fix(ci): four red checks on main, one root cause — workflows drifted off actions.lock

.github/dependabot.yml

@@ -9,10 +9,34 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    # Why a hold lives here at all. `.github/workflows/actions.lock` is what the
+    # estate publishes into the organisation's "specific actions allowed" list, so
+    # a bump that lands WITHOUT a lock refresh moves the workflow onto a ref the
+    # org no longer matches - and GitHub then rejects the whole workflow at
+    # validation time: no jobs, no check run, no annotation. That killed E2E
+    # Validation, Static Analysis Gate and CodeQL Security Analysis here for 9
+    # days (see 87d5bc8). The durable guard is standards' own
+    # `.github/workflows/dependabot-lock-regen.yml`, which regenerates each open
+    # dependabot PR's lockfile. As of 2026-10-10 it sweeps nothing: its two
+    # "Mint an App installation token" steps are `if: vars.APP_ID != ''` and both
+    # are SKIPPED on run 37859881345, because the applier App (STD-R-3) is not
+    # configured - so the job warns and exits 0, by design, rather than pretending
+    # to have swept. Until that credential exists, a bump must be followed by a
+    # manual `gh actions-lock` commit, and refs that must not move are held here.
+    ignore:
+      # Second, independent reason for this one: v4.38.1+ fails workflow-startup
+      # validation estate-wide (hyperpolymath/phantom-metal-taste#71), and
+      # actions.lock resolves this repo's CodeQL to v4.38.0 (b96794f015df).
+      - dependency-name: "github/codeql-action"
     groups:
       actions:
         patterns:
           - "*"
+        # `ignore` alone does not suppress a grouped bump - measured on
+        # phantom-metal-taste#76, where the group rewrote the ref anyway.
+        # exclude-patterns is what actually keeps a held ref out of the group.
+        exclude-patterns:
+          - "github/codeql-action"
     open-pull-requests-limit: 2
 
   # Rust/Cargo
@@ -25,29 +49,16 @@ updates:
         update-types: ["version-update:semver-patch"]
     open-pull-requests-limit: 0
 
-  # Elixir/Mix
-  - package-ecosystem: "mix"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-
-  # Node.js/npm
+  # Node.js/npm - the tree has exactly one JS manifest, the tree-sitter grammar.
+  # This entry declared directory: "/", where no package.json exists, so it scanned
+  # a root with nothing to update while the real manifest went unwatched.
   - package-ecosystem: "npm"
-    directory: "/"
+    directory: "/tools/tree-sitter-twasm"
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 3
 
-  # Python/pip
-  - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-
-  # Nix flakes
-  - package-ecosystem: "nix"
-    directory: "/"
-    schedule:
-      interval: "weekly"
+# Removed 2026-10-10 as dead weight, measured with `git ls-files`: mix (no mix.exs),
+# pip (no pyproject/requirements/setup.py), nix (no flake.nix or shell.nix). An
+# ecosystem with no manifest cannot open a PR, it can only imply coverage. Each is
+# one block to re-add if the manifest ever lands.

.github/workflows/c5-regenerate.yml

@@ -51,7 +51,7 @@ jobs:
           path: affinescript
 
       - name: Install OCaml
-        uses: ocaml/setup-ocaml@v3.9.0
+        uses: ocaml/setup-ocaml@v3.8.0
         with:
           ocaml-compiler: '4.14.2'
 

.github/workflows/codeql.yml

@@ -40,12 +40,12 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.38.2
+        uses: github/codeql-action/init@v4.38.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.38.2
+        uses: github/codeql-action/analyze@v4.38.0
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/e2e.yml

@@ -53,7 +53,7 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v7.1.0
+        uses: actions/setup-node@v7.0.0
         with:
           node-version: '25'
 
@@ -158,7 +158,7 @@ jobs:
 
       # ---- Node (for smoke test within E2E script) ----
       - name: Set up Node.js
-        uses: actions/setup-node@v7.1.0
+        uses: actions/setup-node@v7.0.0
         with:
           node-version: '25'
 

.github/workflows/governance.yml

@@ -14,4 +14,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540

.github/workflows/hypatia-scan.yml

@@ -14,7 +14,11 @@ on:
 permissions:
   contents: read
   security-events: write
+  # standards#1035: hypatia-scan-reusable uploads SARIF (codeql-action/upload-sarif)
+  # and deposits a report artifact. The callee cannot escalate, and its job-level
+  # block replaces this map rather than merging with it - so the grant belongs here.
+  actions: read
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540

.github/workflows/mirror.yml

@@ -12,5 +12,5 @@ permissions:
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540
     secrets: inherit

.github/workflows/release.yml

@@ -1,4 +1,4 @@
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
@@ -77,7 +77,7 @@
           git cliff --output CHANGELOG.md
 
       - name: Upload updated CHANGELOG.md
-        uses: actions/upload-artifact@v7.0.2
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: changelog
           path: CHANGELOG.md

.github/workflows/scorecard.yml

@@ -12,8 +12,13 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540
     permissions:
       contents: read
       security-events: write
       id-token: write
+      # standards#1035: scorecard-reusable runs actions/upload-artifact in the same job
+      # (043fb46d, v7.0.1). This block REPLACES the workflow-level map, so actions:read
+      # has to be granted here or the upload step fails - and 3 of 7 estate callers of
+      # this reusable omit it.
+      actions: read

.github/workflows/secret-scanner.yml

@@ -21,5 +21,5 @@ jobs:
     # caller must grant at least that or the run startup-fails.
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540
     secrets: inherit

.github/workflows/static-analysis-gate.yml

@@ -1,4 +1,4 @@
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # Static Analysis Gate — Required by branch protection rules.
 # Runs panic-attack and hypatia, deposits findings for gitbot-fleet learning.
@@ -117,7 +117,7 @@
           echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload panic-attack findings
-        uses: actions/upload-artifact@v7.0.2
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: panic-attack-findings
           path: panic-attack-findings.json
@@ -251,7 +251,7 @@
           echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload hypatia findings
-        uses: actions/upload-artifact@v7.0.2
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: hypatia-findings
           path: hypatia-findings.json
@@ -341,7 +341,7 @@
           echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload bridge report
-        uses: actions/upload-artifact@v7.0.2
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: bridge-report
           path: bridge-report.json
@@ -365,19 +365,19 @@
 
     steps:
       - name: Download panic-attack findings
-        uses: actions/download-artifact@v8.0.2
+        uses: actions/download-artifact@v8.0.1
         with:
           name: panic-attack-findings
           path: findings/
 
       - name: Download hypatia findings
-        uses: actions/download-artifact@v8.0.2
+        uses: actions/download-artifact@v8.0.1
         with:
           name: hypatia-findings
           path: findings/
 
       - name: Download bridge report
-        uses: actions/download-artifact@v8.0.2
+        uses: actions/download-artifact@v8.0.1
         with:
           name: bridge-report
           path: findings/
@@ -439,7 +439,7 @@
           echo "low=$LOW"           >> "$GITHUB_OUTPUT"
 
       - name: Upload unified findings (fleet scanner picks these up)
-        uses: actions/upload-artifact@v7.0.2
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: unified-findings
           path: findings/unified-findings.json