From 53dd4aa844020bc5669c18a4f4d4d558ab6a8f84 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 20 Sep 2026 02:05:01 +0000 Subject: [PATCH] fix(ci): reconcile the workflows with actions.lock (gh-actions-lock v0.1.6) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `actions.lock` is authoritative: the workflows carry readable refs and the lock records the commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest make the whole repository unstartable — `startup_failure`, "Invalid lockfile". Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are reverted to their readable form here precisely because the lockfile, not the workflow, is what pins them. --- .github/workflows/actions.lock | 65 ++++++++++++++-------- .github/workflows/boj-build.yml | 3 +- .github/workflows/cargo-audit.yml | 5 +- .github/workflows/casket-pages.yml | 15 ++--- .github/workflows/codeql.yml | 7 ++- .github/workflows/dashboard-check.yml | 5 +- .github/workflows/dependabot-automerge.yml | 3 +- .github/workflows/dogfood-gate.yml | 15 ++--- .github/workflows/e2e.yml | 27 ++++----- .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 3 +- .github/workflows/label-triage.yml | 1 + .github/workflows/labels.yml | 1 + .github/workflows/main-estate-audit.yml | 56 ++++++++++--------- .github/workflows/mirror.yml | 1 + .github/workflows/pages.yml | 9 +-- .github/workflows/push-email-notify.yml | 3 +- .github/workflows/rust-ci.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/semgrep.yml | 5 +- .github/workflows/workflow-linter.yml | 3 +- 23 files changed, 138 insertions(+), 94 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 14f606f..8c42abf 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -3,14 +3,6 @@ # Docs: https://gh.io/actions-lockfile version: 'v0.0.2' workflows: - '.github/workflows/governance.yml': [] - '.github/workflows/hypatia-scan.yml': [] - '.github/workflows/label-triage.yml': [] - '.github/workflows/labels.yml': [] - '.github/workflows/mirror.yml': [] - '.github/workflows/rust-ci.yml': [] - '.github/workflows/scorecard.yml': [] - '.github/workflows/secret-scanner.yml': [] '.github/workflows/boj-build.yml': - 'actions/checkout@v7.0.1' '.github/workflows/cargo-audit.yml': @@ -19,12 +11,12 @@ workflows: - 'actions/cache@v6.1.0' - 'actions/checkout@v7.0.1' - 'actions/configure-pages@v6.0.0' - - 'actions/deploy-pages@v5.0.0' + - 'actions/deploy-pages@v5.0.1' - 'actions/upload-pages-artifact@v5.0.0' - 'haskell-actions/setup@v2.12.0' '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - - 'github/codeql-action@v4.37.8' + - 'github/codeql-action@v4.38.0' '.github/workflows/dashboard-check.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' @@ -38,17 +30,28 @@ workflows: - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' - 'swatinem/rust-cache@v2.9.2' + '.github/workflows/governance.yml': [] + '.github/workflows/hypatia-scan.yml': [] '.github/workflows/instant-sync.yml': - 'peter-evans/repository-dispatch@v4.0.1' + '.github/workflows/label-triage.yml': [] + '.github/workflows/labels.yml': [] + '.github/workflows/main-estate-audit.yml': + - 'actions/checkout@v7.0.1' + - 'hyperpolymath/cicd-suite@main' + '.github/workflows/mirror.yml': [] '.github/workflows/pages.yml': - 'actions/checkout@v7.0.1' - - 'actions/deploy-pages@v5.0.0' + - 'actions/deploy-pages@v5.0.1' - 'actions/upload-pages-artifact@v5.0.0' '.github/workflows/push-email-notify.yml': - 'dawidd6/action-send-mail@v3.12.0' + '.github/workflows/rust-ci.yml': [] + '.github/workflows/scorecard.yml': [] + '.github/workflows/secret-scanner.yml': [] '.github/workflows/semgrep.yml': - 'actions/checkout@v7.0.1' - - 'github/codeql-action@v4.37.8' + - 'github/codeql-action@v4.38.0' '.github/workflows/workflow-linter.yml': - 'actions/checkout@v7.0.1' dependencies: @@ -67,9 +70,9 @@ dependencies: commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d' owner_id: 44036562 repo_id: 513659658 - 'actions/deploy-pages@v5.0.0': - ref: 'v5.0.0' - commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128' + 'actions/deploy-pages@v5.0.1': + ref: 'v5.0.1' + commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346' owner_id: 44036562 repo_id: 438112499 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f': @@ -86,7 +89,7 @@ dependencies: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' 'dawidd6/action-send-mail@v3.12.0': ref: 'v3.12.0' - commit: 'sha1-0bbdab096651ee93f37ec02383e088183d41ff0b' + commit: 'sha1-2cea9617b09d79a095af21254fbcb7ae95903dde' owner_id: 9713907 repo_id: 222439721 'dependabot/fetch-metadata@v3.1.0': @@ -96,12 +99,12 @@ dependencies: repo_id: 371068214 'dtolnay/rust-toolchain@v1': ref: 'v1' - commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' + commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de' owner_id: 1940490 repo_id: 260749683 - 'github/codeql-action@v4.37.8': - ref: 'v4.37.8' - commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' + 'github/codeql-action@v4.38.0': + ref: 'v4.38.0' + commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' owner_id: 9919 repo_id: 259445878 'haskell-actions/setup@v2.12.0': @@ -111,12 +114,30 @@ dependencies: repo_id: 623796603 'hyperpolymath/a2ml-ecosystem@main': ref: 'main' - commit: 'sha1-aa4b836bd969df2bc58128cb8e3d20bbc88d5e79' + commit: 'sha1-ed83d6927e8fb21431e403dbf6d7a4af96772746' owner_id: 6759885 repo_id: 1275649586 + 'hyperpolymath/cicd-suite@main': + ref: 'main' + commit: 'sha1-180b419825d238f8b606584c970a81dfa7cb6f81' + owner_id: 6759885 + repo_id: 1326697643 + uses: + - 'hyperpolymath/deed-ecosystem@f9d999b60cb5f383679ea19912bcdc49c944973a' + - 'hyperpolymath/k9-ecosystem@2155aa26a21758f2ba119f61bc7e0e1981c106fb' + 'hyperpolymath/deed-ecosystem@f9d999b60cb5f383679ea19912bcdc49c944973a': + ref: 'main' + commit: 'sha1-f9d999b60cb5f383679ea19912bcdc49c944973a' + owner_id: 6759885 + repo_id: 1275649586 + 'hyperpolymath/k9-ecosystem@2155aa26a21758f2ba119f61bc7e0e1981c106fb': + ref: 'main' + commit: 'sha1-2155aa26a21758f2ba119f61bc7e0e1981c106fb' + owner_id: 6759885 + repo_id: 1275650185 'hyperpolymath/k9-ecosystem@main': ref: 'main' - commit: 'sha1-89f3c2702f4f650a92aa7411502f38da06abd562' + commit: 'sha1-c1a34884054fabf0e9de81dbf68f4ba7874e85f1' owner_id: 6759885 repo_id: 1275650185 'peter-evans/repository-dispatch@v4.0.1': diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index a8b3e02..231ddad 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: BoJ Server Build Trigger @@ -11,7 +12,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 - name: Trigger BoJ Server (Casket/ssg-mcp) run: | # Send a secure trigger to boj-server to build this repository diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml index cd82951..e03918f 100644 --- a/.github/workflows/cargo-audit.yml +++ b/.github/workflows/cargo-audit.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Prevention workflow - audits Rust dependencies for vulnerabilities @@ -23,7 +24,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 - name: Install cargo-audit run: cargo install cargo-audit --locked @@ -46,7 +47,7 @@ jobs: permissions: issues: write steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 - name: Create vulnerability issue env: diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index 1f9c6a3..60ca00a 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: GitHub Pages @@ -23,22 +24,22 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 - name: Checkout casket-ssg - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/casket-ssg path: .casket-ssg - name: Setup GHCup - uses: haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d # v2.12.0 + uses: haskell-actions/setup@v2.12.0 with: ghc-version: '9.8.2' cabal-version: '3.10' - name: Cache Cabal - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6.1.0 with: path: | ~/.cabal/packages @@ -100,10 +101,10 @@ jobs: touch ../_site/.nojekyll - name: Setup Pages - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 + uses: actions/configure-pages@v6.0.0 - name: Upload artifact - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 + uses: actions/upload-pages-artifact@v5.0.0 with: path: '_site' @@ -117,4 +118,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 + uses: actions/deploy-pages@v5.0.1 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 3944780..ae66012 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: CodeQL Security Analysis @@ -43,15 +44,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 + uses: github/codeql-action/init@v4.38.0 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 + uses: github/codeql-action/analyze@v4.38.0 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/dashboard-check.yml b/.github/workflows/dashboard-check.yml index f55fc97..0a337ee 100644 --- a/.github/workflows/dashboard-check.yml +++ b/.github/workflows/dashboard-check.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) @@ -24,9 +25,9 @@ jobs: timeout-minutes: 15 steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 - - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + - uses: dtolnay/rust-toolchain@v1 with: toolchain: v1 diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 45c4d08..02082ae 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # @@ -57,7 +58,7 @@ jobs: steps: - name: Fetch Dependabot metadata id: meta - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 + uses: dependabot/fetch-metadata@v3.1.0 with: github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 0f58016..0c18d4f 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) @@ -28,7 +29,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 - name: Check for A2ML files id: detect @@ -41,7 +42,7 @@ jobs: - name: Validate A2ML manifests if: steps.detect.outputs.count > 0 - uses: hyperpolymath/a2ml-ecosystem/validate-action@ed83d6927e8fb21431e403dbf6d7a4af96772746 # main + uses: hyperpolymath/a2ml-ecosystem/validate-action@main with: path: '.' strict: 'false' @@ -73,7 +74,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 - name: Check for K9 files id: detect @@ -90,7 +91,7 @@ jobs: - name: Validate K9 contracts if: steps.detect.outputs.k9_count > 0 - uses: hyperpolymath/k9-ecosystem/validate-action@c1a34884054fabf0e9de81dbf68f4ba7874e85f1 # main + uses: hyperpolymath/k9-ecosystem/validate-action@main with: path: '.' strict: 'false' @@ -123,7 +124,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 - name: Scan for invisible characters id: lint @@ -188,7 +189,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 - name: Check for Groove manifest id: groove @@ -249,7 +250,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 - name: Generate dogfooding scorecard run: | diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 1f1dae9..2acf914 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # JanusKey E2E + P2P + Aspect + Bench + Panic-Attack CI @@ -17,11 +18,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + - uses: actions/checkout@v7.0.1 + - uses: dtolnay/rust-toolchain@v1 with: toolchain: v1 - - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + - uses: Swatinem/rust-cache@v2.9.2 - name: Build run: cargo build --release - name: Unit + P2P tests @@ -36,9 +37,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 - - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + - uses: actions/checkout@v7.0.1 + - uses: dtolnay/rust-toolchain@v1 + - uses: Swatinem/rust-cache@v2.9.2 - name: Run benchmarks run: cargo bench -- --output-format bencher 2>/dev/null || echo "Benchmarks completed" @@ -47,9 +48,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 - - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 + - uses: actions/checkout@v7.0.1 + - uses: dtolnay/rust-toolchain@v1 + - uses: Swatinem/rust-cache@v2.9.2 - name: Build release run: cargo build --release - name: Run E2E tests @@ -60,7 +61,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 - name: Run aspect tests run: bash tests/aspect/cross_cutting_test.sh @@ -69,7 +70,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 - name: Install Zig run: | wget -q https://ziglang.org/download/0.13.0/zig-linux-x86_64-0.13.0.tar.xz @@ -86,8 +87,8 @@ jobs: timeout-minutes: 15 if: github.event_name == 'push' steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + - uses: actions/checkout@v7.0.1 + - uses: dtolnay/rust-toolchain@v1 - name: Install panic-attack run: cargo install --git https://github.com/hyperpolymath/panic-attacker.git 2>/dev/null || echo "panic-attack unavailable" - name: Run assail scan diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 784d974..844828e 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # governance.yml — single wrapper calling the shared estate governance bundle diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 410fd2e..205a9b2 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml. diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 6d303cf..74669b7 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Instant Forge Sync - Triggers propagation to all forges on push/release @@ -22,7 +23,7 @@ jobs: # Without the secret this step fails on every push (gitbot-fleet#433). # Skipping is honest; a red tick on a misconfigured repo is not a signal. if: ${{ secrets.FARM_DISPATCH_TOKEN != '' }} - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 + uses: peter-evans/repository-dispatch@v4.0.1 with: token: ${{ secrets.FARM_DISPATCH_TOKEN }} repository: hyperpolymath/.git-private-farm diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml index 9886e92..814a192 100644 --- a/.github/workflows/label-triage.yml +++ b/.github/workflows/label-triage.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Label Triage diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index c80b676..83ab941 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Labels diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml index 3bedad7..af83b38 100644 --- a/.github/workflows/main-estate-audit.yml +++ b/.github/workflows/main-estate-audit.yml @@ -1,3 +1,5 @@ +# This workflow is managed by gh actions-lock. + name: Central Estate CI/CD Audit on: @@ -10,82 +12,82 @@ jobs: estate-audit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 - name: Required Files Gate - uses: hyperpolymath/cicd-suite/actions/required-files-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/required-files-check@main - name: Code Hygiene Gate - uses: hyperpolymath/cicd-suite/actions/code-hygiene-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/code-hygiene-check@main - name: Manifest Validation Gate - uses: hyperpolymath/cicd-suite/actions/manifest-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/manifest-check@main - name: Idris2 ABI Purity Gate - uses: hyperpolymath/cicd-suite/actions/idris2-abi-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/idris2-abi-check@main - name: Zig Hexadeca API Gate - uses: hyperpolymath/cicd-suite/actions/zig-hexadeca-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/zig-hexadeca-check@main - name: Contractile Validation Gate - uses: hyperpolymath/cicd-suite/actions/contractile-validation-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/contractile-validation-check@main - name: Recipes Set Validation Gate - uses: hyperpolymath/cicd-suite/actions/recipes-set-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/recipes-set-check@main - name: Affirmation Document Gate - uses: hyperpolymath/cicd-suite/actions/affirmation-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/affirmation-check@main - name: Academic Referencing Gate - uses: hyperpolymath/cicd-suite/actions/referencing-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/referencing-check@main - name: Semantic Audit Gate - uses: hyperpolymath/cicd-suite/actions/semantic-audit-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/semantic-audit-check@main - name: SPDX License Gate - uses: hyperpolymath/cicd-suite/actions/spdx-license-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/spdx-license-check@main - name: Proof Runner Gate - uses: hyperpolymath/cicd-suite/actions/proof-runner-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/proof-runner-check@main - name: PRAT Testing Gate - uses: hyperpolymath/cicd-suite/actions/prat-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/prat-check@main - name: Panic Attack & Pons Gate - uses: hyperpolymath/cicd-suite/actions/custom-tools-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/custom-tools-check@main - name: WWW & Well-Known Compliance Gate - uses: hyperpolymath/cicd-suite/actions/www-compliance-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/www-compliance-check@main - name: BoJ Cartridge Validation Gate - uses: hyperpolymath/cicd-suite/actions/boj-cartridge-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/boj-cartridge-check@main - name: Formatting Validation Gate - uses: hyperpolymath/cicd-suite/actions/formatting-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/formatting-check@main - name: Accreditations & Badges Gate - uses: hyperpolymath/cicd-suite/actions/badges-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/badges-check@main - name: Metrics Extraction Gate - uses: hyperpolymath/cicd-suite/actions/metrics-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/metrics-check@main - name: Linguist & Banned Languages Gate - uses: hyperpolymath/cicd-suite/actions/linguist-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/linguist-check@main - name: Test & Benchmarks Dashboard Gate - uses: hyperpolymath/cicd-suite/actions/tests-benches-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/tests-benches-check@main - name: Hosting & Site Status Gate - uses: hyperpolymath/cicd-suite/actions/hosting-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/hosting-check@main - name: Git-Sea Analytics Gate - uses: hyperpolymath/cicd-suite/actions/gitsea-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/gitsea-check@main - name: Trust & Humans Validation Gate - uses: hyperpolymath/cicd-suite/actions/trust-humans-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/trust-humans-check@main - name: Are We UnAPI Gate (Secret Scanning) - uses: hyperpolymath/cicd-suite/actions/secrets-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/secrets-check@main - name: Reasonably Good Token Validation Gate - uses: hyperpolymath/cicd-suite/actions/vaulted-tokens-check@180b419825d238f8b606584c970a81dfa7cb6f81 # main + uses: hyperpolymath/cicd-suite/actions/vaulted-tokens-check@main diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index d4ac835..e3965f1 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Mirror to Git Forges diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 5ea39f1..6a0d6ca 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: GitHub Pages (Ddraig SSG) @@ -21,9 +22,9 @@ jobs: image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff steps: - name: Checkout Site - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 - name: Checkout Ddraig SSG - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/ddraig-ssg path: .ddraig-ssg @@ -40,7 +41,7 @@ jobs: fi ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/} - name: Upload artifact - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 + uses: actions/upload-pages-artifact@v5.0.0 with: path: '_site' deploy: @@ -53,4 +54,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 + uses: actions/deploy-pages@v5.0.1 diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 36bdafc..b4f1073 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable @@ -17,7 +18,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Send push notification email - uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0 + uses: dawidd6/action-send-mail@v3.12.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 43408cd..b4ffd22 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Rust CI — thin wrapper calling the shared estate reusable in diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 6a6fa72..d70c000 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Scorecards supply-chain security diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 89a1438..5013d1a 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Secret Scanner diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index e4a13a0..5d9e3a5 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Semgrep SAST @@ -25,13 +26,13 @@ jobs: container: image: semgrep/semgrep steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 - name: Run Semgrep run: semgrep scan --sarif --output=semgrep.sarif --config=auto . - name: Upload SARIF - uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 + uses: github/codeql-action/upload-sarif@v4.38.0 with: sarif_file: semgrep.sarif if: always() diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index de14f29..57208d9 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Prevention workflow - validates all workflows have proper security config @@ -18,7 +19,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 - name: Check SPDX headers run: |