[hyperpolymath]

Summary

generator-generic-ossf-slsa3-publish.yml calls slsa-framework/slsa-github-generator@f7dd8c54… as a job-level reusable, but actions.lock had neither an entry nor a record for it. GitHub refuses to start a workflow whose uses: set doesn't match its lock entries. No workflow file changes.

Changes

• generator-generic-ossf-slsa3-publish.yml: add the missing entry slsa-framework/slsa-github-generator@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a
• New record for it: ref: 'v2.1.0', owner_id: 80431187, repo_id: 475074978. That is the tag git ls-remote shows peeling to f7dd8c54, and the IDs seven other estate lockfiles record for this action.

Testing

• standards' scripts/check-lock-sync.sh reports no mismatch except the hyperpolymath/standards reusable refs, which this PR leaves alone (see below).
• Every lock entry has a dependency record.

Not fixed here

The standards reusables (governance, hypatia-scan, secret-scanner, rust-ci) stay red. At the pins on main they fail with "invalid lockfile pin" from standards' own old lockfile. Re-pinning to a current standards commit makes them fail at startup with zero jobs instead; I tested that on hyperpolymath/presswerk#138. That has to be fixed in standards, so this PR doesn't touch those pins.

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• .github/workflows/actions.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 5488bdae-2969-44f4-bb8e-37c55c277d2e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• No new commits to review - use @coderabbitai full review for a full pass

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T01:34:42.530406Z	c64ecfd	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[hyperpolymath]

CI note: the red checks on this PR don't come from this change. The PR edits only .github/workflows/actions.lock.

• lint-workflows (missing SPDX headers in workflow files) and Validate K9 contracts: both fail the same way on main.
• PR (address), ClusterFuzzLite: failed to read dockerfile: open Dockerfile: no such file or directory. The repo has .clusterfuzzlite/Containerfile, not Dockerfile. This check runs only on PRs and has failed on every PR since 2026-10-16.
• governance / hypatia-scan / secret-scanner (0 jobs): the standards reusable workflows have started zero jobs from callers estate-wide since about 2026-10-25, including on main. This PR doesn't touch those workflows' lock entries.
• publish-nixpkgs.yml: 0 jobs on main as well.

No fix exists yet for any of these, so I haven't ported one.

---

Generated by Claude Code