fix(ci): resync actions.lock metadata after the #891 actions-group bump - #893
Merged
Merged
Conversation
The dependabot actions-group bump (#891, a521ed7) moved five action pins in the workflows but left their actions.lock entries stale, breaking GitHub's dependency-lock validation for every pinned caller at a521ed7 or later: Invalid workflow file: …error parsing called workflow … : Invalid dependency lockfile "…/actions.lock@a521ed7…": workflow "…" references action "…" not present in the lockfile Reproduced downstream on hyperpolymath/empty-linter PR #95 (governance, hypatia-scan wrappers both rejected at parse time). No historical SHA is a compatible pin: b77c53c (the hypatia validator repair) already carried the upload-sarif drift, and a521ed7 is unparseable. This commit replaces the four stale per-workflow entries and their pin metadata (ref + sha1 commit digest) with the SHAs the workflows actually reference, preserving the estate's SHA-pin policy — deliberately *without* the CLI default behaviour, which would rewrite the workflows' uses: lines to mutable semver tags (its 'freshly pinned' narrowing does not fire on already-locked refs, which all four now are): ocaml/setup-ocaml e89b2de -> 93303b6 (affinescript-verify) github/codeql-action b96794f -> 1c5b675 (codeql-, hypatia-scan-, scorecard-reusable) dtolnay/rust-toolchain 6c977a6 -> 02cb101 (mirror-, rust-ci-reusable) Verified with the official tool on the result: gh actions-lock --no-fix Scanning 53 workflows (no findings) Follow-up for maintainers: decide why the estate's own actions-lock gate did not catch #891's drift, and consider a dependabot post-update hook that runs 'gh actions-lock'.
Contributor
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
hyperpolymath
added a commit
to hyperpolymath/empty-linter
that referenced
this pull request
Sep 22, 2026
…1a3b7b) (#97) ## One-line-each pin bump — unbreaks the four estate reusables for this repo Moves the four standards-reusable pins `a521ed7 → b1a3b7b` (the merge commit of [standards#893](hyperpolymath/standards#893)). Why: `a521ed7`'s `actions.lock` was stale relative to its own workflows (dependabot #891 bumped five action pins without lock regen), so GitHub rejects governance-, hypatia-, scorecard-, and secret-scanner-reusable at **workflow-parse time** for any caller pinned there. upstream#893 resynced the lock — tool-verified clean (53/53 workflows) with SHA pins preserved — and the four reusable workflow files at `b1a3b7b` are byte-identical to `a521ed7`, so this pin swap changes *no reusable behaviour* other than making it parseable again. Bonus delivered by the same SHA: the hypatia findings-validator repair (standards#886 — the jq fix, and the `"warn"` severity whitelist that was the root cause of [standards#892](hyperpolymath/standards#892)). The Hypatia check should finally go green. Compatibility was reviewed in #95 before any of this moved: no caller passes `with:` inputs, and the calling jobs already grant the permissions the current reusables require (incl. scorecard's `actions: read`). Expected check outcomes on this PR: Governance ✅ (the #95 content fixes plus parseable reusable), Hypatia ✅ (validator repair + parseable reusable), Dogfood Gate ✅ (unchanged product surface), Secret Scanner ✅. Out of scope, pre-existing: Mirror to Git Forges (account credentials — needs your secret config, not code), and hypatia's workflow-YAML findings (7 critical +18 high +31 medium against files like `label-triage.yml`, `mirror.yml`) — they're advisory (`block-on-high: false` by design upstream) and land as code-scanning alerts, not check failures.
hyperpolymath
added a commit
that referenced
this pull request
Sep 22, 2026
…#898) ## The one audit #893 missed #893 resynced the stale list entries and pin digests — but GitHub's called-workflow validation keys on the lockfile's `dependencies:` metadata section, not only the workflows lists. Live proof downstream ([empty-linter#97](hyperpolymath/empty-linter#97)): hypatia-scan wrapper went **green** on the `b1a3b7b` pin, while the governance wrapper still died at parse: ``` workflow ".github/workflows/governance-reusable.yml" references action "denoland/setup-deno@22d081ff…" not present in the lockfile ``` The pin was listed in the workflows section all along — its metadata entry was simply never written (the #882 "26 refs were uncertified" cohort). ## Method (so the next audit author can rerun it) Compared every `uses: owner/repo@sha` ref across all 53 workflows against the `dependencies:` keys, applying GitHub's own normalisation as evidenced by what *passes*: - repo-root keying: `codeql-action/init`, `/analyze`, `/upload-sarif` resolve to the `github/codeql-action@…` metadata entry — proven by hypatia-scan-reusable now parsing green without subpath keys; - case-insensitive slugs: `Swatinem/rust-cache` in `uses:` satisfies the lowercase `swatinem/rust-cache` metadata entry; - `uses: …/.github/workflows/*-reusable.yml@…` calls are versioned elsewhere and carry no metadata entries by design. ## Result: exactly two genuine gaps | Metadata key added | Used by | owner_id / repo_id | |---|---|---| | `denoland/setup-deno@22d081ff…` | governance-reusable | 42048915 / 356423100 | | `tailscale/github-action@780049a…` | tailscale-connect-reusable | 48932923 / 360548653 | Both entries placed in sorted position with `ref` + `sha1-` commit digest and API-resolved ids. No workflow file or workflows-list entry is touched. ## Verification - `gh actions-lock --no-fix` → Scanning 53 workflows (no findings) - YAML parse → 24 dependency keys, case-insensitive sorted - custom metadata audit → 0 genuinely missing keys across all 53 workflows After merge, [empty-linter#97](hyperpolymath/empty-linter#97 pin moves to this merge SHA and the governance gate should finally go green downstream.
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What broke
The dependabot actions-group bump (#891, merged as
a521ed7) moved five action pins in the workflows (ocaml/setup-ocaml, codeql-action init/analyze/upload-sarif, dtolnay/rust-toolchain) but did not regenerate.github/workflows/actions.lock. GitHub's dependency-lock validation now rejects every caller pinned at any standards SHA ≥ the drift introduction at workflow-parse time:Reproduced downstream on
hyperpolymath/empty-linterPR #95 — governance and hypatia-scan wrappers both died before running. (Observed while following up on #892: no historical SHA is a clean pin — the hypatia validator repairb77c53calready carried the upload-sarif drift.)This fix
Replaces the four stale per-workflow entries and their pin metadata (
ref+sha1-commit digest in the second lock section — replacing only the list entry leaves the lock unreadable: "pin key ref … but commit digest … does not match") with the SHAs the workflows actually reference:ocaml/setup-ocaml@e89b2de@93303b6github/codeql-action@b96794f@1c5b675dtolnay/rust-toolchain@6c977a6@02cb101SHA pins were preserved deliberately. The official tool's default fix was used for diagnosis, but it would rewrite the workflows'
uses:lines to mutable semver tags (@v4.38.1,@v1) — contradicting the estate SHA-pin policy these very files document (and it added an unmanaged marker line totailscale-connect-reusable). Its narrowing only fires on freshly pinned refs; with the metadata corrected, all four are "already-locked" and untouched by future regenerations.Verification
53/53 workflows verify clean with this lockfile; zero workflow files are modified by this PR.
Follow-up questions for maintainers (not done here)
actions-lock-gate.yml/ hook chain catch chore(deps): bump the actions group with 5 updates #891's drift before merge?actions.lockrefresh in the same commit — worth a small workflow or bot comment that triggers regen on actions-group PRs.Once merged, pinned callers should move lockstep to this merge commit to pick up both the hypatia findings-validator repair (
b77c53c, #892's warn whitelist) and parseable reusables again.