From a40f6c853569b068e24cc9654a65eeabc08e6e33 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 20 Sep 2026 02:02:22 +0000 Subject: [PATCH] fix(ci): reconcile the workflows with actions.lock (gh-actions-lock v0.1.6) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `actions.lock` is authoritative: the workflows carry readable refs and the lock records the commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest make the whole repository unstartable — `startup_failure`, "Invalid lockfile". Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are reverted to their readable form here precisely because the lockfile, not the workflow, is what pins them. --- .github/workflows/abi-verify.yml | 7 ++++--- .github/workflows/actions.lock | 11 +++++------ .github/workflows/codeql.yml | 7 ++++--- .github/workflows/coq-build.yml | 5 +++-- .github/workflows/ffi-seams.yml | 7 ++++--- .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 3 ++- .github/workflows/label-triage.yml | 1 + .github/workflows/labels.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/push-email-notify.yml | 3 ++- .github/workflows/rust-ci.yml | 9 +++++---- .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/status-gate.yml | 7 ++++--- 16 files changed, 40 insertions(+), 26 deletions(-) diff --git a/.github/workflows/abi-verify.yml b/.github/workflows/abi-verify.yml index 2a5d6130..9482de69 100644 --- a/.github/workflows/abi-verify.yml +++ b/.github/workflows/abi-verify.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) @@ -48,7 +49,7 @@ jobs: image: snazzybucket/idris2:latest # estate-standard Idris2 image steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Build (typecheck) the ABI seam working-directory: src/abi @@ -70,7 +71,7 @@ jobs: image: snazzybucket/idris2:latest # estate-standard Idris2 image steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Build (typecheck) the formal package working-directory: src/formal @@ -86,7 +87,7 @@ jobs: image: snazzybucket/idris2:latest # estate-standard Idris2 image steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Build the parse front-end + test executable working-directory: idris2 diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 781ce21f..a67b292a 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -24,11 +24,10 @@ workflows: '.github/workflows/mirror.yml': - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd' '.github/workflows/push-email-notify.yml': - - 'dawidd6/action-send-mail@v21' + - 'dawidd6/action-send-mail@v3.12.0' '.github/workflows/rust-ci.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' - - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd' - 'swatinem/rust-cache@v2.9.2' '.github/workflows/scorecard.yml': - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd' @@ -59,9 +58,9 @@ dependencies: commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' owner_id: 44036562 repo_id: 192625955 - 'dawidd6/action-send-mail@v21': - ref: 'v21' - commit: 'sha1-03a02a49409134de07636216fb379a026c52991e' + 'dawidd6/action-send-mail@v3.12.0': + ref: 'v3.12.0' + commit: 'sha1-67ce3558d613188179559c61d3565140cf389968' owner_id: 9713907 repo_id: 222439721 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed': @@ -76,7 +75,7 @@ dependencies: repo_id: 260749683 'dtolnay/rust-toolchain@v1': ref: 'v1' - commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' + commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de' owner_id: 1940490 repo_id: 260749683 'editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c': diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c04c2a5b..4ca11e9f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: CodeQL Security Analysis @@ -39,15 +40,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 + uses: github/codeql-action/init@v4.38.0 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 + uses: github/codeql-action/analyze@v4.38.0 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/coq-build.yml b/.github/workflows/coq-build.yml index 88b5b74a..a7546a1b 100644 --- a/.github/workflows/coq-build.yml +++ b/.github/workflows/coq-build.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) @@ -55,7 +56,7 @@ jobs: outputs: relevant: ${{ steps.f.outputs.relevant }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 2 - id: f @@ -104,7 +105,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install Coq 8.18 (noble apt) run: | diff --git a/.github/workflows/ffi-seams.yml b/.github/workflows/ffi-seams.yml index 2b5941a6..d219a47b 100644 --- a/.github/workflows/ffi-seams.yml +++ b/.github/workflows/ffi-seams.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Owner: Jonathan D.A. Jewell @@ -37,7 +38,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - id: detect @@ -68,10 +69,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: Install Zig - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1 + uses: mlugg/setup-zig@v2.2.1 with: version: 0.15.2 diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index fd42d2b4..79ba1dd6 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Governance diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 989347a0..e4346cbe 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Hypatia Security Scan diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index e6b6f09a..5fd1cf48 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Instant Forge Sync - Triggers propagation to all forges on push/release @@ -24,7 +25,7 @@ jobs: - name: Trigger Propagation id: propagate if: ${{ env.FARM_DISPATCH_TOKEN != '' }} - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 + uses: peter-evans/repository-dispatch@v4.0.1 env: FARM_DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }} with: diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml index 9886e920..814a1924 100644 --- a/.github/workflows/label-triage.yml +++ b/.github/workflows/label-triage.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Label Triage diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index c80b676c..83ab941a 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Labels diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 92623846..5440e468 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Mirror to Git Forges diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 421f349e..0a1529ce 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable @@ -17,7 +18,7 @@ jobs: timeout-minutes: 5 steps: - name: Send push notification email - uses: dawidd6/action-send-mail@67ce3558d613188179559c61d3565140cf389968 # v22 + uses: dawidd6/action-send-mail@v3.12.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 00a00801..9f8abed0 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Rust CI — thin wrapper calling the shared estate reusable in @@ -45,10 +46,10 @@ jobs: # for the in-tree codec that makes this possible. steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + uses: dtolnay/rust-toolchain@v1 with: toolchain: v1 with: @@ -89,10 +90,10 @@ jobs: # known rustc-incremental ICE on ephapax-parser. steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + uses: dtolnay/rust-toolchain@v1 with: toolchain: stable # required when SHA-pinned (no rust-toolchain.toml in repo) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index a04c47ec..f2ec1f8b 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: OSSF Scorecard diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 084d51a3..80b7c85a 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Secret Scanner diff --git a/.github/workflows/status-gate.yml b/.github/workflows/status-gate.yml index 11a14626..45ff68e6 100644 --- a/.github/workflows/status-gate.yml +++ b/.github/workflows/status-gate.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Owner: Jonathan D.A. Jewell @@ -42,7 +43,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Proof-count drift (grep only — no build) run: ./scripts/status-gate.sh --proofs @@ -57,9 +58,9 @@ jobs: run: | echo "::notice title=Slow check — safe to cancel::status-gate-tests runs a full cargo build just to verify the TEST-NEEDS.md test count. The core proof-count gate (status-gate-core) is a separate, independent job and is already enforced. If you're in a rush you can cancel THIS job without letting any core gating go." - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1 + uses: dtolnay/rust-toolchain@v1 with: toolchain: v1 with: