fix(ci): resync actions.lock and add a lock-sync recurrence gate

[hyperpolymath]

What this fixes

.github/workflows/actions.lock had drifted from the workflow YAML. That drift is
not cosmetic: GitHub refuses such a run at startup, creating zero jobs, and
reports only "This run likely failed because of a workflow file issue." Most of a
repository's CI can be silently dead for days without a single red tick, because a
run that never starts posts no check.

Measured across the estate on 2026-09-22: 13 of 37 repositories swept were in
this state.

Why it happened here

GitHub's startup check compares the lockfile ref to the workflow's uses: ref as a
literal string. gh actions-lock compares them by resolved commit. The two
disagree whenever a lock entry names a tag that dereferences to exactly the commit
the YAML pins — the tool prints All N workflows valid and GitHub still kills the
run.

Proof, on hyperpolymath/awesome-nickel/codeql.yml:

commit	YAML uses:	lock entry	literal match	outcome
ad035f4e (09-21)	codeql-action/init@v4.38.0	codeql-action@v4.38.0	yes	ran
9d83550d (09-22)	codeql-action/init@b96794f0…	codeql-action@v4.38.0	no	startup_failure, jobs=0

v4.38.0 dereferences to b96794f0… — the same commit the YAML pins — and the run
still died. A cross-workflow control at the same heads (boj-build.yml, lock-matched)
was green, so the lock is not globally broken; the failure is scoped to the one
workflow whose entry mismatches.

What changed

• .github/workflows/actions.lock regenerated and made transitively closed. A ref
  named under workflows: or inside another record's nested uses: with no top-level
  dependencies: record is a dangling edge and kills the run at startup.
• No workflow YAML was modified. Only the lockfile changed, plus the two new files
  below.
• gh actions-lock was run with --no-migrate-local-actions, which prevents it
  rewriting uses: ./… into uses: $/… — an invalid form that itself causes startup
  death.

The recurrence gate (the actual defect)

Regenerating alone is a one-week fix: Dependabot rewrites uses: refs in the YAML on a
schedule and cannot touch the lockfile, so the repo re-breaks on the next grouped
bump. This PR therefore also adds:

• .github/workflows/lock-sync-gate.yml — fails any PR whose lockfile has drifted.
• scripts/check-lock-sync.sh — the check itself.

The gate deliberately carries no uses: of its own — it checks out by calling git
in a run: step instead of actions/checkout, so it has no lockfile entry to go stale
and is structurally immune to the very failure it detects. It also has no paths:
filter, on purpose: a filtered workflow never reports on PRs that miss the filter, which
would deadlock any branch ruleset requiring this check.

The gate hard-fails on desync. It is not continue-on-error and not a ::warning::,
which cannot fail a job.

Note on gh actions-lock --verify-local

The gate does not call gh actions-lock --verify-local, which was the originally
proposed mechanism. That tool is measured wrong in both directions: it reports STALE on
job-level reusable-workflow refs it cannot parse (upstream #129 — 5 repos in this sweep
are false reds from exactly that), and it reports valid on the tag-vs-SHA literal
mismatch above. check-lock-sync.sh tests literal-string equality, which is what GitHub
actually enforces.

Expected on this PR

Workflows that have not executed since the desync began will run here for the first
time, and some may go red for reasons unrelated to this change. Per the estate stopping
rule each becomes its own issue with acceptance criteria, not a blocker on this PR.

Tracking: hyperpolymath/standards#968

🤖 Generated with Claude Code

https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm

[coderabbitai]

Warning

Review limit reached

Next included review available in 8 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 107709ec-2624-436f-8a2f-b30c8ce90ab9

📥 Commits

Reviewing files that changed from the base of the PR and between 8dc873a and 03dc343.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• .github/workflows/lock-sync-gate.yml
• scripts/check-lock-sync.sh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}