Skip to content

fix(ci): adopt the Actions lockfile — every workflow was startup_failure - #71

Merged
hyperpolymath merged 1 commit into
mainfrom
fix/ci-lockfile
Aug 5, 2026
Merged

hyperpolymath merged 1 commit into
mainfrom
fix/ci-lockfile

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Every workflow in this repo returns startup_failure in 0s, so nothing here has been checked.

Workflow-lockfile enforcement is active on this account and this repo had no .github/workflows/actions.lock.

Applied the cure proven on haec#50 and trope-particularity-workbench#45. It takes four steps because each failure is invisible until the previous is fixed — they surface strictly one at a time, which makes this look intermittent when it is not:

  1. gh actions-lock — generates the lockfile, normalises pins to readable tags.
  2. Hoist SPDX back to line 1 — actions-lock puts its banner there and the workflow linter requires SPDX first, so the cure reddens every workflow file unless this is undone in the same commit.
  3. Hand-author an empty [] lockfile entry per reusable caller (5 here) — actions-lock skips callers, so without this they stay startup_failure while everything else goes green.
  4. Re-pin those callers to standards bd0df9ead7fa, verified via the commits API.

Expect previously-unseen failures. The first green run is a starting point, not a result.

Found during the 2026-08-05 estate CI/CD census.

🤖 Generated with Claude Code

Every workflow in this repo returns startup_failure in 0s, and has for its
entire recent history, so it has had no working CI at all.

Workflow-lockfile enforcement is active on this account and this repo had no
.github/workflows/actions.lock.

Applied the cure proven on haec #50 and trope-particularity-workbench #45. It
takes four steps because each one's failure is invisible until the previous is
fixed — they surface strictly one at a time:

1. gh actions-lock generates the lockfile and normalises pins to tags.
2. Hoist SPDX back to line 1. actions-lock inserts its own banner there and the
   workflow linter requires SPDX first, so the tool that cures the startup
   failures reddens every workflow file unless this is undone.
3. Hand-author an empty [] lockfile entry per reusable-workflow caller.
   gh actions-lock SKIPS callers, so without this they stay startup_failure
   while everything else goes green.
4. Re-pin those callers to standards bd0df9ead7fa, the commit that made the
   governance check lockfile-aware, verified via the commits API.

Expect previously-unseen failures. Nothing here has been checked in a long
time, so the first green run is a starting point rather than a result.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
@sonarqubecloud

sonarqubecloud Bot commented Aug 5, 2026

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

@gitar-bot

gitar-bot Bot commented Aug 5, 2026

Copy link
Copy Markdown

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved

Adopts the GitHub Actions lockfile and resolves reusable caller entries to fix persistent startup failures across all CI workflows. No issues found.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact
gitar display:verbose         

Important

Your trial ends in 5 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

Was this helpful? React with 👍 / 👎 | Gitar

@gitar-bot
gitar-bot Bot enabled auto-merge (squash) August 5, 2026 04:38

@gitar-bot gitar-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gitar has auto-approved this PR and enabled auto-merge (configure)

@gitar-bot gitar-bot Bot added the gitar-approved Added by Gitar label Aug 5, 2026
@hyperpolymath
hyperpolymath merged commit 874140a into main Aug 5, 2026
16 of 22 checks passed
@hyperpolymath
hyperpolymath deleted the fix/ci-lockfile branch August 5, 2026 06:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gitar-approved Added by Gitar

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant