From 46ef434a4470814e27c0a2a56b86ad26fd44074c Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 17 Sep 2026 20:01:39 +0000
Subject: [PATCH] fix(lock): key denoland/setup-deno for
 governance-reusable.yml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

scripts/lock-selfcheck.sh reports canon main POISON: governance-reusable.yml
uses denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed (added in
cdec573, the 2.0.2 release) but the lock at that SHA does not key it.

GitHub resolves a reusable's action refs against the CALLEE repo's actions.lock
at the pinned SHA. A ref that is not keyed kills every caller at startup with
zero jobs, conclusion failure (not startup_failure) and no reason in either REST
or GraphQL — the gate reads as ABSENT rather than failing, so the branch looks
clean. That is the exact hazard lock-selfcheck.sh (#821) was merged to catch,
and it caught it on its own merge commit.

The key is fully determined: the lockfile validator requires key-SHA == the
digest written inline in the workflow, so this reproduces what gh actions-lock +
relock-sha-keys.sh would key. Empty diff to the resolved set; no other entry
moved.
---
 .github/workflows/actions.lock | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 5827fa86d..abeccaf7c 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -49,6 +49,7 @@ workflows:
     '.github/workflows/governance-reusable.yml':
         - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
         - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393'
         - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
     '.github/workflows/governance.yml': []