From 59dfaf6fee8af6c1659e7fa26fcc5ecfca927a8f Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 21 Sep 2026 22:27:39 +0000 Subject: [PATCH] fix(ci): resync actions.lock metadata after the #891 actions-group bump MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The dependabot actions-group bump (#891, a521ed7) moved five action pins in the workflows but left their actions.lock entries stale, breaking GitHub's dependency-lock validation for every pinned caller at a521ed7 or later: Invalid workflow file: …error parsing called workflow … : Invalid dependency lockfile "…/actions.lock@a521ed7…": workflow "…" references action "…" not present in the lockfile Reproduced downstream on hyperpolymath/empty-linter PR #95 (governance, hypatia-scan wrappers both rejected at parse time). No historical SHA is a compatible pin: b77c53c (the hypatia validator repair) already carried the upload-sarif drift, and a521ed7 is unparseable. This commit replaces the four stale per-workflow entries and their pin metadata (ref + sha1 commit digest) with the SHAs the workflows actually reference, preserving the estate's SHA-pin policy — deliberately *without* the CLI default behaviour, which would rewrite the workflows' uses: lines to mutable semver tags (its 'freshly pinned' narrowing does not fire on already-locked refs, which all four now are): ocaml/setup-ocaml e89b2de -> 93303b6 (affinescript-verify) github/codeql-action b96794f -> 1c5b675 (codeql-, hypatia-scan-, scorecard-reusable) dtolnay/rust-toolchain 6c977a6 -> 02cb101 (mirror-, rust-ci-reusable) Verified with the official tool on the result: gh actions-lock --no-fix Scanning 53 workflows (no findings) Follow-up for maintainers: decide why the estate's own actions-lock gate did not catch #891's drift, and consider a dependabot post-update hook that runs 'gh actions-lock'. --- .github/workflows/actions.lock | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 6f4afd421..659733fbd 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -7,7 +7,7 @@ workflows: - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/affinescript-verify.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'ocaml/setup-ocaml@e89b2ded52a6e13f50162220cf5fe47290162032' + - 'ocaml/setup-ocaml@93303b622b2522e4411e295f9e77411a24912ac7' '.github/workflows/allowlist-preflight-reusable.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/apply-workflow-pins.yml': @@ -33,7 +33,7 @@ workflows: - 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3' '.github/workflows/codeql-reusable.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' + - 'github/codeql-action@1c5b675653bb5c22dbe9b12b556ec555138e09fd' '.github/workflows/codeql.yml': [] '.github/workflows/debt-measure.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' @@ -64,7 +64,7 @@ workflows: - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' - - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' + - 'github/codeql-action@1c5b675653bb5c22dbe9b12b556ec555138e09fd' '.github/workflows/hypatia-scan.yml': [] '.github/workflows/instant-sync.yml': - 'peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697' @@ -83,7 +83,7 @@ workflows: - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/mirror-reusable.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' + - 'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de' - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' '.github/workflows/mirror.yml': [] '.github/workflows/no-js-scan.yml': @@ -108,7 +108,7 @@ workflows: - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/rust-ci-reusable.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' + - 'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de' - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406' - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' '.github/workflows/scorecard-enforcer.yml': @@ -119,7 +119,7 @@ workflows: '.github/workflows/scorecard-reusable.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' - - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' + - 'github/codeql-action@1c5b675653bb5c22dbe9b12b556ec555138e09fd' - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' '.github/workflows/secret-scanner-reusable.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' @@ -203,9 +203,9 @@ dependencies: repo_id: 772313726 uses: - 'actions/setup-python@v2' - 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772': - ref: '6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' - commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' + 'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de': + ref: '02cb101ec7c40f2c49e1d9714d64511d8e1b74de' + commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de' owner_id: 1940490 repo_id: 260749683 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393': @@ -218,9 +218,9 @@ dependencies: commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' owner_id: 47606891 repo_id: 331103973 - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63': - ref: 'b96794f015dfd88f77b49b1c93e0fa7110f94c63' - commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' + 'github/codeql-action@1c5b675653bb5c22dbe9b12b556ec555138e09fd': + ref: '1c5b675653bb5c22dbe9b12b556ec555138e09fd' + commit: 'sha1-1c5b675653bb5c22dbe9b12b556ec555138e09fd' owner_id: 9919 repo_id: 259445878 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406': @@ -233,9 +233,9 @@ dependencies: commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' owner_id: 75048950 repo_id: 623796603 - 'ocaml/setup-ocaml@e89b2ded52a6e13f50162220cf5fe47290162032': - ref: 'v3.8.0' - commit: 'sha1-e89b2ded52a6e13f50162220cf5fe47290162032' + 'ocaml/setup-ocaml@93303b622b2522e4411e295f9e77411a24912ac7': + ref: '93303b622b2522e4411e295f9e77411a24912ac7' + commit: 'sha1-93303b622b2522e4411e295f9e77411a24912ac7' owner_id: 1841483 repo_id: 220799100 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc':