From a036336b6a7bc1611ec3bd3eaa7048f12ca4246f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 14 Oct 2026 09:38:17 +0000
Subject: [PATCH] ci(scratch): one-off actions.lock regeneration for main (not
 for merge)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
---
 .github/workflows/zz-one-off-lock-regen.yml | 46 +++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 .github/workflows/zz-one-off-lock-regen.yml

diff --git a/.github/workflows/zz-one-off-lock-regen.yml b/.github/workflows/zz-one-off-lock-regen.yml
new file mode 100644
index 0000000..8f4e248
--- /dev/null
+++ b/.github/workflows/zz-one-off-lock-regen.yml
@@ -0,0 +1,46 @@
+# SPDX-License-Identifier: MPL-2.0
+# ONE-OFF, scratch branch only, deleted after use. Regenerates main's
+# actions.lock with the estate repair order (regen_lock in
+# standards/scripts/regen-dependabot-locks.sh), runs the governance gate's own
+# check against the result, and prints the lock base64-encoded. It has no
+# `uses:` steps, so it needs no lock entry to start. It writes nothing back:
+# the lock reaches the repository in a reviewed PR.
+name: one-off actions.lock regeneration
+on:
+  push:
+    branches: [claude/new-session-th4e9w-lockregen]
+permissions:
+  contents: read
+jobs:
+  regen:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REPO: ${{ github.repository }}
+      STANDARDS_REGEN_SHA: ae36881b5ff4b469fb904b66542ac226a15107f3
+      STANDARDS_GATE_SHA: 8f2ee50841e216cd8c192eeb68953118190f105c
+    steps:
+      - name: Regenerate main's actions.lock and check it with the gate
+        run: |
+          set -uo pipefail
+          git clone --quiet --branch main "https://github.com/$REPO.git" pb
+          git -C pb log --oneline -1
+          git clone --quiet https://github.com/hyperpolymath/standards.git std
+          git -C std worktree add --quiet --detach ../std-regen "$STANDARDS_REGEN_SHA"
+          git -C std worktree add --quiet --detach ../std-gate "$STANDARDS_GATE_SHA"
+          sudo apt-get install -y -qq gawk >/dev/null
+          gh extension install github/gh-actions-lock --pin v0.2.0
+          gh actions-lock --version
+          export GH_BIN=gh REGEN_TOOLS="$PWD/std-regen/scripts"
+          source std-regen/scripts/regen-dependabot-locks.sh
+          outcome="$(regen_lock "$PWD/pb")"
+          echo "OUTCOME=$outcome"
+          git -C pb status --porcelain
+          echo "== the governance gate, as pinned by proof-burrower ($STANDARDS_GATE_SHA)"
+          (cd pb && ACTIONS_LOCK_VERIFIER="$PWD/../std-gate/scripts/update-actions-lock.sh" \
+            bash ../std-gate/scripts/check-actions-lock-gate.sh .github/workflows); echo "GATE_RC=$?"
+          echo "LOCK-SHA256 $(sha256sum < pb/.github/workflows/actions.lock | cut -d' ' -f1)"
+          echo "LOCK-BEGIN"
+          base64 -w0 pb/.github/workflows/actions.lock; echo
+          echo "LOCK-END"