #746, so a caller pinning it gets HTTP 422 and dies at startup with zero jobs. hyperpolymath/standards#754 resyncs the lockfile. Until it merges, governance stays on fad242d3 - the pin with a verified green 15-job run. The other four callers move to main HEAD, which parses cleanly (mirror verified: 7 jobs, was 0). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QMTyDv9CoJo5PfeNzyp519
|
hyperpolymath
added a commit
to hyperpolymath/cloud-sync-tuner
that referenced
this pull request
Sep 8, 2026
…ns:read scorecard, mirror and secret-scanner were dying at startup on this repo: each reported 0 jobs and 0 check runs, so main looked green because the gates were ABSENT, not passing. Two causes, both fixed here: 1. Callers sat on the older standards pin 7fdc2705, whose reusables request `actions: read`, which the callers did not grant. 2. A job-level `permissions:` block REPLACES the workflow-level map rather than merging with it, so a job with its own block ran without `contents: read` or `actions: read` no matter what the top of the file granted. All four affected callers are repointed to standards main HEAD 257869d3 and now grant `actions: read` + `contents: read` at BOTH workflow and job level. governance.yml is deliberately left on fad242d3: standards main HEAD is currently unparseable by callers because its actions.lock is out of sync with governance-reusable.yml after Dependabot #746 (HTTP 422, run dies at startup). hyperpolymath/standards#754 resyncs it; governance moves to HEAD once that lands. Verified on the sibling canary (bofig): mirror went 0 jobs -> 7 jobs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QMTyDv9CoJo5PfeNzyp519
hyperpolymath
added a commit
to hyperpolymath/cloud-sync-tuner
that referenced
this pull request
Sep 8, 2026
…#55) ## What was actually wrong Three of this repo's five governance-suite gates were **dying at startup**: `scorecard`, `mirror` and `secret-scanner` each reported **0 jobs and 0 check runs**. A gate that never starts is *absent*, not red — so `main` looked green while nothing ran. `gh run view` on those runs says only: *"This run likely failed because of a workflow file issue."* ## Two causes 1. **Stale pins.** Callers sat on older standards revisions (7fdc2705) whose reusables request `actions: read` — a permission the callers never granted. The reusable call fails validation and the run dies before any job is created. 2. **A job-level `permissions:` block REPLACES the workflow-level map** rather than merging with it. So a job carrying its own block ran with neither `contents: read` nor `actions: read`, regardless of what the top of the file granted. This is why "just add `actions: read` at the top" is a **no-op** on these callers — the gate stays absent while looking patched. ## What this PR does - Repoints the standards reusables to main HEAD `257869d3`. - Grants `actions: read` + `contents: read` at **both** workflow and job level. - Adds `workflow_dispatch` to `scorecard.yml` so the gate is verifiable on demand (matching `proof-burrower`, the verified-working control caller). - **Holds `governance.yml` at `fad242d3`.** standards main HEAD is currently *unparseable* by callers: its `actions.lock` fell out of sync with `governance-reusable.yml` after Dependabot #746, so pinning HEAD returns `HTTP 422 … references actions not present in the lockfile` and the run dies at startup. hyperpolymath/standards#754 resyncs it; governance moves to HEAD once that lands. ## Verification — dispatched on this branch, job counts measured | workflow | main | this branch | | |---|---|---|---| | governance | 15j | 15j | already alive, held at fad242d3 | | scorecard | **0j** | **2j** | REVIVED | | mirror | **0j** | **7j** | REVIVED | | secret-scanner | **0j** | **3j** | REVIVED | | hypatia-scan | **0j** | **1j** | REVIVED | Job counts come from `actions/runs/<id>/jobs .total_count` — a failing-checks list cannot distinguish "gate passed" from "gate never ran", so the positive control is the count itself. Newly-visible failures (e.g. mirror's bitbucket/sourcehut targets) are **real findings the absent gate was concealing**, not regressions introduced here. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01QMTyDv9CoJo5PfeNzyp519 --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
hyperpolymath
added a commit
to hyperpolymath/bofig
that referenced
this pull request
Sep 8, 2026
…#174) ## What was actually wrong Three of this repo's five governance-suite gates were **dying at startup**: `scorecard`, `mirror` and `secret-scanner` each reported **0 jobs and 0 check runs**. A gate that never starts is *absent*, not red — so `main` looked green while nothing ran. `gh run view` on those runs says only: *"This run likely failed because of a workflow file issue."* ## Two causes 1. **Stale pins.** Callers sat on older standards revisions (7fdc2705, 892497fe) whose reusables request `actions: read` — a permission the callers never granted. The reusable call fails validation and the run dies before any job is created. 2. **A job-level `permissions:` block REPLACES the workflow-level map** rather than merging with it. So a job carrying its own block ran with neither `contents: read` nor `actions: read`, regardless of what the top of the file granted. This is why "just add `actions: read` at the top" is a **no-op** on these callers — the gate stays absent while looking patched. ## What this PR does - Repoints the standards reusables to main HEAD `257869d3`. - Grants `actions: read` + `contents: read` at **both** workflow and job level. - Adds `workflow_dispatch` to `scorecard.yml` so the gate is verifiable on demand (matching `proof-burrower`, the verified-working control caller). - **Holds `governance.yml` at `fad242d3`.** standards main HEAD is currently *unparseable* by callers: its `actions.lock` fell out of sync with `governance-reusable.yml` after Dependabot #746, so pinning HEAD returns `HTTP 422 … references actions not present in the lockfile` and the run dies at startup. hyperpolymath/standards#754 resyncs it; governance moves to HEAD once that lands. ## Verification — dispatched on this branch, job counts measured | workflow | main | this branch | | |---|---|---|---| | governance | 15j | 14j | already alive, held at fad242d3 | | scorecard | **0j** | **2j** | REVIVED | | mirror | **0j** | **7j** | REVIVED | | secret-scanner | **0j** | **3j** | REVIVED | | hypatia-scan | 1j | 1j | local workflow, not a standards caller | Job counts come from `actions/runs/<id>/jobs .total_count` — a failing-checks list cannot distinguish "gate passed" from "gate never ran", so the positive control is the count itself. Newly-visible failures (e.g. mirror's bitbucket/sourcehut targets) are **real findings the absent gate was concealing**, not regressions introduced here. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01QMTyDv9CoJo5PfeNzyp519 --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The defect
PR #746 (
chore(deps): bump the actions group across 1 directory with 2 updates) changed pinned action refs insidegovernance-reusable.yml,pages.ymlandcasket-pages.ymlbut did not regenerate.github/workflows/actions.lock. GitHub refuses to parse a workflow whose actions are absent from its lockfile.Why it matters beyond this repo
Any repo pinning a standards reusable at main HEAD (
257869d3) fails with:The caller then dies at startup: zero jobs, zero check runs. The gate goes absent, not red, so the consuming repo's
mainlooks green while nothing ran. This currently blocks the estate-wide consolidation pin-bump, whose whole purpose is to move callers onto main HEAD.Discovered by dispatching a single canary caller before propagating the bump — the 422 above is the verbatim response.
The fix
Resync the two stale lockfile entries to the shas the workflows actually reference:
editorconfig-checker/action-editorconfig-checker840e866d(v2.2.0)51f63319(v3.0.0)actions/deploy-pagescd2ce8fc368f8252(v5.0.1)owner_id/repo_idare unchanged. Both shas were verified to exist and to carry those tags.Verification
Audited every non-standards
uses:ref across.github/workflows/against the lockfile — matching on sha, case-insensitively, and on the action root for subpath actions likegithub/codeql-action/init:(An earlier naive exact-string audit reported 10 mismatches; 8 were false positives from subpath and letter-case differences that GitHub itself tolerates. Only the two above are genuine.)
Edited surgically rather than via a bare
gh actions-lockregeneration, which is known to be destructive on this estate.🤖 Generated with Claude Code
https://claude.ai/code/session_01QMTyDv9CoJo5PfeNzyp519