e-pin the estate reusables to the last accepted standards ref - #865
Merged
Merged
Conversation
Pins at `4e6ffe55`-or-later are rejected by GitHub's dependency-lockfile validation, so the callers that used them could not parse: `conclusion=failure`, **0 jobs**, run name equal to the file's path. `210f14e7` (2026-09-12T17:32:17Z) is the last ref whose pins are accepted — measured by pinning a caller at each candidate and dispatching it, not inferred. This re-points the refs here to that ref. Behaviour is otherwise unchanged; the lockfile in `hyperpolymath/standards` is the thing that has to be regenerated before a forward re-point is safe again, and the estate's own applier (`.github/workflows/apply-workflow-pins.yml`) is what should do that re-pointing once it can run.
Contributor
|
Warning Review limit reachedNext included review available in 27 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (76)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
hyperpolymath
added a commit
that referenced
this pull request
Sep 19, 2026
…res the main-gate failure) (#866) ## What `Actions Lockfile Gate` (`uses ⊆ actions.lock`) has been failing on **every** run since `deed-conformance.yml` and `tag-ruleset-canon.yml` landed with pins that were never keyed in `.github/workflows/actions.lock`: | workflow | old pin | new pin | |---|---|---| | `deed-conformance.yml` | `actions/checkout@8e8c483…` (v6.0.1) | `actions/checkout@3d3c42e5…` (v7.0.1) | | `tag-ruleset-canon.yml` | `actions/upload-artifact@ea165f8…` (v4.6.2, EOL) | `actions/upload-artifact@043fb46…` (v7.0.1) | Both replacement SHAs are **already keyed** in the lock (checkout v7.0.1 is the estate standard in ~30 workflows; upload-artifact v7.0.1 is keyed and used by `apply-workflow-pins.yml` + `echidna-verify.yml`). The lockfile is **unchanged**: the gate's own contract is that the lock is the SSOT and workflow pins must match it. The alternative (keying the old SHAs in the lock) was deliberately rejected: it would entrench deprecated pins (checkout v6, upload-artifact v4) as estate standard — exactly the failure mode the gate exists to prevent. Note: this is *not* a #865 e-pin issue — the gate skips cross-repo `*/.github/workflows/*` refs by design; those were never the failing refs. ## Verification ``` $ bash .githooks/validate-actions-lock.sh ✅ 23 SHA-pinned ref(s) found among 23 lockfile keys, 2 doctrine exception(s) (exit 0; was 2 errors) $ git diff --stat -- .github/workflows/actions.lock (empty) ``` ## Risk Low. Both workflows inherit the exact pins used estate-wide; no job logic changes. Co-authored-by: hyperpolymath <hyperpolymath@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix(ci): re-pin the estate reusables to the last accepted standards ref
Pins at
4e6ffe55-or-later are rejected by GitHub's dependency-lockfile validation, so thecallers that used them could not parse:
conclusion=failure, 0 jobs, run name equal to thefile's path.
210f14e7(2026-09-12T17:32:17Z) is the last ref whose pins are accepted — measured bypinning a caller at each candidate and dispatching it, not inferred.
This re-points the refs here to that ref. Behaviour is otherwise unchanged; the lockfile in
hyperpolymath/standardsis the thing that has to be regenerated before a forward re-point is safeagain, and the estate's own applier (
.github/workflows/apply-workflow-pins.yml) is what should dothat re-pointing once it can run.