From af45222d6f5cc6910b4f0a5a39391e686ed14c46 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 27 Aug 2026 06:46:41 +0100 Subject: [PATCH] fix(ci): unbreak workflow YAML and add a complete actions.lock Remediates GitHub Workflow Dependency Locking (public preview), which rejects runs at startup_failure with zero jobs and no logs. See hyperpolymath/standards#657. Five steps, in order, because each blocks the next: 1. Unbroke any workflow whose `permissions:` carried a scalar with an indented mapping under it - blind-permissions-insertion damage. This matters beyond the one file: gh actions-lock refuses to run when ANY workflow in the repo fails to parse, so the repo could never acquire a lockfile and could never self-heal. 2. Repinned hyperpolymath/standards reusables off commits that have no actions.lock. The rejection requires the CALLEE to be covered at the pinned SHA, which is unsatisfiable at a pre-lockfile commit. 3. Generated the lockfile with gh actions-lock. 4. Hand-added the reusable-workflow caller entries the tool omits, as '': []. Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without, because every workflow a lockfile OMITS is rejected. A PARTIAL lock is worse than none - running gh actions-lock and stopping there is how this outage spread. 5. Restored SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps with head -1. Verified before push: 0 unparseable workflows, lockfile covers every workflow with no omissions, SPDX on line 1 in every file. Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead -> 0 startup_failure, 13 running. Co-Authored-By: Claude Opus 5 --- .github/workflows/actions.lock | 16 ++++++++++++++++ .github/workflows/governance.yml | 4 +++- .github/workflows/push-email-notify.yml | 3 ++- .github/workflows/secret-scanner.yml | 2 ++ .github/workflows/spark-theatre-gate.yml | 4 +++- 5 files changed, 26 insertions(+), 3 deletions(-) create mode 100644 .github/workflows/actions.lock diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..b8cd01b --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,16 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/governance.yml': [] + '.github/workflows/secret-scanner.yml': [] + '.github/workflows/spark-theatre-gate.yml': [] + '.github/workflows/push-email-notify.yml': + - 'dawidd6/action-send-mail@v3.12.0' +dependencies: + 'dawidd6/action-send-mail@v3.12.0': + ref: 'v3.12.0' + commit: 'sha1-6e502825a508b867ab2954ad6343b68787624c01' + owner_id: 9713907 + repo_id: 222439721 diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index f261b5b..711c5e5 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: PMPL-1.0-or-later +# This workflow is managed by gh actions-lock. name: Governance on: push: @@ -8,7 +9,8 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5a93d9d57cc04de4002d6d0ecd336fc7a8698910 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 4b4e754..b69c87f 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by @@ -15,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Send push notification email - uses: dawidd6/action-send-mail@6e502825a508b867ab2954ad6343b68787624c01 # pinned + uses: dawidd6/action-send-mail@v3.12.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index d325a5c..07dd1d2 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Calls the estate's shared secret scanner (gitleaks + rust-secrets + # shell-secrets). Added because this repository had NO leak scanning at all. # @@ -13,6 +14,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read jobs: secret-scan: diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml index bce3480..748fada 100644 --- a/.github/workflows/spark-theatre-gate.yml +++ b/.github/workflows/spark-theatre-gate.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Estate SPARK Theatre Gate — thin caller of the reusable workflow in # hyperpolymath/standards (#135 / #141). Pinned by commit SHA per the # estate action-pinning policy. Regenerate the pin only when the reusable @@ -9,10 +10,11 @@ on: push: branches: [main, master] permissions: + actions: read contents: read jobs: spark-theatre-gate: - uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@462003782f3ebb93ea763e81d0d199ce13ef7d73 + uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@84355587cb2a1f86e6882de83514a32db2646e7a timeout-minutes: 10 with: paths: "."