From 80b5628b556e494460de946a577fd0ce51a100f5 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 7 Oct 2026 00:16:15 +0100 Subject: [PATCH 1/2] ci: resync actions.lock with Dependabot's actions-group bump (#1) Dependabot #1 bumped haskell-actions/setup v2.12.0 -> v2.12.1 (pages.yml) and SonarSource/sonarqube-scan-action v8.2.2 -> v8.3.0 (sonarqube.yml) without touching actions.lock, so the lock-sync gate went red on main. Swap the two workflow entries and their dependencies: records in place. No other record changes; every other pin is untouched. haskell-actions/setup@v2.12.1 -> 0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d sonarsource/sonarqube-scan-action@v8.3.0 -> d209202bc7d53ff1cc128f7f907dac145c9d6ae9 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm --- .github/workflows/actions.lock | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index e95a18b..c7f62da 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -56,7 +56,7 @@ workflows: - 'actions/configure-pages@v6.0.0' - 'actions/deploy-pages@v5.0.1' - 'actions/upload-pages-artifact@v5.0.0' - - 'haskell-actions/setup@v2.12.0' + - 'haskell-actions/setup@v2.12.1' '.github/workflows/push-email-notify.yml': - 'hyperpolymath/smtp-notify-action@v0.3.0' '.github/workflows/quality.yml': @@ -81,7 +81,7 @@ workflows: - 'actions/checkout@v7.0.1' '.github/workflows/sonarqube.yml': - 'actions/checkout@v7.0.1' - - 'sonarsource/sonarqube-scan-action@v8.2.2' + - 'sonarsource/sonarqube-scan-action@v8.3.0' '.github/workflows/static-analysis-gate.yml': - 'actions/checkout@v7.0.1' - 'actions/download-artifact@v8.0.1' @@ -210,9 +210,9 @@ dependencies: commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406' owner_id: 1006268 repo_id: 212984112 - 'haskell-actions/setup@v2.12.0': - ref: 'v2.12.0' - commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' + 'haskell-actions/setup@v2.12.1': + ref: 'v2.12.1' + commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d' owner_id: 75048950 repo_id: 623796603 'hyperpolymath/cicd-suite@0da816c05ae7486671d863e07935f93981c0c2d5': @@ -280,9 +280,9 @@ dependencies: commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64' owner_id: 2242 repo_id: 204253808 - 'sonarsource/sonarqube-scan-action@v8.2.2': - ref: 'v8.2.2' - commit: 'sha1-ba9859eae8dd6bd29e412f25ddbbef3d032000f4' + 'sonarsource/sonarqube-scan-action@v8.3.0': + ref: 'v8.3.0' + commit: 'sha1-d209202bc7d53ff1cc128f7f907dac145c9d6ae9' owner_id: 545988 repo_id: 366408409 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555': From 00001f0adc209bff15de2fc95229dccf5996a98b Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 7 Oct 2026 08:41:37 +0100 Subject: [PATCH 2/2] ci: repin standards callers to da2c748 and drop unclosed @main lock record secret-scanner (gitleaks), rust-ci and governance have died at startup (STARTUP_FAILURE, jobs=0, no check run) on every commit since this repo was created. Their callers pinned hyperpolymath/standards@main, whose actions.lock record carried no uses: closure, while the closed record for the template's pin (standards@da2c748) sat orphaned in the lock. Repin all six standards callers (secret-scanner, rust-ci, governance, hypatia-scan, scorecard, mirror) to da2c748, matching rsr-template-repo, where the same callers run green, and remove the dangling @main record. Verified: gh actions-lock --no-fix rc=0; scripts/check-lock-sync.sh reports in sync and transitively closed. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_015bTuGfwCcvjrmNFejydTML --- .github/workflows/actions.lock | 17 ++++++----------- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 7 files changed, 12 insertions(+), 17 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index c7f62da..026ce2a 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -31,13 +31,13 @@ workflows: '.github/workflows/estate-rules.yml': - 'actions/checkout@v7.0.1' '.github/workflows/governance.yml': - - 'hyperpolymath/standards@main' + - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540' '.github/workflows/groove-check.yml': - 'actions/checkout@v7.0.1' '.github/workflows/guix-policy.yml': - 'actions/checkout@v7.0.1' '.github/workflows/hypatia-scan.yml': - - 'hyperpolymath/standards@main' + - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540' '.github/workflows/k9-validate.yml': - 'actions/checkout@v7.0.1' - 'hyperpolymath/k9-ecosystem@main' @@ -47,7 +47,7 @@ workflows: '.github/workflows/main-estate-audit.yml': - 'hyperpolymath/cicd-suite@55556cf5ba71ba744695861503c13148d3915a5d' '.github/workflows/mirror.yml': - - 'hyperpolymath/standards@main' + - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540' '.github/workflows/ossf-best-practices.yml': - 'actions/checkout@v7.0.1' '.github/workflows/pages.yml': @@ -72,11 +72,11 @@ workflows: '.github/workflows/runtime-policy.yml': - 'actions/checkout@v7.0.1' '.github/workflows/rust-ci.yml': - - 'hyperpolymath/standards@main' + - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540' '.github/workflows/scorecard.yml': - - 'hyperpolymath/standards@main' + - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540' '.github/workflows/secret-scanner.yml': - - 'hyperpolymath/standards@main' + - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540' '.github/workflows/security-policy.yml': - 'actions/checkout@v7.0.1' '.github/workflows/sonarqube.yml': @@ -260,11 +260,6 @@ dependencies: - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' - 'Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' - 'hyperpolymath/standards@main': - ref: 'main' - commit: 'sha1-d556b3db6c85718b971969b3d40da1b071aa4b2d' - owner_id: 6759885 - repo_id: 1116521501 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': ref: '2d1146689b8cda280b9bc96326124645441f03bc' commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index a80411a..73366ea 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -18,4 +18,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index a53b10e..997e008 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -27,4 +27,4 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 9014b30..35c5683 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -13,7 +13,7 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 # Explicit secrets map — no `secrets: inherit` (Hypatia WH008, alert #131). # All seven are the callee's complete optional contract (standards # mirror-reusable.yml@da2c748); behaviour is unchanged, future secrets diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index aed4b1f..05369dd 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -16,4 +16,4 @@ permissions: contents: read jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 1112288..f2ce703 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -16,7 +16,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 # Reusable called-workflow permissions are CAPPED by the caller's grants; # without security-events: write here the scorecard SARIF upload fails with # startup_failure (hypatia WF018). id-token: write enables OIDC publish. diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index b48f572..9a7b136 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -26,4 +26,4 @@ jobs: # is therefore the cap GitHub applies to the called workflow. permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540