From 3f7be7e4cc9625842d0f3edf99be875243518c2f Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 22 Sep 2026 08:10:17 +0000
Subject: [PATCH] fix(ci): add the two missing actions.lock dependency metadata
 entries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to #893. GitHub's dependency-lock validation at called-workflow
parse time keys on the dependencies metadata section, not only the
per-workflows ref lists: governance-reusable@b1a3b7b was still rejected
downstream with

  workflow ".github/workflows/governance-reusable.yml" references action
  "denoland/setup-deno@22d081ff…" not present in the lockfile

even though the workflows list mentions the pin — its metadata entry was
never written (#882's '26 refs were uncertified' cohort). Observed live on
hyperpolymath/empty-linter PR #97.

A full audit of all 53 workflows' uses: refs against the metadata keys —
case-insensitive, repo-root normalised (GitHub resolves subpaths such as
codeql-action/upload-sarif and owner-spelling such as Swatinem/ to the
repo-level pin, which hypatia-scan-reusable's now-green parse confirms) —
found exactly two gaps:

  denoland/setup-deno@22d081ff…   (governance-reusable)   owner 42048915
  tailscale/github-action@780049a… (tailscale-connect)     owner 48932923

Both metadata entries added in sorted position with ref/sha1-commit and
the repo ids resolved via the API. Validations on the result:

  gh actions-lock --no-fix  → Scanning 53 workflows (no findings)
  YAML parse                → 24 dependency keys, sorted
  metadata audit            → 0 genuinely missing keys across all workflows

No workflow file and no workflows-list entry is touched by this change.
---
 .github/workflows/actions.lock | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 659733fbd..76b8042d0 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -203,6 +203,11 @@ dependencies:
         repo_id: 772313726
         uses:
             - 'actions/setup-python@v2'
+    'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
+        ref: '22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+        commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+        owner_id: 42048915
+        repo_id: 356423100
     'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de':
         ref: '02cb101ec7c40f2c49e1d9714d64511d8e1b74de'
         commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de'
@@ -253,6 +258,11 @@ dependencies:
         commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
         owner_id: 580492
         repo_id: 298565987
+    'tailscale/github-action@780049a30b6ff5c378a9e7b389d15ece7a204888':
+        ref: '780049a30b6ff5c378a9e7b389d15ece7a204888'
+        commit: 'sha1-780049a30b6ff5c378a9e7b389d15ece7a204888'
+        owner_id: 48932923
+        repo_id: 360548653
     'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555':
         ref: 'e83874834305fe9a4a2997156cb26c5de65a8555'
         commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555'