Repository navigation
fix(ci): rename the suite call and refresh actions.lock after PR 491 - #496
Merged
Merged
Conversation
hyperpolymath/cicd-suite is renamed to proven-cicd-and-workflows. The official actions.lock refresh rewrites this call to the new name, drops the old record, and then cannot close the lock (run 42869749661: "close-lock: 3 ref(s) could not be resolved"). The commit 4c772eb stays. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6 Signed-off-by: Claude <noreply@anthropic.com>
Applied without edits from the "Prepare official actions.lock refresh candidate" step of run 42873771915 (outcome: changed; close-lock: 0 dangling refs; check-lock-sync: in sync). It moves the Security Scan record from panic-attack be6ac46 to 55ffcc9 (PR 491), renames the suite record to proven-cicd-and-workflows, and prunes the entry of the deleted boj-build.yml. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6 Signed-off-by: Claude <noreply@anthropic.com>
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 5 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
|
hyperpolymath
marked this pull request as ready for review
November 10, 2026 18:28
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
hyperpolymath
enabled auto-merge (squash)
November 10, 2026 18:28
hyperpolymath
pushed a commit
that referenced
this pull request
Nov 10, 2026
#496 refreshed actions.lock on main. Take main's lockfile, then regenerate it with gh-actions-lock v0.2.0 --no-onboard --no-narrow, so the only change against main is removing the 8 reusable-workflow entries that v0.2.0 reports as unused. No workflow file changes; --verify-local: all 34 workflows have complete lockfile coverage. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4
This was referenced Nov 10, 2026
hyperpolymath
added a commit
that referenced
this pull request
Nov 10, 2026
## Summary The Workflow Security Linter refresh and the committed `actions.lock` produced different locks. This PR makes them agree, using the form the owner chose: the form that the standards refresh tool writes. The candidate is applied without edits, from the "Prepare official actions.lock refresh candidate" step of run 42897428598 on `18828c3`. That run reports `close-lock: 0 dangling refs`, `prune-stale: oracle vetoes 0` and `actions.lock is in sync`. It restores the reusable-workflow records that #495 removed: 8 job-level reusable calls, with their transitive actions. ## Why this is safe for governance #495 removed these records as stale. The governance gate accepts them, however. Its verifier (standards `a797d30`, `scripts/update-actions-lock.sh`, `verify_lock_coverage`) accepts a `stale` finding when the workflow calls that exact `owner/repo/.github/workflows/…@ref`. The governance log on `d98b0e2` shows that 7 of the 8 records were accepted. It rejected only 1: `security-scan.yml → panic-attack@be6ac46`, which was stale because #491 had moved the call to `55ffcc9`. This form passed governance on `453fe3b` (#496). The refresh run above printed the same "Accepted reusable-workflow lock coverage" line for each of the 8 current calls. ## Correction #500 said that applying this candidate would turn governance red. That was wrong, for the reason above. ## Test plan - [ ] governance / Actions lockfile verify passes on this head. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PR 491 moved
security-scan.ymlto panic-attack55ffcc9, butactions.lockstill recordsbe6ac46. The official refresh could not fix that: it failed onmaintoo (run 42869749661, "close-lock: 3 ref(s) could not be resolved"). The cause iszig-ffi-ci.yml, which still calls the suite ashyperpolymath/cicd-suite. The tool rewrites the call to the renamed repository, drops the old record, and then cannot write it again.Changes
.github/workflows/zig-ffi-ci.yml: the call nameshyperpolymath/proven-cicd-and-workflows. The commit4c772ebdoes not change, and it is an ancestor of that repository'smain..github/workflows/actions.lock: the official refresh candidate from run 42873771915, applied without edits. It moves the Security Scan record to55ffcc9, renames the suite record, and prunes the entry of the deletedboj-build.yml.RSR Quality Checklist
Required
Check workflow policy and issue regressions.unsafeblocks without// SAFETY:comments.envfiles includedAs Applicable
Testing
workflow_dispatch,refresh_actions_lock: true) atcb0f560: canonical outcomechanged, close-lock 0 dangling refs,update-actions-lock.sh --verify-localaccepted,check-lock-sync.sh: "actions.lock is in sync".git apply --checkand is the only change in the second commit.Screenshots
Not applicable.
Generated by Claude Code