[hyperpolymath]

Summary

actions.lock had drifted from the workflow files. Dependabot bumped actions in the YAML without regenerating the lock, and GitHub refuses to start a workflow whose uses: set doesn't match its lock entries. This blocked release.yml, casket-pages.yml and push-email-notify.yml. No workflow file changes.

Changes

• casket-pages.yml: haskell-actions/setup@v2.12.0 → @v2.12.1 (the version the workflow uses)
• push-email-notify.yml: hyperpolymath/smtp-notify-action@v0.3.0 → @v0.5.0
• release.yml: actions/download-artifact@v8.0.1 → @v8.0.2, actions/upload-artifact@v7.0.1 → @v7.0.2
• New records for those four refs, and the four old records removed now that nothing references them

Each new record's commit was checked against the upstream tag with git ls-remote. No commit an existing entry pins was changed.

Testing

• standards' scripts/check-lock-sync.sh reports no mismatch except the hyperpolymath/standards reusable refs, which this PR leaves alone (see below).
• Every lock entry has a dependency record.

Not fixed here

The standards reusables (governance, hypatia-scan, secret-scanner) stay red. At the pins on main they fail with "invalid lockfile pin" from standards' own old lockfile. Re-pinning to a current standards commit makes them fail at startup with zero jobs instead; I tested that on hyperpolymath/presswerk#138. That has to be fixed in standards, so this PR doesn't touch those pins.

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• .github/workflows/actions.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 1f2b0d83-3937-4e02-9bdc-016ed6145a9c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• No new commits to review - use @coderabbitai full review for a full pass

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hyperpolymath]

CI note: the red checks on this PR don't come from this change. The PR edits only .github/workflows/actions.lock.

• lint-workflows: .github/workflows/*.yml missing SPDX header. It fails the same way on main. Fixing it means adding SPDX headers to the workflow files, which belongs outside this PR.
• governance / hypatia-scan / secret-scanner / rust-ci (0 jobs): the standards reusable workflows have started zero jobs from callers estate-wide since about 2026-10-25 19:30 UTC, including on main. Here main broke on a Dependabot merge that changed only the codeql and trufflehog lock entries. This PR doesn't touch those workflows' lock entries; the fix belongs in the standards repo.
• test.yml: startup_failure on main too, in every run since at least 2026-10-08.

No fix exists yet for any of these, so I haven't ported one.

---

Generated by Claude Code

[coderabbitai]

Add Carrot credits or activate Agent usage billing to use Autofix