diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 404b96f4..7754a808 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -46,9 +46,9 @@ workflows: - 'actions/attest-build-provenance@v4.2.2' - 'actions/checkout@v7.0.1' '.github/workflows/governance.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/hypatia-scan.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/idris2-abi-ci.yml': - 'actions/checkout@v7.0.1' '.github/workflows/label-triage.yml': [] @@ -58,7 +58,7 @@ workflows: - 'dtolnay/rust-toolchain@v1' - 'swatinem/rust-cache@v2.9.2' '.github/workflows/mirror.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/mvp-smoke.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' @@ -81,17 +81,17 @@ workflows: - 'swatinem/rust-cache@v2.9.2' - 'taiki-e/install-action@v2.87.28' '.github/workflows/scorecard.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/secret-scanner.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/security-scan.yml': - - 'hyperpolymath/panic-attack@b689a74d2762a1c19839ae3fbd59b7fe5ef920ea' + - 'hyperpolymath/panic-attack@8955f615f769204e42340e08bdea2de9d72e81cd' '.github/workflows/server-boot-gate.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' - 'swatinem/rust-cache@v2.9.2' '.github/workflows/spark-theatre-gate.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0' '.github/workflows/static-analysis-gate.yml': - 'actions/checkout@v7.0.1' - 'actions/download-artifact@v8.0.2' @@ -106,6 +106,11 @@ workflows: - 'hyperpolymath/cicd-suite@4c772eb235b04455307d5c03cbbc4f45130f7f0f' - 'mlugg/setup-zig@v2.2.1' dependencies: + 'Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6': + ref: 'v2.9.2' + commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + owner_id: 580492 + repo_id: 298565987 'actions/attest-build-provenance@v4.2.2': ref: 'v4.2.2' commit: 'sha1-4d101475d8b20a2381f78447822ac1eab6504dd8' @@ -148,6 +153,11 @@ dependencies: commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' owner_id: 44036562 repo_id: 192626254 + 'actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08': + ref: 'v4.6.0' + commit: 'sha1-65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08' + owner_id: 44036562 + repo_id: 192625955 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f': ref: 'v7.0.0' commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' @@ -175,9 +185,9 @@ dependencies: commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' owner_id: 42048915 repo_id: 356423100 - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f': + 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8': ref: 'v1' - commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8' owner_id: 1940490 repo_id: 260749683 'dtolnay/rust-toolchain@v1': @@ -225,9 +235,18 @@ dependencies: commit: 'sha1-4c772eb235b04455307d5c03cbbc4f45130f7f0f' owner_id: 6759885 repo_id: 1326697643 - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': - ref: '75bd5994470661a099df562d6d5ad2fe744dbd66' - commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66' + 'hyperpolymath/panic-attack@8955f615f769204e42340e08bdea2de9d72e81cd': + ref: '8955f615f769204e42340e08bdea2de9d72e81cd' + commit: 'sha1-8955f615f769204e42340e08bdea2de9d72e81cd' + owner_id: 6759885 + repo_id: 1152434997 + uses: + - 'Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8' + 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0': + ref: '3c00687a5bbd0d881d351db8502417b5d0a8b0b0' + commit: 'sha1-3c00687a5bbd0d881d351db8502417b5d0a8b0b0' owner_id: 6759885 repo_id: 1116521501 uses: @@ -235,11 +254,11 @@ dependencies: - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' - - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8' - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393' - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' - - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' + - 'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e' - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6' - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' 'mlugg/setup-zig@v2.2.1': @@ -247,9 +266,9 @@ dependencies: commit: 'sha1-d1434d08867e3ee9daa34448df10607b98908d29' owner_id: 7289241 repo_id: 812112570 - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': - ref: 'v2.4.4' - commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' + 'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e': + ref: 'v2.5.0' + commit: 'sha1-fa7117db83c52d787ae5a89f350999701505d78e' owner_id: 67707773 repo_id: 421101922 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6': @@ -262,6 +281,25 @@ dependencies: commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6' owner_id: 108928776 repo_id: 512644635 + 'slsa-framework/slsa-github-generator@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a': + ref: 'f7dd8c54c2067bafc12ca7a55595d5ee9b75204a' + commit: 'sha1-f7dd8c54c2067bafc12ca7a55595d5ee9b75204a' + owner_id: 80431187 + repo_id: 475074978 + uses: + - 'actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08' + - 'slsa-framework/slsa-github-generator@v2.1.0' + - 'softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda' + 'slsa-framework/slsa-github-generator@v2.1.0': + ref: 'v2.1.0' + commit: 'sha1-f7dd8c54c2067bafc12ca7a55595d5ee9b75204a' + owner_id: 80431187 + repo_id: 475074978 + 'softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda': + ref: 'v2.2.1' + commit: 'sha1-c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda' + owner_id: 2242 + repo_id: 204253808 'swatinem/rust-cache@v2.9.2': ref: 'v2.9.2' commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index e02ca45f..a8d0dc85 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -18,4 +18,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index cc0b7276..76f80191 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -21,6 +21,6 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }} diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 16b1ac1d..a623e1ba 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -24,7 +24,7 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 73f52da2..14b23c3a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -26,4 +26,4 @@ jobs: security-events: write id-token: write contents: read - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index c81b6352..fd1c6e17 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -23,4 +23,4 @@ jobs: # caller must grant at least that or the run startup-fails. permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index bfa885fa..f56d2668 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -24,6 +24,6 @@ permissions: jobs: scan: - uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@b689a74d2762a1c19839ae3fbd59b7fe5ef920ea # main 2026-10-01 panic-attack#209: SHA-pinned steps (skip dispatch without VERISIMDB_PAT) + uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@8955f615f769204e42340e08bdea2de9d72e81cd # main 2026-10-20: dtolnay/rust-toolchain v1 at 683b588 (the b689a74 pin was a commit no tag names any more) secrets: VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }} diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml index d36bbd52..ca2b37c9 100644 --- a/.github/workflows/spark-theatre-gate.yml +++ b/.github/workflows/spark-theatre-gate.yml @@ -20,7 +20,7 @@ permissions: jobs: spark-theatre-gate: - uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@3c00687a5bbd0d881d351db8502417b5d0a8b0b0 # main 2026-10-20, standards#1315 hypatia-ref aa34a4cc (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) with: paths: "." enforce_zero_contract: false diff --git a/.github/workflows/zz-one-off-lock-regen.yml b/.github/workflows/zz-one-off-lock-regen.yml deleted file mode 100644 index a66359d9..00000000 --- a/.github/workflows/zz-one-off-lock-regen.yml +++ /dev/null @@ -1,55 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# ONE-OFF, scratch branch only, deleted after use. Regenerates panic-attack's fix branch's -# actions.lock with the estate repair order (regen_lock in -# standards/scripts/regen-dependabot-locks.sh), runs the governance gate's own -# check against the result, and prints the lock base64-encoded. It has no -# `uses:` steps, so it needs no lock entry to start. It writes nothing back: -# the lock reaches the repository in a reviewed PR. -name: one-off actions.lock regeneration -on: - push: - branches: [claude/new-session-th4e9w-lockregen] -permissions: - contents: read -jobs: - regen: - runs-on: ubuntu-latest - timeout-minutes: 20 - env: - GH_TOKEN: ${{ github.token }} - REPO: hyperpolymath/panic-attack - STANDARDS_REGEN_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7 - STANDARDS_GATE_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7 - steps: - - name: Regenerate the repair branch's actions.lock and check it with the gate - run: | - set -uo pipefail - git clone --quiet --branch claude/new-session-th4e9w https://github.com/hyperpolymath/panic-attack.git pb - git -C pb log --oneline -1 - git clone --quiet https://github.com/hyperpolymath/standards.git std - git -C std worktree add --quiet --detach ../std-regen "$STANDARDS_REGEN_SHA" - git -C std worktree add --quiet --detach ../std-gate "$STANDARDS_GATE_SHA" - sudo apt-get install -y -qq gawk >/dev/null - gh extension install github/gh-actions-lock --pin v0.2.0 - gh actions-lock --version - # Full estate regen (gh actions-lock first, which also migrates the - # format to v0.0.3, then the repair chain). - export GH_BIN=gh REGEN_TOOLS="$PWD/std-regen/scripts" - # Start from no lock: main's pins v1 at a commit the tag no longer - # names, which gh actions-lock rejects as a conflicting target. - rm -f pb/.github/workflows/actions.lock - (cd pb && { gh actions-lock >&2 || echo "seed gh actions-lock RC=$?"; }) - test -f pb/.github/workflows/actions.lock && echo SEEDED - source std-regen/scripts/regen-dependabot-locks.sh - outcome="$(regen_lock "$PWD/pb" || true)" - echo "OUTCOME=$outcome" - (cd pb && { bash ../std-regen/scripts/check-lock-sync.sh .github/workflows && echo "SYNC RC=0" || echo "SYNC RC=$?"; }) - head -5 pb/.github/workflows/actions.lock - git -C pb status --porcelain - echo "== the governance gate, as pinned by the repair branch ($STANDARDS_GATE_SHA)" - (cd pb && ACTIONS_LOCK_VERIFIER="$PWD/../std-gate/scripts/update-actions-lock.sh" \ - bash ../std-gate/scripts/check-actions-lock-gate.sh .github/workflows); echo "GATE_RC=$?" - echo "LOCK-SHA256 $(sha256sum < pb/.github/workflows/actions.lock | cut -d' ' -f1)" - echo "LOCK-BEGIN" - cat pb/.github/workflows/actions.lock - echo "LOCK-END"