chore(ci): generate actions.lock ahead of the 2026-10-01 lock gate

.github/workflows/actions.lock

@@ -0,0 +1,125 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/boj-build.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'sonarsource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4'
+    '.github/workflows/casket-pages.yml':
+        - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d'
+        - 'actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346'
+        - 'actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9'
+        - 'haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d'
+    '.github/workflows/codeql.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'github/codeql-action@1c5b675653bb5c22dbe9b12b556ec555138e09fd'
+    '.github/workflows/dogfood-gate.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+    '.github/workflows/elixir.yml':
+        - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
+    '.github/workflows/generator-generic-ossf-slsa3-publish.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+    '.github/workflows/hypatia-scan.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3'
+        - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
+        - 'github/codeql-action@1c5b675653bb5c22dbe9b12b556ec555138e09fd'
+    '.github/workflows/instant-sync.yml':
+        - 'peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697'
+    '.github/workflows/pages.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346'
+        - 'actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9'
+    '.github/workflows/push-email-notify.yml':
+        - 'hyperpolymath/smtp-notify-action@22e7bdb322c430c1d0dac6b3bb307f4bb139d0be'
+    '.github/workflows/rescript-deno-ci.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+    '.github/workflows/trustfile.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+    '.github/workflows/workflow-linter.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+dependencies:
+    'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
+        ref: 'v6.1.0'
+        commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d':
+        ref: 'v6.0.0'
+        commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d'
+        owner_id: 44036562
+        repo_id: 513659658
+    'actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346':
+        ref: 'v5.0.1'
+        commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
+        owner_id: 44036562
+        repo_id: 438112499
+    'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3':
+        ref: 'v9.0.0'
+        commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a':
+        ref: 'v7.0.1'
+        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
+        ref: 'v7.0.0'
+        commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9':
+        ref: 'v5.0.0'
+        commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
+        owner_id: 44036562
+        repo_id: 496012378
+        uses:
+            - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+    'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
+        ref: 'v2.0.5'
+        commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+        owner_id: 42048915
+        repo_id: 356423100
+    'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
+        ref: 'v1.24.1'
+        commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
+        owner_id: 47606891
+        repo_id: 331103973
+    'github/codeql-action@1c5b675653bb5c22dbe9b12b556ec555138e09fd':
+        ref: 'v4.38.1'
+        commit: 'sha1-1c5b675653bb5c22dbe9b12b556ec555138e09fd'
+        owner_id: 9919
+        repo_id: 259445878
+    'haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d':
+        ref: 'v2.12.1'
+        commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d'
+        owner_id: 75048950
+        repo_id: 623796603
+    'hyperpolymath/smtp-notify-action@22e7bdb322c430c1d0dac6b3bb307f4bb139d0be':
+        ref: 'v0.3.0'
+        commit: 'sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be'
+        owner_id: 6759885
+        repo_id: 1352485172
+    'peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697':
+        ref: 'v4.0.1'
+        commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
+        owner_id: 18365890
+        repo_id: 220359305
+    'sonarsource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4':
+        ref: 'v8.2.2'
+        commit: 'sha1-ba9859eae8dd6bd29e412f25ddbbef3d032000f4'
+        owner_id: 545988
+        repo_id: 366408409

.github/workflows/boj-build.yml

@@ -1,3 +1,6 @@
+# SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
+
 name: Build
 on:
   push:

.github/workflows/casket-pages.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: GitHub Pages
 
 on:

.github/workflows/codeql.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: CodeQL Security Analysis
 
 on:

.github/workflows/dogfood-gate.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate

.github/workflows/elixir-ci.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Thin wrapper around hyperpolymath/standards elixir-ci-reusable.yml.
 # See standards#174 for the reusable's purpose.
 

.github/workflows/elixir.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # This workflow uses actions that are not certified by GitHub.
 # They are provided by a third-party and are governed by
 # separate terms of service, privacy policy, and support

.github/workflows/generator-generic-ossf-slsa3-publish.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # This workflow uses actions that are not certified by GitHub.
 # They are provided by a third-party and are governed by
 # separate terms of service, privacy policy, and support

.github/workflows/governance.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # governance.yml — single wrapper calling the shared estate governance bundle
 # in hyperpolymath/standards instead of carrying per-repo copies.
 #

.github/workflows/hypatia-scan.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Hypatia Neurosymbolic CI/CD Security Scan
 name: Hypatia Security Scan
 

.github/workflows/instant-sync.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: Instant Sync
 

.github/workflows/label-triage.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Label Triage
 
 # Classify newly-filed issues against the estate label taxonomy.

.github/workflows/labels.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Labels
 
 # Applies the canonical estate label set from .github/labels.json.

.github/workflows/mirror.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Mirror to Git Forges
 
 on:

.github/workflows/pages.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: GitHub Pages (Ddraig SSG)
 on:
   push:

.github/workflows/push-email-notify.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Dormant push-email notification. ARMED by setting the repo variable
 # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
 # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by

.github/workflows/rescript-deno-ci.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 permissions:
   actions: read
   contents: read

.github/workflows/scorecard.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Scorecards supply-chain security
 
 on:

.github/workflows/secret-scanner.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Secret Scanner
 
 on:

.github/workflows/trustfile.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Trustfile Validation - A2ML v2.1 integrity checks

.github/workflows/workflow-linter.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Prevention workflow - validates all workflows have proper security config
 name: Workflow Security Linter
 

lib/evidence_graph/accounts/user_notifier.ex

@@ -1,6 +1,8 @@
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 defmodule EvidenceGraph.Accounts.UserNotifier do
+  @moduledoc "Email notifications for account authentication."
+
   import Swoosh.Email
 
   alias EvidenceGraph.Accounts.User

lib/evidence_graph/api_keys.ex

@@ -94,14 +94,7 @@ defmodule EvidenceGraph.ApiKeys do
     case ArangoDB.query_read(aql, %{key_hash: key_hash}) do
       {:ok, [doc]} ->
         if doc["active"] do
-          # Update last_used_at (fire-and-forget, don't block validation)
-          Task.start(fn ->
-            ArangoDB.update("api_keys", doc["_key"], %{
-              last_used_at: DateTime.to_iso8601(DateTime.utc_now())
-            })
-          end)
-
-          {:ok, doc}
+          touch_valid_key(doc)
         else
           {:error, :revoked}
         end
@@ -182,4 +175,15 @@ defmodule EvidenceGraph.ApiKeys do
     :crypto.hash(:sha256, plaintext_key)
     |> Base.encode16(case: :lower)
   end
+
+  defp touch_valid_key(doc) do
+    # Update last_used_at (fire-and-forget, don't block validation)
+    Task.start(fn ->
+      ArangoDB.update("api_keys", doc["_key"], %{
+        last_used_at: DateTime.to_iso8601(DateTime.utc_now())
+      })
+    end)
+
+    {:ok, doc}
+  end
 end

lib/evidence_graph/claims.ex

@@ -7,6 +7,7 @@ defmodule EvidenceGraph.Claims do
 
   alias EvidenceGraph.ArangoDB
   alias EvidenceGraph.Claims.Claim
+  alias EvidenceGraph.Evidence.Evidence
 
   @doc """
   Get a claim by ID.
@@ -95,22 +96,7 @@ defmodule EvidenceGraph.Claims do
   """
   def update_claim(id, attrs) do
     with {:ok, claim} <- get_claim(id) do
-      changeset = Claim.changeset(claim, attrs)
-
-      if changeset.valid? do
-        updates =
-          Ecto.Changeset.apply_changes(changeset)
-          |> Map.put(:updated_at, DateTime.utc_now())
-          |> Claim.to_arango_doc()
-          |> Map.drop([:_key, :inserted_at])
-
-        case ArangoDB.update("claims", id, updates) do
-          {:ok, doc} -> {:ok, Claim.from_arango_doc(doc)}
-          error -> error
-        end
-      else
-        {:error, changeset}
-      end
+      update_claim_changeset(id, claim, attrs)
     end
   end
 
@@ -168,7 +154,7 @@ defmodule EvidenceGraph.Claims do
         evidence =
           Enum.map(results, fn %{"evidence" => ev, "relationship" => rel} ->
             %{
-              evidence: EvidenceGraph.Evidence.Evidence.from_arango_doc(ev),
+              evidence: Evidence.from_arango_doc(ev),
               weight: rel["weight"],
               confidence: rel["confidence"],
               reasoning: rel["reasoning"]
@@ -200,7 +186,7 @@ defmodule EvidenceGraph.Claims do
         evidence =
           Enum.map(results, fn %{"evidence" => ev, "relationship" => rel} ->
             %{
-              evidence: EvidenceGraph.Evidence.Evidence.from_arango_doc(ev),
+              evidence: Evidence.from_arango_doc(ev),
               weight: rel["weight"],
               confidence: rel["confidence"],
               reasoning: rel["reasoning"]
@@ -213,4 +199,23 @@ defmodule EvidenceGraph.Claims do
         error
     end
   end
+
+  defp update_claim_changeset(id, claim, attrs) do
+    changeset = Claim.changeset(claim, attrs)
+
+    if changeset.valid? do
+      updates =
+        Ecto.Changeset.apply_changes(changeset)
+        |> Map.put(:updated_at, DateTime.utc_now())
+        |> Claim.to_arango_doc()
+        |> Map.drop([:_key, :inserted_at])
+
+      case ArangoDB.update("claims", id, updates) do
+        {:ok, doc} -> {:ok, Claim.from_arango_doc(doc)}
+        error -> error
+      end
+    else
+      {:error, changeset}
+    end
+  end
 end