Repository navigation
ci(scratch): list the scratch workflow in actions.lock so GitHub star… #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| # ONE-OFF, scratch branch only, deleted after use. Re-run 3: after the revert at 09a5857, Actions running again. Regenerates the fix branch's | |
| # actions.lock with the estate repair order (regen_lock in | |
| # standards/scripts/regen-dependabot-locks.sh), runs the governance gate's own | |
| # check against the result, and prints the lock base64-encoded. It has no | |
| # `uses:` steps, so it needs no lock entry to start. It writes nothing back: | |
| # the lock reaches the repository in a reviewed PR. | |
| name: one-off actions.lock regeneration | |
| on: | |
| push: | |
| branches: [claude/new-session-th4e9w-lockregen] | |
| permissions: | |
| contents: read | |
| jobs: | |
| regen: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.repository }} | |
| STANDARDS_REGEN_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7 | |
| STANDARDS_GATE_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7 | |
| steps: | |
| - name: Regenerate the repair branch's actions.lock and check it with the gate | |
| run: | | |
| set -uo pipefail | |
| git clone --quiet --branch claude/new-session-th4e9w "https://github.com/$REPO.git" pb | |
| git -C pb log --oneline -1 | |
| git clone --quiet https://github.com/hyperpolymath/standards.git std | |
| git -C std worktree add --quiet --detach ../std-regen "$STANDARDS_REGEN_SHA" | |
| git -C std worktree add --quiet --detach ../std-gate "$STANDARDS_GATE_SHA" | |
| sudo apt-get install -y -qq gawk >/dev/null | |
| gh extension install github/gh-actions-lock --pin v0.2.0 | |
| gh actions-lock --version | |
| # The repair chain without a gh actions-lock fix-mode pass (it drops | |
| # records it cannot re-resolve). | |
| export GH_BIN=gh | |
| for s in relock-sha-keys complete-job-refs close-lock prune-stale check-lock-sync; do | |
| (cd pb && { bash ../std-regen/scripts/$s.sh .github/workflows && echo "$s RC=0" || echo "$s RC=$?"; }) | |
| done | |
| git -C pb status --porcelain | |
| echo "== the governance gate, as pinned by the repair branch ($STANDARDS_GATE_SHA)" | |
| (cd pb && ACTIONS_LOCK_VERIFIER="$PWD/../std-gate/scripts/update-actions-lock.sh" \ | |
| bash ../std-gate/scripts/check-actions-lock-gate.sh .github/workflows); echo "GATE_RC=$?" | |
| echo "LOCK-SHA256 $(sha256sum < pb/.github/workflows/actions.lock | cut -d' ' -f1)" | |
| echo "DIFF-BEGIN" | |
| git -C pb diff -- .github/workflows/actions.lock | |
| echo "DIFF-END" |