Skip to content

Commit 9b102d6

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
authored
fix(ci): add the Actions lockfile and re-pin stale reusables (#465)
Every governance and Hypatia run here is **`startup_failure`** — not failing, **never starting**. Two causes, and the second is invisible until the first is fixed. ## 1. No lockfile Workflow-lockfile enforcement is active on this account and this repo had **no `.github/workflows/actions.lock`**, so every workflow was rejected before any job was created — no log, no check run, no row in `gh pr checks`. ## 2. Two stale reusable pins `81dbf2dd` (2026-06-27) across 3 files, and `e9c88887` across 2. Re-pinned to standards `bd0df9ead7fa` — the commit that made the governance check lockfile-aware. ## Why this was misdiagnosed Because the workflow never emitted its status context, the branch rule requiring `governance / Validate Hypatia Baseline` **looked like a phantom**. It isn't — **the rule is correct and the workflow is broken.** Rewriting the rule would have turned *"this check is broken"* into *"this check is not required"*. ## The cure, in order Each step's failure is invisible until the previous one is fixed: 1. **`gh actions-lock`** — generates the lockfile, normalises pins to tags 2. **Hoist SPDX back to line 1** — `actions-lock` puts its banner there and the linter requires SPDX first, so the tool that cures the startup failures would otherwise redden all 20 workflow files 3. **Hand-author `[]` lockfile entries** for the 5 reusable callers — `actions-lock` **skips callers**, so without this they stay `startup_failure` while everything else goes green 4. **Re-pin** the callers **Verified:** all 20 workflows parse, SPDX on line 1, 5 caller entries in the lockfile. **Expect previously-unseen failures.** Nothing here has been checked in a long time; the first green run is a starting point, not a result. Found by the estate CI/CD census (metadatastician/standards#583). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
1 parent 4621a3a commit 9b102d6

21 files changed

Lines changed: 194 additions & 42 deletions

‎.github/workflows/actions.lock‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
# This file is machine-generated by `gh actions-lock`.
2+
# Do not edit by hand; run `gh actions-lock` to update.
3+
# Docs: https://gh.io/actions-lockfile
4+
version: 'v0.0.2'
5+
workflows:
6+
'.github/workflows/boj-build.yml':
7+
- 'actions/checkout@v7.0.1'
8+
'.github/workflows/casket-pages.yml':
9+
- 'actions/cache@v6.1.0'
10+
- 'actions/checkout@v7.0.1'
11+
- 'actions/configure-pages@v6.0.0'
12+
- 'actions/deploy-pages@v5.0.0'
13+
- 'actions/upload-pages-artifact@v5.0.0'
14+
- 'haskell-actions/setup@v2.11.0'
15+
'.github/workflows/codeql.yml':
16+
- 'actions/checkout@v7.0.1'
17+
- 'github/codeql-action@v4.37.3'
18+
'.github/workflows/dogfood-gate.yml':
19+
- 'actions/checkout@v7.0.1'
20+
- 'hyperpolymath/a2ml-ecosystem@main'
21+
- 'hyperpolymath/k9-ecosystem@main'
22+
'.github/workflows/e2e.yml':
23+
- 'actions/checkout@v7.0.1'
24+
'.github/workflows/governance.yml': []
25+
'.github/workflows/hypatia-dispatch-intake.yml':
26+
- 'actions/checkout@v7.0.1'
27+
'.github/workflows/hypatia-scan.yml': []
28+
'.github/workflows/inbox-steward.yml':
29+
- 'actions/checkout@v7.0.1'
30+
'.github/workflows/instant-sync.yml':
31+
- 'peter-evans/repository-dispatch@v4.0.1'
32+
'.github/workflows/learning-loop.yml':
33+
- 'actions/checkout@v7.0.1'
34+
- 'actions/upload-artifact@v7.0.1'
35+
'.github/workflows/mirror.yml': []
36+
'.github/workflows/pages.yml':
37+
- 'actions/checkout@v7.0.1'
38+
- 'actions/deploy-pages@v5.0.0'
39+
- 'actions/upload-pages-artifact@v5.0.0'
40+
'.github/workflows/panicbot-sweep.yml':
41+
- 'actions/checkout@v7.0.1'
42+
- 'actions/upload-artifact@v7.0.1'
43+
- 'dtolnay/rust-toolchain@master'
44+
- 'swatinem/rust-cache@v2.9.1'
45+
'.github/workflows/push-email-notify.yml':
46+
- 'dawidd6/action-send-mail@v3.12.0'
47+
'.github/workflows/repo-integrity-guard.yml':
48+
- 'actions/checkout@v7.0.1'
49+
'.github/workflows/rust.yml':
50+
- 'actions/checkout@v7.0.1'
51+
'.github/workflows/scorecard.yml': []
52+
'.github/workflows/secret-scanner.yml': []
53+
'.github/workflows/supervised-fleet-scan.yml':
54+
- 'actions/checkout@v7.0.1'
55+
dependencies:
56+
'actions/cache@v6.1.0':
57+
ref: 'v6.1.0'
58+
commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
59+
owner_id: 44036562
60+
repo_id: 215566462
61+
'actions/checkout@v7.0.1':
62+
ref: 'v7.0.1'
63+
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
64+
owner_id: 44036562
65+
repo_id: 197814629
66+
'actions/configure-pages@v6.0.0':
67+
ref: 'v6.0.0'
68+
commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d'
69+
owner_id: 44036562
70+
repo_id: 513659658
71+
'actions/deploy-pages@v5.0.0':
72+
ref: 'v5.0.0'
73+
commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128'
74+
owner_id: 44036562
75+
repo_id: 438112499
76+
'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
77+
ref: 'v7.0.0'
78+
commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
79+
owner_id: 44036562
80+
repo_id: 192625955
81+
'actions/upload-artifact@v7.0.1':
82+
ref: 'v7.0.1'
83+
commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
84+
owner_id: 44036562
85+
repo_id: 192625955
86+
'actions/upload-pages-artifact@v5.0.0':
87+
ref: 'v5.0.0'
88+
commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
89+
owner_id: 44036562
90+
repo_id: 496012378
91+
uses:
92+
- 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
93+
'dawidd6/action-send-mail@v3.12.0':
94+
ref: 'v3.12.0'
95+
commit: 'sha1-12335b969ae3fb71bee5f2c6b829744261aec34c'
96+
owner_id: 9713907
97+
repo_id: 222439721
98+
'dtolnay/rust-toolchain@master':
99+
ref: 'master'
100+
commit: 'sha1-2c7215f132e9ebf062739d9130488b56d53c060c'
101+
owner_id: 1940490
102+
repo_id: 260749683
103+
'github/codeql-action@v4.37.3':
104+
ref: 'v4.37.3'
105+
commit: 'sha1-e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81'
106+
owner_id: 9919
107+
repo_id: 259445878
108+
'haskell-actions/setup@v2.11.0':
109+
ref: 'v2.11.0'
110+
commit: 'sha1-cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553'
111+
owner_id: 75048950
112+
repo_id: 623796603
113+
'hyperpolymath/a2ml-ecosystem@main':
114+
ref: 'main'
115+
commit: 'sha1-aa4b836bd969df2bc58128cb8e3d20bbc88d5e79'
116+
owner_id: 6759885
117+
repo_id: 1275649586
118+
'hyperpolymath/k9-ecosystem@main':
119+
ref: 'main'
120+
commit: 'sha1-89f3c2702f4f650a92aa7411502f38da06abd562'
121+
owner_id: 6759885
122+
repo_id: 1275650185
123+
'peter-evans/repository-dispatch@v4.0.1':
124+
ref: 'v4.0.1'
125+
commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
126+
owner_id: 18365890
127+
repo_id: 220359305
128+
'swatinem/rust-cache@v2.9.1':
129+
ref: 'v2.9.1'
130+
commit: 'sha1-c19371144df3bb44fab255c43d04cbc2ab54d1c4'
131+
owner_id: 580492
132+
repo_id: 298565987

‎.github/workflows/boj-build.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
name: BoJ Server Build Trigger
34
on:
45
push:
@@ -10,7 +11,7 @@ jobs:
1011
timeout-minutes: 10
1112
steps:
1213
- name: Checkout
13-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
14+
uses: actions/checkout@v7.0.1
1415
- name: Trigger BoJ Server (Casket/ssg-mcp)
1516
run: |
1617
# Send a secure trigger to boj-server to build this repository

‎.github/workflows/casket-pages.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
name: GitHub Pages
34

45
on:
@@ -22,22 +23,22 @@ jobs:
2223
timeout-minutes: 30
2324
steps:
2425
- name: Checkout
25-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
26+
uses: actions/checkout@v7.0.1
2627

2728
- name: Checkout casket-ssg
28-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
29+
uses: actions/checkout@v7.0.1
2930
with:
3031
repository: hyperpolymath/casket-ssg
3132
path: .casket-ssg
3233

3334
- name: Setup GHCup
34-
uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2
35+
uses: haskell-actions/setup@v2.11.0
3536
with:
3637
ghc-version: '9.8.2'
3738
cabal-version: '3.10'
3839

3940
- name: Cache Cabal
40-
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
41+
uses: actions/cache@v6.1.0
4142
with:
4243
path: |
4344
~/.cabal/packages
@@ -99,10 +100,10 @@ jobs:
99100
touch ../_site/.nojekyll
100101
101102
- name: Setup Pages
102-
uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
103+
uses: actions/configure-pages@v6.0.0
103104

104105
- name: Upload artifact
105-
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
106+
uses: actions/upload-pages-artifact@v5.0.0
106107
with:
107108
path: '_site'
108109

@@ -116,4 +117,4 @@ jobs:
116117
steps:
117118
- name: Deploy to GitHub Pages
118119
id: deployment
119-
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
120+
uses: actions/deploy-pages@v5.0.0

‎.github/workflows/codeql.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
name: CodeQL Security Analysis
34

45
on:
@@ -42,15 +43,15 @@ jobs:
4243

4344
steps:
4445
- name: Checkout
45-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
46+
uses: actions/checkout@v7.0.1
4647

4748
- name: Initialize CodeQL
48-
uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
49+
uses: github/codeql-action/init@v4.37.3
4950
with:
5051
languages: ${{ matrix.language }}
5152
build-mode: ${{ matrix.build-mode }}
5253

5354
- name: Perform CodeQL Analysis
54-
uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
55+
uses: github/codeql-action/analyze@v4.37.3
5556
with:
5657
category: "/language:${{ matrix.language }}"

‎.github/workflows/dogfood-gate.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
34
#
45
# dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate
@@ -27,7 +28,7 @@ jobs:
2728

2829
steps:
2930
- name: Checkout repository
30-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
31+
uses: actions/checkout@v7.0.1
3132

3233
- name: Check for A2ML files
3334
id: detect
@@ -44,7 +45,7 @@ jobs:
4445
4546
- name: Validate A2ML manifests
4647
if: steps.detect.outputs.count > 0
47-
uses: hyperpolymath/a2ml-ecosystem/validate-action@aa4b836bd969df2bc58128cb8e3d20bbc88d5e79 # main
48+
uses: hyperpolymath/a2ml-ecosystem/validate-action@main
4849
with:
4950
path: '.'
5051
strict: 'false'
@@ -89,7 +90,7 @@ jobs:
8990

9091
steps:
9192
- name: Checkout repository
92-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
93+
uses: actions/checkout@v7.0.1
9394

9495
- name: Check for K9 files
9596
id: detect
@@ -106,7 +107,7 @@ jobs:
106107
107108
- name: Validate K9 contracts
108109
if: steps.detect.outputs.k9_count > 0
109-
uses: hyperpolymath/k9-ecosystem/validate-action@89f3c2702f4f650a92aa7411502f38da06abd562 # main
110+
uses: hyperpolymath/k9-ecosystem/validate-action@main
110111
with:
111112
path: '.'
112113
strict: 'false'
@@ -139,7 +140,7 @@ jobs:
139140

140141
steps:
141142
- name: Checkout repository
142-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
143+
uses: actions/checkout@v7.0.1
143144

144145
- name: Scan for invisible characters
145146
id: lint
@@ -204,7 +205,7 @@ jobs:
204205

205206
steps:
206207
- name: Checkout repository
207-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
208+
uses: actions/checkout@v7.0.1
208209

209210
- name: Check for Groove manifest
210211
id: groove
@@ -265,7 +266,7 @@ jobs:
265266

266267
steps:
267268
- name: Checkout repository
268-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
269+
uses: actions/checkout@v7.0.1
269270

270271
- name: Generate dogfooding scorecard
271272
run: |

‎.github/workflows/e2e.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
name: E2E Tests
34
on:
45
push:
@@ -14,7 +15,7 @@ jobs:
1415
runs-on: ubuntu-latest
1516
timeout-minutes: 30
1617
steps:
17-
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
18+
- uses: actions/checkout@v7.0.1
1819
- name: Install PyYAML (for workflow YAML validation)
1920
run: pip install pyyaml --quiet
2021
- name: Run E2E tests

‎.github/workflows/governance.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
# governance.yml — single wrapper calling the shared estate governance bundle
34
# in hyperpolymath/standards instead of carrying per-repo copies.
45
#
@@ -32,4 +33,4 @@ permissions:
3233

3334
jobs:
3435
governance:
35-
uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 # main 2026-06-27
36+
uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 # main 2026-06-27

‎.github/workflows/hypatia-dispatch-intake.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
# Intake pipeline for cross-repo Hypatia/Gitbot dispatch events.
34
name: Hypatia Dispatch Intake
45

@@ -22,7 +23,7 @@ jobs:
2223
contents: write # push received events to the findings-submissions inbox branch
2324
steps:
2425
- name: Checkout gitbot-fleet
25-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
26+
uses: actions/checkout@v7.0.1
2627
with:
2728
fetch-depth: 0
2829

‎.github/workflows/hypatia-scan.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
# Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml.
34
# See standards#191 for the reusable's purpose and design.
45

@@ -28,7 +29,7 @@ permissions:
2829

2930
jobs:
3031
hypatia:
31-
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
32+
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
3233
secrets: inherit
3334
# Total caller-side wall-clock cap for the reusable. Matches
3435
# Hypatia's `missing_timeout_minutes` rule expectation. The scan is

‎.github/workflows/inbox-steward.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
# Inbox Steward — Automated PR processing through CICD gate
34
#
45
# This workflow:
@@ -288,7 +289,7 @@ jobs:
288289

289290
steps:
290291
- name: Checkout gitbot-fleet
291-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
292+
uses: actions/checkout@v7.0.1
292293
with:
293294
fetch-depth: 0
294295

@@ -377,7 +378,7 @@ jobs:
377378

378379
steps:
379380
- name: Checkout gitbot-fleet
380-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
381+
uses: actions/checkout@v7.0.1
381382

382383
- name: Send dispatch to Hypatia
383384
env:

0 commit comments

Comments
 (0)