From c83615df2245302d3805dd8f3169fcab28462a72 Mon Sep 17 00:00:00 2001 From: hyperpolymath Date: Sat, 19 Sep 2026 22:51:56 +0000 Subject: [PATCH] fix(ci): align two straggler action pins to the lockfile standard MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Actions Lockfile Gate (uses ⊆ actions.lock) has been failing on main since deed-conformance.yml and tag-ruleset-canon.yml landed with pins that were never keyed: deed-conformance.yml actions/checkout@8e8c483… (v6.0.1) tag-ruleset-canon.yml actions/upload-artifact@ea165f8… (v4.6.2) Both workflows now use the estate-standard pins already present in .github/workflows/actions.lock: actions/checkout@3d3c42e5… # v7.0.1 (keyed; ~30 workflows) actions/upload-artifact@043fb46… # v7.0.1 (keyed; apply-workflow-pins, echidna-verify) The lockfile itself is unchanged — the canonical fix per the gate's own regeneration contract (lock is the SSOT; workflow pins must match it). The alternative (keying the old SHAs in the lock) was rejected: it would entrench deprecated pins (checkout v6, upload-artifact v4 — v4 is end-of-life) as estate standard. Verified locally: bash .githooks/validate-actions-lock.sh → ✅ 23 SHA-pinned ref(s) found among 23 lockfile keys, 2 doctrine exception(s) (exit 0; was 2 errors) git diff --stat -- .github/workflows/actions.lock → empty --- .github/workflows/deed-conformance.yml | 2 +- .github/workflows/tag-ruleset-canon.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deed-conformance.yml b/.github/workflows/deed-conformance.yml index 42a24c3f9..4dde837a7 100644 --- a/.github/workflows/deed-conformance.yml +++ b/.github/workflows/deed-conformance.yml @@ -22,7 +22,7 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: validator self-test diff --git a/.github/workflows/tag-ruleset-canon.yml b/.github/workflows/tag-ruleset-canon.yml index ef72ae375..fc4190178 100644 --- a/.github/workflows/tag-ruleset-canon.yml +++ b/.github/workflows/tag-ruleset-canon.yml @@ -160,7 +160,7 @@ jobs: - name: Publish the report if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: tag-ruleset-canon-report path: canon-*.tsv