chore(ci): generate actions.lock ahead of the 2026-10-01 lock gate by hyperpolymath · Pull Request #101 · hyperpolymath/project-wharf

hyperpolymath · 2026-09-30T16:32:12Z

Summary

Adds .github/workflows/actions.lock. It was generated by gh actions-lock --no-narrow v0.1.6 from the refs already SHA-pinned here, so no uses: line changes.
Moves the tool's banner to line 2 in each workflow, keeping SPDX on line 1.

Why

From 2026-10-01 the governance "Actions lockfile verify" gate fails any repo that lacks a lockfile. Changing the date on standards main would not help, because this repo pins the reusable workflow by SHA.

Verification

The gate script at the pinned standards SHA passes with LOCK_TODAY=2026-10-01.
This PR's own runs are the runtime test. Every workflow must create jobs, with no startup_failure.

🤖 Generated with Claude Code

https://claude.ai/code/session_019aa9y32JcBuZ85KXe2jb8R

The governance "Actions lockfile verify" gate requires .github/workflows/actions.lock from 2026-10-01. Every ref here is already SHA-pinned; `gh actions-lock --no-narrow` (v0.1.6) records those same SHAs and their transitive composite deps, with no ref rewritten. The tool's "managed by gh actions-lock" banner is placed on line 2 so SPDX stays on line 1. Verified locally: the gate script at the pinned standards SHA passes with LOCK_TODAY=2026-10-01. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019aa9y32JcBuZ85KXe2jb8R

coderabbitai · 2026-09-30T16:32:21Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ec0ec865-5ed2-4d0f-976d-df78dc36c3bc

📥 Commits

Reviewing files that changed from the base of the PR and between f359b53 and 08e9fae.

⛔ Files ignored due to path filters (1)

.github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (13)

.github/workflows/cargo-audit.yml
.github/workflows/codeql.yml
.github/workflows/generator-generic-ossf-slsa3-publish.yml
.github/workflows/governance.yml
.github/workflows/hypatia-scan.yml
.github/workflows/label-triage.yml
.github/workflows/labels.yml
.github/workflows/pages.yml
.github/workflows/php.yml
.github/workflows/push-email-notify.yml
.github/workflows/rust.yml
.github/workflows/secret-scanner.yml
.github/workflows/workflow-linter.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (23)

GitHub Check: scan / rust-secrets
GitHub Check: governance / Trusted-base reduction policy
GitHub Check: governance / Check Workflow Staleness
GitHub Check: governance / Live Actions policy (credentialed advisory)
GitHub Check: governance / Exemption ratchet
GitHub Check: governance / Allowlist Preflight
GitHub Check: governance / Language / package anti-pattern policy
GitHub Check: governance / Licence consistency
GitHub Check: governance / Actions lockfile verify
GitHub Check: governance / Guix packaging policy (Nix retired)
GitHub Check: governance / Code quality + docs
GitHub Check: governance / Workflow security linter
GitHub Check: governance / Security policy checks
GitHub Check: governance / Well-Known (RFC 9116 + RSR)
GitHub Check: governance / Debt ratchet
GitHub Check: scan / gitleaks
GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
GitHub Check: scan / shell-secrets
GitHub Check: build
GitHub Check: lint-workflows
GitHub Check: Analyze (actions)
GitHub Check: build
GitHub Check: semgrep-cloud-platform/scan

🔇 Additional comments (13)

.github/workflows/cargo-audit.yml (1)

2-2: LGTM!

.github/workflows/codeql.yml (1)

2-2: LGTM!

.github/workflows/generator-generic-ossf-slsa3-publish.yml (1)

2-2: LGTM!

.github/workflows/governance.yml (1)

2-2: LGTM!

.github/workflows/hypatia-scan.yml (1)

2-2: LGTM!

.github/workflows/label-triage.yml (1)

2-2: LGTM!

.github/workflows/labels.yml (1)

2-2: LGTM!

.github/workflows/pages.yml (1)

2-2: LGTM!

.github/workflows/php.yml (1)

2-2: LGTM!

.github/workflows/push-email-notify.yml (1)

2-2: LGTM!

.github/workflows/rust.yml (1)

2-2: LGTM!

.github/workflows/secret-scanner.yml (1)

2-2: LGTM!

.github/workflows/workflow-linter.yml (1)

2-2: LGTM!

📝 Summary

Summary by CodeRabbit

Documentation
- Added notes clarifying that automated checks and publishing workflows are managed by a workflow-locking tool. No workflow behaviour changed.

Walkthrough

Thirteen GitHub Actions workflow files gain comments that identify them as managed by gh actions-lock. Workflow behaviour does not change.

Changes

Workflow ownership comments

Layer / File(s)	Summary
Add workflow ownership markers `.github/workflows/*.yml`	Thirteen workflow files gain comments identifying them as managed by `gh actions-lock`. No workflow behaviour changes.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: metadatastician

Merge Risk: ⚪ Minimal · up to 08e9f

This change adds workflow ownership comments and an action lock; no workflow behavior change or concrete merge risk was established. The external reusable-workflow locking requirement remains unverified.

Architecture Summary

Architecture risk: 🔵 Low · up to 08e9f

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

observed — Modified behavior in .github/workflows/cargo-audit.yml: Added a comment declaring that the workflow is managed by gh actions-lock.
observed — Modified behavior in .github/workflows/codeql.yml: Added a comment stating that this workflow is managed by gh actions-lock.
observed — Modified behavior in .github/workflows/generator-generic-ossf-slsa3-publish.yml: Adds a comment identifying the workflow as managed by gh actions-lock.
observed — Modified behavior in .github/workflows/governance.yml: Adds a comment identifying governance.yml as managed by gh actions-lock.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the main change: generating actions.lock before the 1 October 2026 lock gate.
Description check	✅ Passed	The description directly explains the actions.lock addition, workflow banner changes, reason, and verification details.

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks each workflow line,
And finds a note, neat and fine.
“Managed by actions-lock,” they say,
No steps have changed along the way.
Then hops off, pleased with comments in place.}

_{Comment @coderabbitai help to get the list of available commands.}

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Commit to this branch
Create a new PR

hyperpolymath mentioned this pull request Oct 1, 2026

Estate: needs me metadatastician/standards#1109

Open

Merge branch 'main' into chore/actions-lock-generate

08e9fae

coderabbitai Bot approved these changes Oct 1, 2026

View reviewed changes

hyperpolymath merged commit bef2ec1 into main Oct 1, 2026
26 of 30 checks passed

hyperpolymath deleted the chore/actions-lock-generate branch October 1, 2026 20:54

Navigation Menu

Repository navigation

chore(ci): generate actions.lock ahead of the 2026-10-01 lock gate - #101

chore(ci): generate actions.lock ahead of the 2026-10-01 lock gate#101
hyperpolymath merged 2 commits into
mainfrom
chore/actions-lock-generate

hyperpolymath commented Sep 30, 2026

Uh oh!

coderabbitai Bot commented Sep 30, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

hyperpolymath commented Sep 30, 2026

Summary

Why

Verification

Uh oh!

coderabbitai Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Architecture Summary

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Sep 30, 2026 •

edited

Loading