From 1648ce76c94d4e44f1f1dc520570887089206ff8 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 16:59:28 +0000 Subject: [PATCH 1/4] ci(rust-ci): re-pin rust-ci-reusable past the toolchain-input breakage rust-ci.yml called hyperpolymath/standards rust-ci-reusable at d135b05b. That version runs dtolnay/rust-toolchain by commit SHA without a `toolchain:` input; a SHA ref carries no version, so every run fails in the action's "parse toolchain version" step with "'toolchain' is a required input". d135b05b is the only standards pin in the estate without the fix (landed 2026-06-27). Re-pin to standards@95de3dfc, whose reusable passes `toolchain: stable`, and bring actions.lock's rust-ci.yml entry in line with it: - the workflow entry names hyperpolymath/standards@95de3dfc instead of [] (check-lock-sync flagged the job-level ref as missing); - add the hyperpolymath/standards@95de3dfc dependency record and the records for the four actions the reusable uses at that commit, copied verbatim from standards' own actions.lock at 95de3dfc. No existing lock record is changed or removed. standards' check-lock-sync.sh: rust-ci.yml leaves the failure list; nothing is added to it. Same fix as hyperpolymath/plasma-parser-writer#107, whose Rust CI is now green on main with this pin. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_0132Cdz3iwk2QGKv2sUhhsye --- .github/workflows/actions.lock | 33 ++++++++++++++++++++++++++++++++- .github/workflows/rust-ci.yml | 2 +- 2 files changed, 33 insertions(+), 2 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 195ba7f..4061e95 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -36,7 +36,8 @@ workflows: - 'softprops/action-gh-release@v3.0.3' '.github/workflows/rhodibot.yml': - 'actions/checkout@v7.0.1' - '.github/workflows/rust-ci.yml': [] + '.github/workflows/rust-ci.yml': + - 'hyperpolymath/standards@95de3dfc3fcf09a1cf3325ab42723e3d81682b45' '.github/workflows/scorecard.yml': [] '.github/workflows/secret-scanner.yml': [] '.github/workflows/static-analysis-gate.yml': @@ -50,6 +51,11 @@ dependencies: commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' owner_id: 44036562 repo_id: 215566462 + 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': + ref: '3d3c42e5aac5ba805825da76410c181273ba90b1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 'actions/checkout@v7.0.1': ref: 'v7.0.1' commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' @@ -87,6 +93,11 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f': + ref: 'v1' + commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + owner_id: 1940490 + repo_id: 260749683 'erlef/setup-beam@v1.24.1': ref: 'v1.24.1' commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' @@ -97,6 +108,11 @@ dependencies: commit: 'sha1-24c54180a607b1449ed407dd24f251e4e9147c8d' owner_id: 9919 repo_id: 259445878 + 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406': + ref: 'abea47f85e598557f500fa1fd2ab7464fcb39406' + commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406' + owner_id: 1006268 + repo_id: 212984112 'haskell-actions/setup@v2.12.0': ref: 'v2.12.0' commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' @@ -107,6 +123,16 @@ dependencies: commit: 'sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be' owner_id: 6759885 repo_id: 1352485172 + 'hyperpolymath/standards@95de3dfc3fcf09a1cf3325ab42723e3d81682b45': + ref: '95de3dfc3fcf09a1cf3325ab42723e3d81682b45' + commit: 'sha1-95de3dfc3fcf09a1cf3325ab42723e3d81682b45' + owner_id: 6759885 + repo_id: 1116521501 + uses: + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406' + - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' 'peter-evans/repository-dispatch@v4.0.1': ref: 'v4.0.1' commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697' @@ -117,3 +143,8 @@ dependencies: commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64' owner_id: 2242 repo_id: 204253808 + 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6': + ref: '6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + owner_id: 580492 + repo_id: 298565987 diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 435a2a2..d34c02e 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -15,4 +15,4 @@ permissions: jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@95de3dfc3fcf09a1cf3325ab42723e3d81682b45 From a2eb7da131388a4e86572025532d0bc2913bb33c Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 17:06:42 +0000 Subject: [PATCH 2/4] fix(actions.lock): record real tags as ref for the SHA-keyed reusable actions Experiment on the rust-ci re-pin: GitHub refused the previous lock with 'invalid lockfile pin' for actions/checkout@3d3c42e5. The records copied from standards named the SHA itself as ref; this repo's own SHA-keyed record uses a tag. Use the tag each commit is released as. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_0132Cdz3iwk2QGKv2sUhhsye --- .github/workflows/actions.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 4061e95..a617ddc 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -52,7 +52,7 @@ dependencies: owner_id: 44036562 repo_id: 215566462 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': - ref: '3d3c42e5aac5ba805825da76410c181273ba90b1' + ref: 'v7.0.1' commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' owner_id: 44036562 repo_id: 197814629 @@ -109,7 +109,7 @@ dependencies: owner_id: 9919 repo_id: 259445878 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406': - ref: 'abea47f85e598557f500fa1fd2ab7464fcb39406' + ref: 'v2.2.1' commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406' owner_id: 1006268 repo_id: 212984112 @@ -144,7 +144,7 @@ dependencies: owner_id: 2242 repo_id: 204253808 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6': - ref: '6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + ref: 'v2.9.2' commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' owner_id: 580492 repo_id: 298565987 From 272c67a6fcaa702e872ec976938a8c86b15b1f2c Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 17:07:59 +0000 Subject: [PATCH 3/4] fix(actions.lock): leave the lock untouched for the rust-ci re-pin Job-level reusable calls here (mirror, governance, secret-scanner, ...) have empty entries and no standards records, and they start fine. Adding a non-empty hyperpolymath/standards@95de3dfc entry made GitHub validate the call against the lock, and it rejected it for actions/checkout@3d3c42e5 with 'invalid lockfile pin'. Restore actions.lock to main so the PR only moves the pin, like the other reusable calls. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_0132Cdz3iwk2QGKv2sUhhsye --- .github/workflows/actions.lock | 33 +-------------------------------- 1 file changed, 1 insertion(+), 32 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index a617ddc..195ba7f 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -36,8 +36,7 @@ workflows: - 'softprops/action-gh-release@v3.0.3' '.github/workflows/rhodibot.yml': - 'actions/checkout@v7.0.1' - '.github/workflows/rust-ci.yml': - - 'hyperpolymath/standards@95de3dfc3fcf09a1cf3325ab42723e3d81682b45' + '.github/workflows/rust-ci.yml': [] '.github/workflows/scorecard.yml': [] '.github/workflows/secret-scanner.yml': [] '.github/workflows/static-analysis-gate.yml': @@ -51,11 +50,6 @@ dependencies: commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' owner_id: 44036562 repo_id: 215566462 - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': - ref: 'v7.0.1' - commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' - owner_id: 44036562 - repo_id: 197814629 'actions/checkout@v7.0.1': ref: 'v7.0.1' commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' @@ -93,11 +87,6 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f': - ref: 'v1' - commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f' - owner_id: 1940490 - repo_id: 260749683 'erlef/setup-beam@v1.24.1': ref: 'v1.24.1' commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' @@ -108,11 +97,6 @@ dependencies: commit: 'sha1-24c54180a607b1449ed407dd24f251e4e9147c8d' owner_id: 9919 repo_id: 259445878 - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406': - ref: 'v2.2.1' - commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406' - owner_id: 1006268 - repo_id: 212984112 'haskell-actions/setup@v2.12.0': ref: 'v2.12.0' commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' @@ -123,16 +107,6 @@ dependencies: commit: 'sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be' owner_id: 6759885 repo_id: 1352485172 - 'hyperpolymath/standards@95de3dfc3fcf09a1cf3325ab42723e3d81682b45': - ref: '95de3dfc3fcf09a1cf3325ab42723e3d81682b45' - commit: 'sha1-95de3dfc3fcf09a1cf3325ab42723e3d81682b45' - owner_id: 6759885 - repo_id: 1116521501 - uses: - - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f' - - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406' - - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' 'peter-evans/repository-dispatch@v4.0.1': ref: 'v4.0.1' commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697' @@ -143,8 +117,3 @@ dependencies: commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64' owner_id: 2242 repo_id: 204253808 - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6': - ref: 'v2.9.2' - commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' - owner_id: 580492 - repo_id: 298565987 From 77414b84e5fb962fc1bbcd1bcbc8fc8229bd5220 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 17:19:47 +0000 Subject: [PATCH 4/4] ci(rust-ci): pin rust-ci-reusable to 81dbf2dd, the pin this repo's other reusables use 95de3dfc's reusable uses actions/checkout@3d3c42e5, the commit this repo's lock already pins as checkout@v7.0.1, and GitHub rejects it with 'invalid lockfile pin' (the job fails before any step runs). Every other reusable called here uses checkout@9c091bb2 and starts normally. 81dbf2dd has the toolchain fix, uses that same checkout ref, and is already the pin of this repo's governance and hypatia-scan callers. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_0132Cdz3iwk2QGKv2sUhhsye --- .github/workflows/rust-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index d34c02e..cca21f6 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -15,4 +15,4 @@ permissions: jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@95de3dfc3fcf09a1cf3325ab42723e3d81682b45 + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9