From f628f03e5e2cb3617b9620351b1a93b0cbd17667 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 27 Aug 2026 13:30:05 +0100 Subject: [PATCH] fix(ci): unbreak workflow YAML and add a complete actions.lock Remediates GitHub Workflow Dependency Locking (public preview), which rejects runs at startup_failure with zero jobs and no logs. See hyperpolymath/standards#657. Five steps, in order, because each blocks the next: 1. Unbroke any workflow whose `permissions:` carried a scalar with an indented mapping under it - blind-permissions-insertion damage. This matters beyond the one file: gh actions-lock refuses to run when ANY workflow in the repo fails to parse, so the repo could never acquire a lockfile and could never self-heal. 2. Repinned hyperpolymath/standards reusables off commits that have no actions.lock. The rejection requires the CALLEE to be covered at the pinned SHA, which is unsatisfiable at a pre-lockfile commit. 3. Generated the lockfile with gh actions-lock. 4. Hand-added the reusable-workflow caller entries the tool omits, as '': []. Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without, because every workflow a lockfile OMITS is rejected. A PARTIAL lock is worse than none - running gh actions-lock and stopping there is how this outage spread. 5. Restored SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps with head -1. Verified before push: 0 unparseable workflows, lockfile covers every workflow with no omissions, SPDX on line 1 in every file. Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead -> 0 startup_failure, 13 running. Co-Authored-By: Claude Opus 5 --- .github/workflows/CI.yml | 1 + .github/workflows/CompatHelper.yml | 1 + .github/workflows/Documenter.yml | 1 + .github/workflows/TagBot.yml | 1 + .github/workflows/actions.lock | 38 ++++++++++++---------- .github/workflows/boj-build.yml | 1 + .github/workflows/casket-pages.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/dependabot-automerge.yml | 1 + .github/workflows/dogfood-gate.yml | 1 + .github/workflows/governance.yml | 4 ++- .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/push-email-notify.yml | 1 + .github/workflows/scorecard.yml | 3 +- .github/workflows/secret-scanner.yml | 2 ++ 17 files changed, 40 insertions(+), 20 deletions(-) diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml index 72e0477..65793e7 100644 --- a/.github/workflows/CI.yml +++ b/.github/workflows/CI.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: CI on: diff --git a/.github/workflows/CompatHelper.yml b/.github/workflows/CompatHelper.yml index d269541..315245e 100644 --- a/.github/workflows/CompatHelper.yml +++ b/.github/workflows/CompatHelper.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: CompatHelper on: diff --git a/.github/workflows/Documenter.yml b/.github/workflows/Documenter.yml index e91eaaa..7b3a86c 100644 --- a/.github/workflows/Documenter.yml +++ b/.github/workflows/Documenter.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Documentation on: diff --git a/.github/workflows/TagBot.yml b/.github/workflows/TagBot.yml index 8332836..bd2265a 100644 --- a/.github/workflows/TagBot.yml +++ b/.github/workflows/TagBot.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: TagBot on: diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 1a71232..d73956d 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -3,9 +3,11 @@ # Docs: https://gh.io/actions-lockfile version: 'v0.0.2' workflows: + '.github/workflows/governance.yml': [] + '.github/workflows/secret-scanner.yml': [] '.github/workflows/CI.yml': - 'actions/checkout@v7.0.1' - - 'julia-actions/cache@v3.2.0' + - 'julia-actions/cache@v3.3.0' - 'julia-actions/julia-buildpkg@v1.7.0' - 'julia-actions/julia-runtest@v1.12.0' - 'julia-actions/setup-julia@v3.0.2' @@ -13,10 +15,10 @@ workflows: - 'julia-actions/setup-julia@v3.0.2' '.github/workflows/Documenter.yml': - 'actions/checkout@v7.0.1' - - 'julia-actions/cache@v3.2.0' + - 'julia-actions/cache@v3.3.0' - 'julia-actions/setup-julia@v3.0.2' '.github/workflows/TagBot.yml': - - 'juliaregistries/tagbot@v1.25.10' + - 'juliaregistries/tagbot@v1.25.11' '.github/workflows/boj-build.yml': - 'actions/checkout@v7.0.1' '.github/workflows/casket-pages.yml': @@ -25,10 +27,10 @@ workflows: - 'actions/configure-pages@v6.0.0' - 'actions/deploy-pages@v5.0.0' - 'actions/upload-pages-artifact@v5.0.0' - - 'haskell-actions/setup@v2.11.0' + - 'haskell-actions/setup@v2.12.0' '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - - 'github/codeql-action@v4.37.4' + - 'github/codeql-action@v4.37.7' '.github/workflows/dependabot-automerge.yml': - 'dependabot/fetch-metadata@v3.1.0' '.github/workflows/dogfood-gate.yml': @@ -40,7 +42,7 @@ workflows: - 'actions/github-script@v9.0.0' - 'actions/upload-artifact@v7.0.1' - 'erlef/setup-beam@v1.24.1' - - 'github/codeql-action@v4.37.4' + - 'github/codeql-action@v4.37.7' '.github/workflows/instant-sync.yml': - 'peter-evans/repository-dispatch@v4.0.1' '.github/workflows/mirror.yml': @@ -121,14 +123,14 @@ dependencies: commit: 'sha1-e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81' owner_id: 9919 repo_id: 259445878 - 'github/codeql-action@v4.37.4': - ref: 'v4.37.4' - commit: 'sha1-f205ea1c3313d32999d8d6a48b4f6530d4437b38' + 'github/codeql-action@v4.37.7': + ref: 'v4.37.7' + commit: 'sha1-ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd' owner_id: 9919 repo_id: 259445878 - 'haskell-actions/setup@v2.11.0': - ref: 'v2.11.0' - commit: 'sha1-cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553' + 'haskell-actions/setup@v2.12.0': + ref: 'v2.12.0' + commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' owner_id: 75048950 repo_id: 623796603 'hyperpolymath/a2ml-ecosystem@main': @@ -141,9 +143,9 @@ dependencies: commit: 'sha1-89f3c2702f4f650a92aa7411502f38da06abd562' owner_id: 6759885 repo_id: 1275650185 - 'julia-actions/cache@v3.2.0': - ref: 'v3.2.0' - commit: 'sha1-b7788abd52452d5bc033d69796e110d9906af4ab' + 'julia-actions/cache@v3.3.0': + ref: 'v3.3.0' + commit: 'sha1-a7bed9df697e5d7309d68afe7542a87621a8b6c8' owner_id: 53965732 repo_id: 441908600 'julia-actions/julia-buildpkg@v1.7.0': @@ -161,9 +163,9 @@ dependencies: commit: 'sha1-fa02766e078afaaf09b14210362cee14137e6a32' owner_id: 53965732 repo_id: 202020219 - 'juliaregistries/tagbot@v1.25.10': - ref: 'v1.25.10' - commit: 'sha1-14d7645453716d7a2f09b1da0504a024f97462a1' + 'juliaregistries/tagbot@v1.25.11': + ref: 'v1.25.11' + commit: 'sha1-cded32665b34ca0496d3ac10a67d08ddfc726963' owner_id: 31455341 repo_id: 180715061 'ossf/scorecard-action@v2.4.4': diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 6e84820..accee54 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: BoJ Server Build Trigger on: push: diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index 9d6bfda..745c9e6 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: GitHub Pages on: push: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 2f19990..443dcf3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: CodeQL Security Analysis on: push: diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 5564dae..e7e6485 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # # dependabot-automerge.yml — enable GitHub's native auto-merge on # Dependabot pull requests that match a declared severity / ecosystem diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index c0f8b3c..b572a70 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 25a3fd6..aa1fb37 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # governance.yml — single wrapper calling the shared estate governance bundle # in hyperpolymath/standards instead of carrying per-repo copies. # @@ -25,7 +26,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 2c4ed95..f8b72f0 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan on: diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index c06600f..dfc7185 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 3fd3cbb..1ebf88f 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Mirror to Git Forges on: push: diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index b69c87f..4f733f4 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index eed28b4..892388e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Scorecards supply-chain security on: @@ -11,7 +12,7 @@ permissions: read-all jobs: analysis: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a permissions: contents: read security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index d3f6bb1..eb5063a 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Calls the estate's shared secret scanner (gitleaks + rust-secrets + # shell-secrets). Replaces an inline trufflehog job: trufflehog was retired # estate-wide as redundant, and this repo had no other leak scanning, so the @@ -16,6 +17,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read jobs: scan: