Skip to content

Commit d728da4

Browse files
hyperpolymathhyperpolymath
authored
chore(ci): SPDX headers on line 1 and Actions lockfile minted (#717)
Two estate gates, one change. **SPDX** — the linter checks `head -1` only, so workflows carrying their identifier below a managed-by comment report as missing one. Each file's **own** identifier is moved to line 1; nothing is imposed (repos here are variously MPL-2.0, PMPL-1.0-or-later, AGPL-3.0-or-later). Licences in this repo: `MPL-2.0`. **Lockfile (minted)** — `gh actions-lock` resolves each symbolic ref to a verified commit plus owner_id, repo_id and the transitive dependencies of composite actions. That is what Scorecard's Pinned-Dependencies check wants, and what an inline SHA cannot express. ⚠ Do **not** additionally SHA-pin inline — the mechanisms are mutually exclusive, and inline pinning *removes* actions from the lockfile (measured on hypatia: 14 `startup_failure`s). **Verified**: all workflows parse · no duplicate SPDX identifiers · `gh actions-lock --verify-local`: All 22 workflows have complete lockfile coverage. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
2 parents a0a1714 + 51f6bd4 commit d728da4

23 files changed

Lines changed: 212 additions & 45 deletions

‎.github/workflows/actions.lock‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
# This file is machine-generated by `gh actions-lock`.
2+
# Do not edit by hand; run `gh actions-lock` to update.
3+
# Docs: https://gh.io/actions-lockfile
4+
version: 'v0.0.2'
5+
workflows:
6+
'.github/workflows/affine-vscode-publish.yml':
7+
- 'actions/checkout@v7.0.1'
8+
'.github/workflows/casket-pages.yml':
9+
- 'actions/cache@v6.1.0'
10+
- 'actions/checkout@v7.0.1'
11+
- 'actions/configure-pages@v6.0.0'
12+
- 'actions/deploy-pages@v5.0.0'
13+
- 'actions/upload-pages-artifact@v5.0.0'
14+
- 'haskell-actions/setup@v2.11.0'
15+
'.github/workflows/ci.yml':
16+
- 'actions/checkout@v7.0.1'
17+
- 'actions/setup-node@v7.0.0'
18+
- 'actions/upload-artifact@v7.0.1'
19+
'.github/workflows/codeql.yml':
20+
- 'actions/checkout@v7.0.1'
21+
- 'github/codeql-action@v4.37.4'
22+
'.github/workflows/coq-proof-gate.yml':
23+
- 'actions/checkout@v7.0.1'
24+
'.github/workflows/governance-baseline-impl.yml':
25+
- 'actions/checkout@v7.0.1'
26+
'.github/workflows/governance.yml':
27+
- 'actions/checkout@v7.0.1'
28+
'.github/workflows/instant-sync.yml':
29+
- 'peter-evans/repository-dispatch@v4.0.1'
30+
'.github/workflows/pages.yml':
31+
- 'actions/checkout@v7.0.1'
32+
- 'actions/deploy-pages@v5.0.0'
33+
- 'actions/upload-pages-artifact@v5.0.0'
34+
'.github/workflows/panic-attack.yml':
35+
- 'actions/checkout@v7.0.1'
36+
- 'actions/upload-artifact@v7.0.1'
37+
- 'dtolnay/rust-toolchain@master'
38+
'.github/workflows/publish-jsr.yml':
39+
- 'actions/checkout@v7.0.1'
40+
- 'denoland/setup-deno@v2.0.5'
41+
'.github/workflows/push-email-notify.yml':
42+
- 'dawidd6/action-send-mail@v3.12.0'
43+
'.github/workflows/release.yml':
44+
- 'actions/attest-build-provenance@v4.1.1'
45+
- 'actions/checkout@v7.0.1'
46+
- 'ocaml/setup-ocaml@v3.7.0'
47+
'.github/workflows/secret-scanner.yml':
48+
- 'actions/checkout@v7.0.1'
49+
'.github/workflows/semgrep.yml':
50+
- 'actions/checkout@v7.0.1'
51+
- 'github/codeql-action@v4.37.4'
52+
'.github/workflows/stdlib-naming.yml':
53+
- 'actions/checkout@v7.0.1'
54+
'.github/workflows/workflow-linter.yml':
55+
- 'actions/checkout@v7.0.1'
56+
dependencies:
57+
'actions/attest-build-provenance@v4.1.1':
58+
ref: 'v4.1.1'
59+
commit: 'sha1-0f67c3f4856b2e3261c31976d6725780e5e4c373'
60+
owner_id: 44036562
61+
repo_id: 760702757
62+
uses:
63+
- 'actions/attest@a1948c3f048ba23858d222213b7c278aabede763'
64+
'actions/attest@a1948c3f048ba23858d222213b7c278aabede763':
65+
ref: 'v4.1.1'
66+
commit: 'sha1-a1948c3f048ba23858d222213b7c278aabede763'
67+
owner_id: 44036562
68+
repo_id: 760701061
69+
'actions/cache@v6.1.0':
70+
ref: 'v6.1.0'
71+
commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
72+
owner_id: 44036562
73+
repo_id: 215566462
74+
'actions/checkout@v7.0.1':
75+
ref: 'v7.0.1'
76+
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
77+
owner_id: 44036562
78+
repo_id: 197814629
79+
'actions/configure-pages@v6.0.0':
80+
ref: 'v6.0.0'
81+
commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d'
82+
owner_id: 44036562
83+
repo_id: 513659658
84+
'actions/deploy-pages@v5.0.0':
85+
ref: 'v5.0.0'
86+
commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128'
87+
owner_id: 44036562
88+
repo_id: 438112499
89+
'actions/setup-node@v7.0.0':
90+
ref: 'v7.0.0'
91+
commit: 'sha1-820762786026740c76f36085b0efc47a31fe5020'
92+
owner_id: 44036562
93+
repo_id: 189476904
94+
'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
95+
ref: 'v7.0.0'
96+
commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
97+
owner_id: 44036562
98+
repo_id: 192625955
99+
'actions/upload-artifact@v7.0.1':
100+
ref: 'v7.0.1'
101+
commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
102+
owner_id: 44036562
103+
repo_id: 192625955
104+
'actions/upload-pages-artifact@v5.0.0':
105+
ref: 'v5.0.0'
106+
commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
107+
owner_id: 44036562
108+
repo_id: 496012378
109+
uses:
110+
- 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
111+
'dawidd6/action-send-mail@v3.12.0':
112+
ref: 'v3.12.0'
113+
commit: 'sha1-2e600f3776677e493bf0da7aaec39a586d19a5ed'
114+
owner_id: 9713907
115+
repo_id: 222439721
116+
'denoland/setup-deno@v2.0.5':
117+
ref: 'v2.0.5'
118+
commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
119+
owner_id: 42048915
120+
repo_id: 356423100
121+
'dtolnay/rust-toolchain@master':
122+
ref: 'master'
123+
commit: 'sha1-2c7215f132e9ebf062739d9130488b56d53c060c'
124+
owner_id: 1940490
125+
repo_id: 260749683
126+
'github/codeql-action@v4.37.4':
127+
ref: 'v4.37.4'
128+
commit: 'sha1-f205ea1c3313d32999d8d6a48b4f6530d4437b38'
129+
owner_id: 9919
130+
repo_id: 259445878
131+
'haskell-actions/setup@v2.11.0':
132+
ref: 'v2.11.0'
133+
commit: 'sha1-cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553'
134+
owner_id: 75048950
135+
repo_id: 623796603
136+
'ocaml/setup-ocaml@v3.7.0':
137+
ref: 'v3.7.0'
138+
commit: 'sha1-15d660006c1d3110d77c34b7faa3bddefe8b82f0'
139+
owner_id: 1841483
140+
repo_id: 220799100
141+
'peter-evans/repository-dispatch@v4.0.1':
142+
ref: 'v4.0.1'
143+
commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
144+
owner_id: 18365890
145+
repo_id: 220359305

‎.github/workflows/affine-vscode-publish.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
# Publishes @hyperpolymath/affine-vscode to npm on a scoped tag push.
34
#
45
# This repo is Deno-first (see CLAUDE.md). The npm publish here is a
@@ -33,7 +34,7 @@ jobs:
3334
timeout-minutes: 10
3435
steps:
3536
- name: Checkout code
36-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
37+
uses: actions/checkout@v7.0.1
3738
- name: Verify tag matches package version
3839
working-directory: packages/affine-vscode
3940
run: |

‎.github/workflows/casket-pages.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
name: GitHub Pages
34
on:
45
push:
@@ -49,19 +50,19 @@ jobs:
4950
timeout-minutes: 10
5051
steps:
5152
- name: Checkout
52-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
53+
uses: actions/checkout@v7.0.1
5354
- name: Checkout casket-ssg
54-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
55+
uses: actions/checkout@v7.0.1
5556
with:
5657
repository: hyperpolymath/casket-ssg
5758
path: .casket-ssg
5859
- name: Setup GHCup
59-
uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2
60+
uses: haskell-actions/setup@v2.11.0
6061
with:
6162
ghc-version: '9.8.2'
6263
cabal-version: '3.10'
6364
- name: Cache Cabal
64-
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
65+
uses: actions/cache@v6.1.0
6566
with:
6667
path: |
6768
~/.cabal/packages
@@ -102,7 +103,7 @@ jobs:
102103
fi
103104
cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site
104105
- name: Setup Pages
105-
uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
106+
uses: actions/configure-pages@v6.0.0
106107
with:
107108
# Self-provision Pages on first run instead of failing with
108109
# 404 ("Get Pages site failed"). The repo had Pages disabled
@@ -113,7 +114,7 @@ jobs:
113114
# this.
114115
enablement: true
115116
- name: Upload artifact
116-
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
117+
uses: actions/upload-pages-artifact@v5.0.0
117118
with:
118119
path: '_site'
119120
deploy:
@@ -127,4 +128,4 @@ jobs:
127128
steps:
128129
- name: Deploy to GitHub Pages
129130
id: deployment
130-
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
131+
uses: actions/deploy-pages@v5.0.0

‎.github/workflows/ci.yml‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
#
34
# Standalone CI: no dependency on third-party actions or external-repo
45
# reusable workflows. The OCaml toolchain is self-hosted via apt + opam
@@ -34,7 +35,7 @@ jobs:
3435

3536
steps:
3637
- name: Checkout code
37-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
38+
uses: actions/checkout@v7.0.1
3839
with:
3940
# Full history so the soundness-ledger gate (property 4) can resolve
4041
# :ground-truth-sha: and diff soundness paths against it. A shallow
@@ -51,7 +52,7 @@ jobs:
5152
|| opam switch create . ocaml-base-compiler.4.14.2 --no-install --yes
5253
opam exec -- ocaml -version
5354
- name: Set up Node.js
54-
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4
55+
uses: actions/setup-node@v7.0.0
5556
with:
5657
node-version: "20"
5758
- name: Install dependencies
@@ -117,7 +118,7 @@ jobs:
117118

118119
steps:
119120
- name: Checkout code
120-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
121+
uses: actions/checkout@v7.0.1
121122
- name: Set up OCaml toolchain (self-hosted; replaces ocaml/setup-ocaml)
122123
run: |
123124
sudo apt-get update
@@ -146,7 +147,7 @@ jobs:
146147

147148
steps:
148149
- name: Checkout code
149-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
150+
uses: actions/checkout@v7.0.1
150151
- name: Set up OCaml toolchain (self-hosted; replaces ocaml/setup-ocaml)
151152
run: |
152153
sudo apt-get update
@@ -182,7 +183,7 @@ jobs:
182183
} >> "$GITHUB_STEP_SUMMARY"
183184
- name: Upload bench log
184185
if: always()
185-
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
186+
uses: actions/upload-artifact@v7.0.1
186187
with:
187188
name: bench-output
188189
path: bench-output.log
@@ -196,7 +197,7 @@ jobs:
196197

197198
steps:
198199
- name: Checkout code
199-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
200+
uses: actions/checkout@v7.0.1
200201
- name: Set up OCaml toolchain (self-hosted; replaces ocaml/setup-ocaml)
201202
run: |
202203
sudo apt-get update
@@ -231,7 +232,7 @@ jobs:
231232
} >> "$GITHUB_STEP_SUMMARY"
232233
- name: Upload coverage HTML
233234
if: always()
234-
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
235+
uses: actions/upload-artifact@v7.0.1
235236
with:
236237
name: coverage-html
237238
path: _coverage
@@ -256,9 +257,9 @@ jobs:
256257

257258
steps:
258259
- name: Checkout code
259-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
260+
uses: actions/checkout@v7.0.1
260261
- name: Set up Node.js
261-
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4
262+
uses: actions/setup-node@v7.0.0
262263
with:
263264
node-version: "20"
264265
- name: Install test runner dependencies
@@ -301,9 +302,9 @@ jobs:
301302

302303
steps:
303304
- name: Checkout code
304-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
305+
uses: actions/checkout@v7.0.1
305306
- name: Set up Node.js
306-
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4
307+
uses: actions/setup-node@v7.0.0
307308
with:
308309
node-version: "20"
309310
- name: Install tree-sitter CLI

‎.github/workflows/codeql.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
name: CodeQL Security Analysis
34
on:
45
push:
@@ -35,13 +36,13 @@ jobs:
3536
build-mode: none
3637
steps:
3738
- name: Checkout
38-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
39+
uses: actions/checkout@v7.0.1
3940
- name: Initialize CodeQL
40-
uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
41+
uses: github/codeql-action/init@v4.37.4
4142
with:
4243
languages: ${{ matrix.language }}
4344
build-mode: ${{ matrix.build-mode }}
4445
- name: Perform CodeQL Analysis
45-
uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
46+
uses: github/codeql-action/analyze@v4.37.4
4647
with:
4748
category: "/language:${{ matrix.language }}"

‎.github/workflows/coq-proof-gate.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
# Coq/Rocq proof gate for the `formal/` mechanised-metatheory track (issue #513).
34
#
45
# This gate is deliberately FAIL-CLOSED. It does NOT probe for the prover and
@@ -42,7 +43,7 @@ jobs:
4243
image: coqorg/coq@sha256:e50d77c4c5a9aa0d76ae1b343d79c5f922da3a75054b79c5dc635895438e4674
4344
options: --user root
4445
steps:
45-
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
46+
- uses: actions/checkout@v7.0.1
4647

4748
# The coqorg images install Coq into an opam switch owned by the `coq`
4849
# user and put it on PATH via an ENTRYPOINT wrapper. GitHub Actions

‎.github/workflows/governance-baseline-impl.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
#
34
# Local reusable backing `governance-baseline.yml`. Its single job is named
45
# "Validate Hypatia baseline" so that, when called from a job with id
@@ -25,7 +26,7 @@ jobs:
2526
timeout-minutes: 5
2627
steps:
2728
- name: Checkout
28-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
29+
uses: actions/checkout@v7.0.1
2930
- name: Validate .hypatia-baseline.json (if present)
3031
run: |
3132
set -euo pipefail

‎.github/workflows/governance-baseline.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
#
34
# Required-check bridge: re-emits the estate-standard governance check context
45
# `governance / Validate Hypatia baseline` on EVERY pull request.

‎.github/workflows/governance.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
#
34
# Standalone governance gate. Previously a thin caller of
45
# `hyperpolymath/standards/.github/workflows/governance-reusable.yml@main`;
@@ -26,7 +27,7 @@ jobs:
2627
timeout-minutes: 5
2728
steps:
2829
- name: Checkout code
29-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
30+
uses: actions/checkout@v7.0.1
3031
with:
3132
fetch-depth: 0
3233
- name: Fetch base ref (DOC-FORMAT delta)

‎.github/workflows/hypatia-scan.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
# Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml.
34
# See standards#191 for the reusable's purpose and design.
45

0 commit comments

Comments
 (0)