Skip to content

fix(ci): prune stale entries from actions.lock with gh-actions-lock v0.2.0 #495

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 4 commits into from
Nov 10, 2026
+7 −149
Merged

fix(ci): prune stale entries from actions.lock with gh-actions-lock v0.2.0 #495

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
dcecea1
fix(ci): prune stale entries from actions.lock with gh-actions-lock v…
claude Nov 10, 2026
193597f
Merge remote-tracking branch 'origin/main' into claude/relock-after-491
claude Nov 10, 2026
15b21c0
Merge main into relock-after-491; re-prune actions.lock
claude Nov 10, 2026
392aafb
Merge branch 'main' into claude/relock-after-491
hyperpolymath Nov 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
156 changes: 7 additions & 149 deletions .github/workflows/actions.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,14 +38,11 @@ workflows:
- 'swatinem/rust-cache@v2.9.3'
'.github/workflows/generator-generic-ossf-slsa3-publish.yml':
- 'actions/checkout@v7.0.1'
- 'slsa-framework/slsa-github-generator@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
'.github/workflows/ghcr-publish.yml':
- 'actions/attest-build-provenance@v4.2.2'
- 'actions/checkout@v7.0.1'
'.github/workflows/governance.yml':
- 'metadatastician/standards@a797d308c0517d4e2d21cc7f1cb08d41f82b1a12'
'.github/workflows/hypatia-scan.yml':
- 'metadatastician/standards@d3e4b485a2af90c92a8e18af0888cd19cb132cd9'
'.github/workflows/governance.yml': []

@chatgpt-codex-connector chatgpt-codex-connector Bot Nov 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Preserve reusable-workflow edges in the lock

When governance / Validate Hypatia Baseline scans this tree, .github/workflows/governance.yml still has a job-level uses: metadatastician/standards..., but this row now declares no dependency and the corresponding top-level record is also deleted. The repository's canonical lock chain intentionally completes these job-level refs transitively; without them Hypatia reports invalid_actions_lock/workflow_dependencies_missing, so the required governance check remains red even though raw gh-actions-lock --verify-local passes. Regenerate with the canonical wrapper or restore all eight reusable-workflow edges rather than pruning them.

Useful? React with 👍 / 👎.

@hyperpolymath hyperpolymath Nov 10, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After the merge, main at 03f03fb does not show this. The governance and Hypatia checks pass there.

Main has 5 failures: 4 mirror / * jobs and scan / scan. The same 5 failed on the previous two main commits, cc5f566 and 453fe3b, before this PR. scan / scan gets past job start and builds the scanner. It then fails on verisimdb-data dispatch failed with HTTP 401, which is a credential problem, not a lockfile problem. So the reusable-workflow callers still start without the pruned entries.

Generated by Claude Code

'.github/workflows/hypatia-scan.yml': []
'.github/workflows/idris2-abi-ci.yml':
- 'actions/checkout@v7.0.1'
'.github/workflows/label-triage.yml': []
Expand All @@ -54,8 +51,7 @@ workflows:
- 'actions/checkout@v7.0.1'
- 'dtolnay/rust-toolchain@v1'
- 'swatinem/rust-cache@v2.9.3'
'.github/workflows/mirror.yml':
- 'metadatastician/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0'
'.github/workflows/mirror.yml': []
'.github/workflows/mvp-smoke.yml':
- 'actions/checkout@v7.0.1'
- 'dtolnay/rust-toolchain@v1'
Expand All @@ -77,18 +73,14 @@ workflows:
- 'dtolnay/rust-toolchain@v1'
- 'swatinem/rust-cache@v2.9.3'
- 'taiki-e/install-action@v2.87.32'
'.github/workflows/scorecard.yml':
- 'metadatastician/standards@d3e4b485a2af90c92a8e18af0888cd19cb132cd9'
'.github/workflows/secret-scanner.yml':
- 'hyperpolymath/proven-cicd@a12b2b4644db1a1250bc50b58fd24c99f89f564e'
'.github/workflows/security-scan.yml':
- 'hyperpolymath/panic-attack@55ffcc9a240e937edd968487af15ab45c6f0522f'
'.github/workflows/scorecard.yml': []
'.github/workflows/secret-scanner.yml': []
'.github/workflows/security-scan.yml': []
'.github/workflows/server-boot-gate.yml':
- 'actions/checkout@v7.0.1'
- 'dtolnay/rust-toolchain@v1'
- 'swatinem/rust-cache@v2.9.3'
'.github/workflows/spark-theatre-gate.yml':
- 'metadatastician/standards@d3e4b485a2af90c92a8e18af0888cd19cb132cd9'
'.github/workflows/spark-theatre-gate.yml': []
'.github/workflows/static-analysis-gate.yml':
- 'actions/checkout@v7.0.1'
- 'actions/download-artifact@v8.0.2'
Expand All @@ -103,11 +95,6 @@ workflows:
- 'hyperpolymath/proven-cicd-and-workflows@4c772eb235b04455307d5c03cbbc4f45130f7f0f'
- 'mlugg/setup-zig@v2.2.1'
dependencies:
'Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0':
ref: 'v2.9.3'
commit: 'sha1-d1527c8f67ef9af357290475d4af4b0fab8f12e0'
owner_id: 580492
repo_id: 298565987
'actions/attest-build-provenance@v4.2.2':
ref: 'v4.2.2'
commit: 'sha1-4d101475d8b20a2381f78447822ac1eab6504dd8'
Expand All @@ -120,11 +107,6 @@ dependencies:
commit: 'sha1-508db95dd578ae2727ebd6217d5ba78e4fbda05d'
owner_id: 44036562
repo_id: 760701061
'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
ref: 'v6.1.0'
commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
owner_id: 44036562
repo_id: 215566462
'actions/cache@v6.1.0':
ref: 'v6.1.0'
commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
Expand All @@ -145,31 +127,16 @@ dependencies:
commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
owner_id: 44036562
repo_id: 438112499
'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333':
ref: 'v8.0.2'
commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
owner_id: 44036562
repo_id: 192626254
'actions/download-artifact@v8.0.2':
ref: 'v8.0.2'
commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
owner_id: 44036562
repo_id: 192626254
'actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08':
ref: 'v4.6.0'
commit: 'sha1-65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08'
owner_id: 44036562
repo_id: 192625955
'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
ref: 'v7.0.0'
commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
owner_id: 44036562
repo_id: 192625955
'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9':
ref: 'v7.0.2'
commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
owner_id: 44036562
repo_id: 192625955
'actions/upload-artifact@v7.0.2':
ref: 'v7.0.2'
commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
Expand All @@ -182,41 +149,16 @@ dependencies:
repo_id: 496012378
uses:
- 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
ref: 'v2.0.5'
commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
owner_id: 42048915
repo_id: 356423100
'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8':
ref: 'v1'
commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8'
owner_id: 1940490
repo_id: 260749683
'dtolnay/rust-toolchain@v1':
ref: 'v1'
commit: 'sha1-7e38f4b43b4db5c8dd498af069a4f6196df1d067'
owner_id: 1940490
repo_id: 260749683
'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393':
ref: 'v3.0.0'
commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393'
owner_id: 26415196
repo_id: 297874902
'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
ref: 'v1.24.1'
commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
owner_id: 47606891
repo_id: 331103973
'erlef/setup-beam@v1.24.1':
ref: 'v1.24.1'
commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
owner_id: 47606891
repo_id: 331103973
'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63':
ref: 'v4.38.0'
commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63'
owner_id: 9919
repo_id: 259445878
'github/codeql-action@v4.38.2':
ref: 'v4.38.2'
commit: 'sha1-2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2'
Expand All @@ -227,100 +169,21 @@ dependencies:
commit: 'sha1-884713a6c30a92e5e8544c39945cd7cb630abcd1'
owner_id: 1342004
repo_id: 400046858
'hyperpolymath/panic-attack@55ffcc9a240e937edd968487af15ab45c6f0522f':
ref: '55ffcc9a240e937edd968487af15ab45c6f0522f'
commit: 'sha1-55ffcc9a240e937edd968487af15ab45c6f0522f'
owner_id: 6759885
repo_id: 1152434997
uses:
- 'Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0'
- 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
- 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8'
'hyperpolymath/proven-cicd-and-workflows@4c772eb235b04455307d5c03cbbc4f45130f7f0f':
ref: 'main'
commit: 'sha1-4c772eb235b04455307d5c03cbbc4f45130f7f0f'
owner_id: 6759885
repo_id: 1326697643
'hyperpolymath/proven-cicd@a12b2b4644db1a1250bc50b58fd24c99f89f564e':
ref: 'a12b2b4644db1a1250bc50b58fd24c99f89f564e'
commit: 'sha1-a12b2b4644db1a1250bc50b58fd24c99f89f564e'
owner_id: 6759885
repo_id: 1446155688
uses:
- 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
'metadatastician/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0':
ref: '3c00687a5bbd0d881d351db8502417b5d0a8b0b0'
commit: 'sha1-3c00687a5bbd0d881d351db8502417b5d0a8b0b0'
owner_id: 297579217
repo_id: 1116521501
uses:
- 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
- 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8'
- 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555'
'metadatastician/standards@a797d308c0517d4e2d21cc7f1cb08d41f82b1a12':
ref: 'a797d308c0517d4e2d21cc7f1cb08d41f82b1a12'
commit: 'sha1-a797d308c0517d4e2d21cc7f1cb08d41f82b1a12'
owner_id: 297579217
repo_id: 1116521501
uses:
- 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
- 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
- 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
- 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393'
- 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
- 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
'metadatastician/standards@d3e4b485a2af90c92a8e18af0888cd19cb132cd9':
ref: 'd3e4b485a2af90c92a8e18af0888cd19cb132cd9'
commit: 'sha1-d3e4b485a2af90c92a8e18af0888cd19cb132cd9'
owner_id: 297579217
repo_id: 1116521501
uses:
- 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
- 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
- 'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333'
- 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
- 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
- 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63'
- 'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e'
'mlugg/setup-zig@v2.2.1':
ref: 'v2.2.1'
commit: 'sha1-d1434d08867e3ee9daa34448df10607b98908d29'
owner_id: 7289241
repo_id: 812112570
'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e':
ref: 'v2.5.0'
commit: 'sha1-fa7117db83c52d787ae5a89f350999701505d78e'
owner_id: 67707773
repo_id: 421101922
'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6':
ref: 'v2.2.0'
commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
owner_id: 108928776
repo_id: 512644635
'oven-sh/setup-bun@v2.2.0':
ref: 'v2.2.0'
commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
owner_id: 108928776
repo_id: 512644635
'slsa-framework/slsa-github-generator@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a':
ref: 'f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
commit: 'sha1-f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
owner_id: 80431187
repo_id: 475074978
uses:
- 'actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08'
- 'slsa-framework/slsa-github-generator@v2.1.0'
- 'softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda'
'slsa-framework/slsa-github-generator@v2.1.0':
ref: 'v2.1.0'
commit: 'sha1-f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
owner_id: 80431187
repo_id: 475074978
'softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda':
ref: 'v2.2.1'
commit: 'sha1-c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda'
owner_id: 2242
repo_id: 204253808
'swatinem/rust-cache@v2.9.3':
ref: 'v2.9.3'
commit: 'sha1-d1527c8f67ef9af357290475d4af4b0fab8f12e0'
Expand All @@ -331,8 +194,3 @@ dependencies:
commit: 'sha1-5488ac5a951645ce95062214902ac4b6bc1a1037'
owner_id: 43724913
repo_id: 442947557
'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555':
ref: 'v0.10.0'
commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555'
owner_id: 135788
repo_id: 208510314
Loading