Skip to content

Commit 2ce59d1

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
committed
fix(ci): unbreak workflow YAML and add a complete actions.lock
Remediates GitHub Workflow Dependency Locking (public preview), which rejects runs at startup_failure with zero jobs and no logs. See metadatastician/standards#657. Five steps, in order, because each blocks the next: 1. Unbroke any workflow whose `permissions:` carried a scalar with an indented mapping under it - blind-permissions-insertion damage. This matters beyond the one file: gh actions-lock refuses to run when ANY workflow in the repo fails to parse, so the repo could never acquire a lockfile and could never self-heal. 2. Repinned hyperpolymath/standards reusables off commits that have no actions.lock. The rejection requires the CALLEE to be covered at the pinned SHA, which is unsatisfiable at a pre-lockfile commit. 3. Generated the lockfile with gh actions-lock. 4. Hand-added the reusable-workflow caller entries the tool omits, as '<path>': []. Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without, because every workflow a lockfile OMITS is rejected. A PARTIAL lock is worse than none - running gh actions-lock and stopping there is how this outage spread. 5. Restored SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps with head -1. Verified before push: 0 unparseable workflows, lockfile covers every workflow with no omissions, SPDX on line 1 in every file. Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead -> 0 startup_failure, 13 running. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1 parent 1de4a5b commit 2ce59d1

21 files changed

Lines changed: 34 additions & 14 deletions

‎.github/workflows/actions.lock‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,10 @@ workflows:
1111
- 'actions/configure-pages@v6.0.0'
1212
- 'actions/deploy-pages@v5.0.0'
1313
- 'actions/upload-pages-artifact@v5.0.0'
14-
- 'haskell-actions/setup@v2.11.0'
14+
- 'haskell-actions/setup@v2.12.0'
1515
'.github/workflows/codeql.yml':
1616
- 'actions/checkout@v7.0.1'
17-
- 'github/codeql-action@v4.37.3'
17+
- 'github/codeql-action@v4.37.8'
1818
'.github/workflows/dogfood-gate.yml':
1919
- 'actions/checkout@v7.0.1'
2020
- 'hyperpolymath/a2ml-ecosystem@main'
@@ -41,7 +41,7 @@ workflows:
4141
- 'actions/checkout@v7.0.1'
4242
- 'actions/upload-artifact@v7.0.1'
4343
- 'dtolnay/rust-toolchain@master'
44-
- 'swatinem/rust-cache@v2.9.1'
44+
- 'swatinem/rust-cache@v2.9.2'
4545
'.github/workflows/push-email-notify.yml':
4646
- 'dawidd6/action-send-mail@v3.12.0'
4747
'.github/workflows/repo-integrity-guard.yml':
@@ -92,22 +92,22 @@ dependencies:
9292
- 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
9393
'dawidd6/action-send-mail@v3.12.0':
9494
ref: 'v3.12.0'
95-
commit: 'sha1-12335b969ae3fb71bee5f2c6b829744261aec34c'
95+
commit: 'sha1-94de994a9f6fffee200243214e17002e2920bb59'
9696
owner_id: 9713907
9797
repo_id: 222439721
9898
'dtolnay/rust-toolchain@master':
9999
ref: 'master'
100100
commit: 'sha1-2c7215f132e9ebf062739d9130488b56d53c060c'
101101
owner_id: 1940490
102102
repo_id: 260749683
103-
'github/codeql-action@v4.37.3':
104-
ref: 'v4.37.3'
105-
commit: 'sha1-e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81'
103+
'github/codeql-action@v4.37.8':
104+
ref: 'v4.37.8'
105+
commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
106106
owner_id: 9919
107107
repo_id: 259445878
108-
'haskell-actions/setup@v2.11.0':
109-
ref: 'v2.11.0'
110-
commit: 'sha1-cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553'
108+
'haskell-actions/setup@v2.12.0':
109+
ref: 'v2.12.0'
110+
commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d'
111111
owner_id: 75048950
112112
repo_id: 623796603
113113
'hyperpolymath/a2ml-ecosystem@main':
@@ -125,8 +125,8 @@ dependencies:
125125
commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
126126
owner_id: 18365890
127127
repo_id: 220359305
128-
'swatinem/rust-cache@v2.9.1':
129-
ref: 'v2.9.1'
130-
commit: 'sha1-c19371144df3bb44fab255c43d04cbc2ab54d1c4'
128+
'swatinem/rust-cache@v2.9.2':
129+
ref: 'v2.9.2'
130+
commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
131131
owner_id: 580492
132132
repo_id: 298565987

‎.github/workflows/boj-build.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# SPDX-License-Identifier: MPL-2.0
22
# This workflow is managed by gh actions-lock.
3+
# This workflow is managed by gh actions-lock.
34
name: BoJ Server Build Trigger
45
on:
56
push:

‎.github/workflows/casket-pages.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# SPDX-License-Identifier: MPL-2.0
22
# This workflow is managed by gh actions-lock.
3+
# This workflow is managed by gh actions-lock.
34
name: GitHub Pages
45

56
on:

‎.github/workflows/codeql.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# SPDX-License-Identifier: MPL-2.0
22
# This workflow is managed by gh actions-lock.
3+
# This workflow is managed by gh actions-lock.
34
name: CodeQL Security Analysis
45

56
on:

‎.github/workflows/dogfood-gate.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# SPDX-License-Identifier: MPL-2.0
22
# This workflow is managed by gh actions-lock.
3+
# This workflow is managed by gh actions-lock.
34
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
45
#
56
# dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate

‎.github/workflows/e2e.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# SPDX-License-Identifier: MPL-2.0
22
# This workflow is managed by gh actions-lock.
3+
# This workflow is managed by gh actions-lock.
34
name: E2E Tests
45
on:
56
push:

‎.github/workflows/governance.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# SPDX-License-Identifier: MPL-2.0
22
# This workflow is managed by gh actions-lock.
3+
# This workflow is managed by gh actions-lock.
34
# governance.yml — single wrapper calling the shared estate governance bundle
45
# in hyperpolymath/standards instead of carrying per-repo copies.
56
#

‎.github/workflows/hypatia-dispatch-intake.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# SPDX-License-Identifier: MPL-2.0
22
# This workflow is managed by gh actions-lock.
3+
# This workflow is managed by gh actions-lock.
34
# Intake pipeline for cross-repo Hypatia/Gitbot dispatch events.
45
name: Hypatia Dispatch Intake
56

‎.github/workflows/hypatia-scan.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# SPDX-License-Identifier: MPL-2.0
22
# This workflow is managed by gh actions-lock.
3+
# This workflow is managed by gh actions-lock.
34
# Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml.
45
# See standards#191 for the reusable's purpose and design.
56

‎.github/workflows/inbox-steward.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# SPDX-License-Identifier: MPL-2.0
22
# This workflow is managed by gh actions-lock.
3+
# This workflow is managed by gh actions-lock.
34
# Inbox Steward — Automated PR processing through CICD gate
45
#
56
# This workflow:

0 commit comments

Comments
 (0)