From b1f40ed0077c7194a994b95f55cdab8182cebf72 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 19 Sep 2026 23:22:09 +0000 Subject: [PATCH] fix(ci): reconcile the workflows with actions.lock (gh-actions-lock v0.1.6) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `actions.lock` is authoritative: the workflows carry readable refs and the lock records the commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest make the whole repository unstartable — `startup_failure`, "Invalid lockfile". Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are reverted to their readable form here precisely because the lockfile, not the workflow, is what pins them. --- .github/workflows/actions.lock | 80 ++++++++++++++++++- .github/workflows/affinescript-verify.yml | 1 + .github/workflows/apply-workflow-pins.yml | 9 ++- .github/workflows/boj-build.yml | 1 + .github/workflows/canon-spine-lockstep.yml | 1 + .github/workflows/casket-pages.yml | 1 + .github/workflows/changelog-reusable.yml | 1 + .github/workflows/changelog.yml | 1 + .github/workflows/check-suite-monitor.yml | 1 + .github/workflows/codeql-reusable.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/debt-measure.yml | 1 + .github/workflows/deed-conformance.yml | 3 +- .github/workflows/doc-format.yml | 1 + .github/workflows/dyadt-verify.yml | 1 + .github/workflows/echidna-verify.yml | 1 + .github/workflows/elixir-ci-reusable.yml | 1 + .github/workflows/elixir-ci.yml | 1 + .github/workflows/governance-reusable.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan-reusable.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/k9-contractile.yml | 1 + .github/workflows/label-triage.yml | 1 + .github/workflows/labels.yml | 1 + .../workflows/launcher-standard-lockstep.yml | 1 + .github/workflows/lockfile-drift-detect.yml | 1 + .github/workflows/makefile-blocker.yml | 1 + .github/workflows/mirror-reusable.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/no-js-scan.yml | 1 + .github/workflows/pages-archive.yml | 15 ++-- .github/workflows/pages.yml | 1 + .github/workflows/propagate-hooks.yml | 7 +- .github/workflows/readme-derive-reusable.yml | 1 + .github/workflows/readme-derive.yml | 1 + .github/workflows/registry-verify.yml | 1 + .github/workflows/rust-ci-reusable.yml | 1 + .github/workflows/scorecard-enforcer.yml | 1 + .github/workflows/secret-scanner-reusable.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/security-gate-pr-target.yml | 11 +-- .github/workflows/self-test.yml | 1 + .github/workflows/settings-drift-detect.yml | 5 +- .github/workflows/signed-push-smoke.yml | 3 +- .github/workflows/spark-theatre-gate.yml | 1 + .github/workflows/tag-ruleset-canon.yml | 9 ++- 48 files changed, 152 insertions(+), 29 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index abeccaf7c..12cb8c914 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -10,6 +10,10 @@ workflows: - 'ocaml/setup-ocaml@e89b2ded52a6e13f50162220cf5fe47290162032' '.github/workflows/allowlist-preflight-reusable.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + '.github/workflows/apply-workflow-pins.yml': + - 'actions/checkout@v7.0.1' + - 'actions/create-github-app-token@v3.2.0' + - 'actions/upload-artifact@v7.0.1' '.github/workflows/boj-build.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/canon-spine-lockstep.yml': @@ -33,6 +37,8 @@ workflows: '.github/workflows/codeql.yml': [] '.github/workflows/debt-measure.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + '.github/workflows/deed-conformance.yml': + - 'actions/checkout@v7.0.1' '.github/workflows/doc-format.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/dyadt-verify.yml': @@ -68,11 +74,11 @@ workflows: '.github/workflows/labels.yml': [] '.github/workflows/launcher-standard-lockstep.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + '.github/workflows/lock-selfcheck.yml': + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/lockfile-drift-detect.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' - '.github/workflows/lock-selfcheck.yml': - - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/makefile-blocker.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/mirror-reusable.yml': @@ -82,10 +88,19 @@ workflows: '.github/workflows/mirror.yml': [] '.github/workflows/no-js-scan.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + '.github/workflows/pages-archive.yml': + - 'actions/cache@v6.1.0' + - 'actions/checkout@v7.0.1' + - 'actions/configure-pages@v6.0.0' + - 'actions/deploy-pages@v5.0.1' + - 'actions/upload-pages-artifact@v5.0.0' + - 'haskell-actions/setup@v2.12.0' '.github/workflows/pages.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346' - 'actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9' + '.github/workflows/propagate-hooks.yml': + - 'actions/checkout@v7.0.1' '.github/workflows/readme-derive-reusable.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/readme-derive.yml': [] @@ -108,40 +123,76 @@ workflows: - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' '.github/workflows/secret-scanner-reusable.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + '.github/workflows/security-gate-pr-target.yml': + - 'actions/checkout@v7.0.1' + - 'actions/github-script@v9.0.0' + - 'hyperpolymath/a2ml-ecosystem@main' '.github/workflows/self-test.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + '.github/workflows/settings-drift-detect.yml': + - 'actions/checkout@v7.0.1' + - 'actions/upload-artifact@v7.0.1' '.github/workflows/signed-push-smoke.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1' - 'asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897' '.github/workflows/spark-theatre-gate.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + '.github/workflows/tag-ruleset-canon.yml': + - 'actions/checkout@v7.0.1' + - 'actions/create-github-app-token@v3.2.0' + - 'actions/upload-artifact@v7.0.1' dependencies: 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9': ref: '55cc8345863c7cc4c66a329aec7e433d2d1c52a9' commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' owner_id: 44036562 repo_id: 215566462 + 'actions/cache@v6.1.0': + ref: 'v6.1.0' + commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' + owner_id: 44036562 + repo_id: 215566462 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': ref: 'v7.0.1' commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' owner_id: 44036562 repo_id: 197814629 + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 'actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d': ref: '45bfe0192ca1faeb007ade9deae92b16b8254a0d' commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d' owner_id: 44036562 repo_id: 513659658 + 'actions/configure-pages@v6.0.0': + ref: 'v6.0.0' + commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d' + owner_id: 44036562 + repo_id: 513659658 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1': ref: 'v3.2.0' commit: 'sha1-bcd2ba49218906704ab6c1aa796996da409d3eb1' owner_id: 44036562 repo_id: 642580244 + 'actions/create-github-app-token@v3.2.0': + ref: 'v3.2.0' + commit: 'sha1-bcd2ba49218906704ab6c1aa796996da409d3eb1' + owner_id: 44036562 + repo_id: 642580244 'actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346': ref: '368f82528645a54fb793d4d04e342629a3f51346' commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346' owner_id: 44036562 repo_id: 438112499 + 'actions/deploy-pages@v5.0.1': + ref: 'v5.0.1' + commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346' + owner_id: 44036562 + repo_id: 438112499 'actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c': ref: 'v8.0.1' commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c' @@ -152,6 +203,11 @@ dependencies: commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3' owner_id: 44036562 repo_id: 205262760 + 'actions/github-script@v9.0.0': + ref: 'v9.0.0' + commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3' + owner_id: 44036562 + repo_id: 205262760 'actions/setup-python@v2': ref: 'v2' commit: 'sha1-e9aba2c848f5ebd159c070c61ea2c4e2b122355e' @@ -167,6 +223,11 @@ dependencies: commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' owner_id: 44036562 repo_id: 192625955 + 'actions/upload-artifact@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' + owner_id: 44036562 + repo_id: 192625955 'actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9': ref: 'fc324d3547104276b827a68afc52ff2a11cc49c9' commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9' @@ -174,6 +235,11 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + 'actions/upload-pages-artifact@v5.0.0': + ref: 'v5.0.0' + commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9' + owner_id: 44036562 + repo_id: 496012378 'asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897': ref: 'v1.3' commit: 'sha1-d615ca88d8e1a946734c24970d1e7a6c56f34897' @@ -211,6 +277,16 @@ dependencies: commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' owner_id: 75048950 repo_id: 623796603 + 'haskell-actions/setup@v2.12.0': + ref: 'v2.12.0' + commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' + owner_id: 75048950 + repo_id: 623796603 + 'hyperpolymath/a2ml-ecosystem@main': + ref: 'main' + commit: 'sha1-f7a40a4d5cc82b2e73f861119baa6818d77a448d' + owner_id: 6759885 + repo_id: 1275649586 'ocaml/setup-ocaml@e89b2ded52a6e13f50162220cf5fe47290162032': ref: 'v3.8.0' commit: 'sha1-e89b2ded52a6e13f50162220cf5fe47290162032' diff --git a/.github/workflows/affinescript-verify.yml b/.github/workflows/affinescript-verify.yml index 697ba099e..500bf431b 100644 --- a/.github/workflows/affinescript-verify.yml +++ b/.github/workflows/affinescript-verify.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: AffineScript Verify diff --git a/.github/workflows/apply-workflow-pins.yml b/.github/workflows/apply-workflow-pins.yml index 6be0f42de..8f6785e73 100644 --- a/.github/workflows/apply-workflow-pins.yml +++ b/.github/workflows/apply-workflow-pins.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # @@ -54,7 +55,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 # WHICH App's credentials belong in vars.APP_ID / secrets.APP_PRIVATE_KEY: # a DEDICATED App for this applier, explicitly NOT OikosBot. Owner ruling @@ -70,7 +71,7 @@ jobs: - name: Mint an App installation token for hyperpolymath id: tok-user if: vars.APP_ID != '' - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@v3.2.0 continue-on-error: true with: app-id: ${{ vars.APP_ID }} @@ -80,7 +81,7 @@ jobs: - name: Mint an App installation token for metadatastician id: tok-org if: vars.APP_ID != '' - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@v3.2.0 continue-on-error: true with: app-id: ${{ vars.APP_ID }} @@ -145,7 +146,7 @@ jobs: - name: Upload the census if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@v7.0.1 with: name: workflow-pin-census path: census.tsv diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index bc8eb82b4..529d95e0a 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # diff --git a/.github/workflows/canon-spine-lockstep.yml b/.github/workflows/canon-spine-lockstep.yml index e1a8ab708..352dd01c3 100644 --- a/.github/workflows/canon-spine-lockstep.yml +++ b/.github/workflows/canon-spine-lockstep.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # canon-spine-lockstep — GATE A. diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index 16978f7bb..42cf9fbef 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: GitHub Pages diff --git a/.github/workflows/changelog-reusable.yml b/.github/workflows/changelog-reusable.yml index a95727edc..72dae03ef 100644 --- a/.github/workflows/changelog-reusable.yml +++ b/.github/workflows/changelog-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index 53dfed2f2..9fad6904f 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Changelog diff --git a/.github/workflows/check-suite-monitor.yml b/.github/workflows/check-suite-monitor.yml index f20b8d041..2b6e108c9 100644 --- a/.github/workflows/check-suite-monitor.yml +++ b/.github/workflows/check-suite-monitor.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # 🟡 CHECK: Check Suite Monitor # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/codeql-reusable.yml b/.github/workflows/codeql-reusable.yml index aee3aed48..69f11b583 100644 --- a/.github/workflows/codeql-reusable.yml +++ b/.github/workflows/codeql-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # codeql-reusable.yml — Reusable CodeQL security-analysis workflow. diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 70b24201c..3829618eb 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: CodeQL Security Analysis diff --git a/.github/workflows/debt-measure.yml b/.github/workflows/debt-measure.yml index 7a3f80a80..175f2bb91 100644 --- a/.github/workflows/debt-measure.yml +++ b/.github/workflows/debt-measure.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: "📅 Debt measure" diff --git a/.github/workflows/deed-conformance.yml b/.github/workflows/deed-conformance.yml index 4dde837a7..c6003c84e 100644 --- a/.github/workflows/deed-conformance.yml +++ b/.github/workflows/deed-conformance.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: deed-conformance @@ -22,7 +23,7 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: validator self-test diff --git a/.github/workflows/doc-format.yml b/.github/workflows/doc-format.yml index ed5947014..892363c66 100644 --- a/.github/workflows/doc-format.yml +++ b/.github/workflows/doc-format.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Documentation Format Enforcement diff --git a/.github/workflows/dyadt-verify.yml b/.github/workflows/dyadt-verify.yml index c3889ce18..7c95b9454 100644 --- a/.github/workflows/dyadt-verify.yml +++ b/.github/workflows/dyadt-verify.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # dyadt-verify — DYADT dogfood. Verify this repo's CLAIMS.a2ml against primary diff --git a/.github/workflows/echidna-verify.yml b/.github/workflows/echidna-verify.yml index 2b369975a..dad3ff380 100644 --- a/.github/workflows/echidna-verify.yml +++ b/.github/workflows/echidna-verify.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # ECHIDNA proof verification — formal verification of Agda and Idris2 proofs. diff --git a/.github/workflows/elixir-ci-reusable.yml b/.github/workflows/elixir-ci-reusable.yml index de04c11ce..320e7d5ab 100644 --- a/.github/workflows/elixir-ci-reusable.yml +++ b/.github/workflows/elixir-ci-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # elixir-ci-reusable.yml — Reusable Elixir CI bundle (RSR). diff --git a/.github/workflows/elixir-ci.yml b/.github/workflows/elixir-ci.yml index 3d5d9a92a..c80decacd 100644 --- a/.github/workflows/elixir-ci.yml +++ b/.github/workflows/elixir-ci.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Elixir CI diff --git a/.github/workflows/governance-reusable.yml b/.github/workflows/governance-reusable.yml index fd811e79e..a9e9081ab 100644 --- a/.github/workflows/governance-reusable.yml +++ b/.github/workflows/governance-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Governance checks for hyperpolymath repositories — Reusable Workflow diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 401cbafc1..c2945c45e 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Governance diff --git a/.github/workflows/hypatia-scan-reusable.yml b/.github/workflows/hypatia-scan-reusable.yml index 27f2e7e1a..90c1ae6df 100644 --- a/.github/workflows/hypatia-scan-reusable.yml +++ b/.github/workflows/hypatia-scan-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Hypatia Neurosymbolic CI/CD Security Scan — Reusable Workflow diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 171a1c28f..8686b8c29 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Hypatia Security Scan diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 16343c8b6..d886ec84f 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Instant Forge Sync - Triggers propagation to all forges on push/release diff --git a/.github/workflows/k9-contractile.yml b/.github/workflows/k9-contractile.yml index 1580f0cba..c1bed4195 100644 --- a/.github/workflows/k9-contractile.yml +++ b/.github/workflows/k9-contractile.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml index e61baef93..3e7474854 100644 --- a/.github/workflows/label-triage.yml +++ b/.github/workflows/label-triage.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Label Triage diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index c536afb97..a4208d7f1 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Labels diff --git a/.github/workflows/launcher-standard-lockstep.yml b/.github/workflows/launcher-standard-lockstep.yml index 58b058190..21fdc3617 100644 --- a/.github/workflows/launcher-standard-lockstep.yml +++ b/.github/workflows/launcher-standard-lockstep.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: launcher-standard lock-step diff --git a/.github/workflows/lockfile-drift-detect.yml b/.github/workflows/lockfile-drift-detect.yml index 782c98dea..16745f217 100644 --- a/.github/workflows/lockfile-drift-detect.yml +++ b/.github/workflows/lockfile-drift-detect.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell # diff --git a/.github/workflows/makefile-blocker.yml b/.github/workflows/makefile-blocker.yml index 37d9cfbc5..11b1a1558 100644 --- a/.github/workflows/makefile-blocker.yml +++ b/.github/workflows/makefile-blocker.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Makefile Blocker diff --git a/.github/workflows/mirror-reusable.yml b/.github/workflows/mirror-reusable.yml index 34176e2af..545501872 100644 --- a/.github/workflows/mirror-reusable.yml +++ b/.github/workflows/mirror-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # mirror-reusable.yml — Reusable git-forge mirror bundle. diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 926238463..5440e4683 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Mirror to Git Forges diff --git a/.github/workflows/no-js-scan.yml b/.github/workflows/no-js-scan.yml index 3a6dc62a6..18ccf0ec2 100644 --- a/.github/workflows/no-js-scan.yml +++ b/.github/workflows/no-js-scan.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: No-JS Scan (warn-first) diff --git a/.github/workflows/pages-archive.yml b/.github/workflows/pages-archive.yml index 16978f7bb..acb633587 100644 --- a/.github/workflows/pages-archive.yml +++ b/.github/workflows/pages-archive.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: GitHub Pages @@ -23,22 +24,22 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 - name: Checkout casket-ssg - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/casket-ssg path: .casket-ssg - name: Setup GHCup - uses: haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d # v2.12.0 + uses: haskell-actions/setup@v2.12.0 with: ghc-version: '9.8.2' cabal-version: '3.10' - name: Cache Cabal - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4 + uses: actions/cache@v6.1.0 with: path: | ~/.cabal/packages @@ -82,10 +83,10 @@ jobs: cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site - name: Setup Pages - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 + uses: actions/configure-pages@v6.0.0 - name: Upload artifact - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v3 + uses: actions/upload-pages-artifact@v5.0.0 with: path: '_site' @@ -99,4 +100,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 + uses: actions/deploy-pages@v5.0.1 diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 11d401c85..0ab5e0431 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: GitHub Pages (Ddraig SSG) diff --git a/.github/workflows/propagate-hooks.yml b/.github/workflows/propagate-hooks.yml index f2c7662cd..91656da3b 100644 --- a/.github/workflows/propagate-hooks.yml +++ b/.github/workflows/propagate-hooks.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # ⚙️ AUTO: Propagate Hook Updates # This workflow is managed by gh actions-lock. @@ -49,7 +50,7 @@ jobs: steps: - name: Checkout standards repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: fetch-depth: 1 @@ -172,7 +173,7 @@ jobs: steps: - name: Checkout standards repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Determine source and target id: config @@ -191,7 +192,7 @@ jobs: echo "target_name=$TARGET_NAME" >> $GITHUB_OUTPUT - name: Checkout target repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: ${{ matrix.repo }} token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/readme-derive-reusable.yml b/.github/workflows/readme-derive-reusable.yml index 95b6b2e54..5df5361cd 100644 --- a/.github/workflows/readme-derive-reusable.yml +++ b/.github/workflows/readme-derive-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # README single-source derivation — Reusable Workflow (ADR-004) diff --git a/.github/workflows/readme-derive.yml b/.github/workflows/readme-derive.yml index ba51d78ed..c0a326b37 100644 --- a/.github/workflows/readme-derive.yml +++ b/.github/workflows/readme-derive.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: README Derive diff --git a/.github/workflows/registry-verify.yml b/.github/workflows/registry-verify.yml index 8d112cb21..63bd57bde 100644 --- a/.github/workflows/registry-verify.yml +++ b/.github/workflows/registry-verify.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # registry-verify — fail the build if the spec registry or the DERIVED diff --git a/.github/workflows/rust-ci-reusable.yml b/.github/workflows/rust-ci-reusable.yml index ec2c1d407..002922860 100644 --- a/.github/workflows/rust-ci-reusable.yml +++ b/.github/workflows/rust-ci-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # rust-ci-reusable.yml — Reusable Rust CI bundle (RSR). diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml index be6e8af65..4ee284168 100644 --- a/.github/workflows/scorecard-enforcer.yml +++ b/.github/workflows/scorecard-enforcer.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Prevention workflow - runs OpenSSF Scorecard and fails on low scores diff --git a/.github/workflows/secret-scanner-reusable.yml b/.github/workflows/secret-scanner-reusable.yml index 18240884d..dae222508 100644 --- a/.github/workflows/secret-scanner-reusable.yml +++ b/.github/workflows/secret-scanner-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # secret-scanner-reusable.yml — Reusable secret-scanner bundle. diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index c5ba2cc24..628be9684 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Secret Scanner diff --git a/.github/workflows/security-gate-pr-target.yml b/.github/workflows/security-gate-pr-target.yml index c9c5e17ba..ac35c2fd3 100644 --- a/.github/workflows/security-gate-pr-target.yml +++ b/.github/workflows/security-gate-pr-target.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # 🔴 GATE: Security Gate for Fork Pull Requests # This workflow is managed by gh actions-lock. @@ -23,7 +24,7 @@ jobs: steps: - name: Checkout base repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: # Explicitly checkout the base branch, not the PR branch ref: ${{ github.base_ref }} @@ -88,7 +89,7 @@ jobs: - name: Security Scan - Secrets Detection if: steps.fork-check.outputs.is_fork == 'true' && steps.pr-checkout.outputs.pr_checked_out == 'true' id: secrets-scan - uses: hyperpolymath/a2ml-ecosystem/secrets-check-action@f7a40a4d5cc82b2e73f861119baa6818d77a448d # main + uses: hyperpolymath/a2ml-ecosystem/secrets-check-action@main with: path: '.' strict: 'true' @@ -178,7 +179,7 @@ jobs: - name: Post Security Scan Comment if: steps.fork-check.outputs.is_fork == 'true' - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + uses: actions/github-script@v9.0.0 with: script: | const prNumber = context.issue.number; @@ -210,7 +211,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 @@ -227,7 +228,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Generate Summary run: | diff --git a/.github/workflows/self-test.yml b/.github/workflows/self-test.yml index 77a863c71..527d135ec 100644 --- a/.github/workflows/self-test.yml +++ b/.github/workflows/self-test.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # self-test — run this repo's own test suite. diff --git a/.github/workflows/settings-drift-detect.yml b/.github/workflows/settings-drift-detect.yml index 4f2d8d47a..d08c92b9b 100644 --- a/.github/workflows/settings-drift-detect.yml +++ b/.github/workflows/settings-drift-detect.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell # @@ -58,7 +59,7 @@ jobs: timeout-minutes: 45 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + uses: actions/checkout@v7.0.1 - name: Scan estate for settings drift id: scan @@ -89,7 +90,7 @@ jobs: - name: Upload report if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@v7.0.1 with: name: settings-drift path: drift.tsv diff --git a/.github/workflows/signed-push-smoke.yml b/.github/workflows/signed-push-smoke.yml index 675ae0655..00782a22f 100644 --- a/.github/workflows/signed-push-smoke.yml +++ b/.github/workflows/signed-push-smoke.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # End-to-end check for the signed-push composite action: pushes a throwaway commit @@ -52,7 +53,7 @@ jobs: git commit -m "test(signed-push): verified-commit smoke [run ${GITHUB_RUN_ID}]" - name: Push the local commit as Verified (via the App) - uses: ./.github/actions/signed-push + uses: $/.github/actions/signed-push with: app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml index 88908f21c..6b5ab2a28 100644 --- a/.github/workflows/spark-theatre-gate.yml +++ b/.github/workflows/spark-theatre-gate.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: SPARK Theatre Gate diff --git a/.github/workflows/tag-ruleset-canon.yml b/.github/workflows/tag-ruleset-canon.yml index fc4190178..6dcce234e 100644 --- a/.github/workflows/tag-ruleset-canon.yml +++ b/.github/workflows/tag-ruleset-canon.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Converge every non-archived estate repository on the canonical immutable-tags # ruleset. This workflow exists because the 2026-09-11 damage (372 repositories @@ -41,7 +42,7 @@ jobs: converge: runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 # WHICH App's credentials belong in vars.APP_ID / secrets.APP_PRIVATE_KEY: # a DEDICATED App for this applier -- explicitly NOT OikosBot. Owner ruling @@ -61,7 +62,7 @@ jobs: - name: Mint an App installation token for hyperpolymath id: tok-user if: vars.APP_ID != '' - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@v3.2.0 continue-on-error: true with: app-id: ${{ vars.APP_ID }} @@ -71,7 +72,7 @@ jobs: - name: Mint an App installation token for metadatastician id: tok-org if: vars.APP_ID != '' - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@v3.2.0 continue-on-error: true with: app-id: ${{ vars.APP_ID }} @@ -160,7 +161,7 @@ jobs: - name: Publish the report if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@v7.0.1 with: name: tag-ruleset-canon-report path: canon-*.tsv