fix(ci): unbreak workflow YAML and add a complete actions.lock by hyperpolymath · Pull Request #49 · hyperpolymath/blocky-writer

hyperpolymath · 2026-08-27T05:54:03Z

Remediates GitHub Workflow Dependency Locking (public preview, no changelog entry), which rejects runs at startup_failure — zero jobs, no logs, nothing in REST or GraphQL. Full analysis: hyperpolymath/standards#657.

Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead → 0 startup_failure, 13 running.

Five steps, in order — each blocks the next

1. Unbreak the workflow YAML. Any permissions: carrying a scalar with an indented mapping under it:

permissions: read-all
  actions: read        # <- mapping under a scalar. Unparseable.

This reaches past the one file: gh actions-lock refuses to run when any workflow in the repo fails to parse, so the repo can never acquire a lockfile and can never self-heal.

2. Repin standards reusables off commits with no actions.lock. The rejection requires the callee to be covered at the pinned SHA — unsatisfiable at a pre-lockfile commit.

3. Generate the lockfile with gh actions-lock.

4. Hand-add the reusable-caller entries the tool omits, as '<path>': [].

⚠️ Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without — because every workflow a lockfile omits is rejected. A partial lock is worse than none. Running gh actions-lock and stopping there is how this outage spread.

5. Restore SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps via head -1.

Verified before this PR was opened

0 unparseable workflows · lockfile covers every workflow, no omissions · SPDX on line 1 in every file. The script refuses to push if any of the three fails.

🤖 Generated with Claude Code

Remediates GitHub Workflow Dependency Locking (public preview), which rejects runs at startup_failure with zero jobs and no logs. See hyperpolymath/standards#657. Five steps, in order, because each blocks the next: 1. Unbroke any workflow whose `permissions:` carried a scalar with an indented mapping under it - blind-permissions-insertion damage. This matters beyond the one file: gh actions-lock refuses to run when ANY workflow in the repo fails to parse, so the repo could never acquire a lockfile and could never self-heal. 2. Repinned hyperpolymath/standards reusables off commits that have no actions.lock. The rejection requires the CALLEE to be covered at the pinned SHA, which is unsatisfiable at a pre-lockfile commit. 3. Generated the lockfile with gh actions-lock. 4. Hand-added the reusable-workflow caller entries the tool omits, as '<path>': []. Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without, because every workflow a lockfile OMITS is rejected. A PARTIAL lock is worse than none - running gh actions-lock and stopping there is how this outage spread. 5. Restored SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps with head -1. Verified before push: 0 unparseable workflows, lockfile covers every workflow with no omissions, SPDX on line 1 in every file. Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead -> 0 startup_failure, 13 running. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

coderabbitai · 2026-08-27T05:54:20Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6e2605bf-6a66-4f57-a199-f4869870a150

📥 Commits

Reviewing files that changed from the base of the PR and between 92da8d8 and 52346f2.

⛔ Files ignored due to path filters (1)

.github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (11)

.github/workflows/boj-build.yml
.github/workflows/casket-pages.yml
.github/workflows/ci.yml
.github/workflows/codeql.yml
.github/workflows/governance.yml
.github/workflows/hypatia-scan.yml
.github/workflows/instant-sync.yml
.github/workflows/mirror.yml
.github/workflows/pages.yml
.github/workflows/push-email-notify.yml
.github/workflows/secret-scanner.yml

📝 Walkthrough

Summary by CodeRabbit

Chores
- Updated automated build, testing, scanning, deployment and synchronisation workflows to use maintained action and workflow revisions.
- Improved workflow maintenance tracking and consistency across repository automation.
- Removed duplicate workflow metadata where applicable.
Bug Fixes
- Improved the reliability and security of automated development and deployment checks without changing application functionality.

Walkthrough

The pull request updates management comments in GitHub workflow files and changes selected action or reusable workflow references. Most changes are documentary. The CI Rust toolchain references now use the v1 tag.

Changes

Workflow maintenance

Layer / File(s)	Summary
Workflow management comments `.github/workflows/*.yml`	Management comments were added, removed, or duplicated in workflow headers.
Action and reusable workflow references `.github/workflows/ci.yml`, `.github/workflows/governance.yml`, `.github/workflows/mirror.yml`, `.github/workflows/secret-scanner.yml`	The CI Rust toolchain references now use `v1`. Reusable workflow references were repinned to updated commits.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit checks each workflow line

Header marks are neat and fine
Rust tools follow v1
Pinned paths shift where updates run
The burrow builds in order once again

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

gitar-bot · 2026-08-27T05:54:33Z

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

codacy-production · 2026-08-27T05:55:09Z

Not up to standards ⛔

🔴 Issues 1 high

Alerts:
⚠ 1 issue (≤ 0 issues of at least minor severity)

Results:
1 new issue

Category Results

Security 1 high

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

codacy-production

Pull Request Overview

The PR aims to fix GitHub Actions outages by implementing dependency locking and correcting YAML syntax. However, the analysis shows that the Codacy results are currently not up to standards, primarily due to security regressions.

A major concern is the replacement of fixed commit SHAs with floating tags (@v1) for the dtolnay/rust-toolchain action in .github/workflows/ci.yml. This undermines the goal of build immutability and exposes the pipeline to supply-chain risks. Additionally, while the PR description mentions manual patches to the actions.lock file, this file is absent from the diff, leaving a critical acceptance criterion unverified. Minor redundancy was also introduced in the file headers during the automated processing.

About this PR

The 'actions.lock' file is missing from the PR diff. This prevents verification of the 'complete' lockfile requirement and the manual patches mentioned in Step 4 of the PR description.
The header comment '# This workflow is managed by gh actions-lock.' is duplicated across most workflow files (lines 2 and 3). Please check the idempotency of the tool used to generate these locks.

Test suggestions

Verify all workflow files are valid YAML and parseable by GitHub Actions.
Verify SPDX-License-Identifier is on the first line of every modified workflow.
Verify 'hyperpolymath/standards' reusables are updated to use specific SHAs compatible with locking.
Verify actions.lock contains manually added entries for callers ('': []) as specified in the description.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify actions.lock contains manually added entries for callers ('<path>': []) as specified in the description.

_{TIP Improve review quality by adding custom instructions}
_{TIP How was this review? Give us feedback}

codacy-production · 2026-08-27T05:56:09Z

          deno-version: v2.x

-      - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+      - uses: dtolnay/rust-toolchain@v1


_{🔴 HIGH RISK}

Replacing the pinned commit hash with a floating tag @v1 reduces the security posture of the CI pipeline. In projects using actions-lock, it is best practice to keep actions pinned to immutable commit hashes to ensure build integrity and reproducibility. Pin dtolnay/rust-toolchain to a full 40-character commit SHA.

See Issue in Codacy

codacy-production · 2026-08-27T05:56:09Z

          deno-version: v2.x

-      - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+      - uses: dtolnay/rust-toolchain@v1


_{🟡 MEDIUM RISK}

Replacing the pinned commit hash with a floating tag @v1 reduces the security posture. This action should remain pinned to a specific hash.

codacy-production · 2026-08-27T05:56:10Z

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.


_{⚪ LOW RISK}

Nitpick: Duplicate comment line. Line 3 repeats the same 'managed by gh actions-lock' message found on line 2. Consider removing the redundancy:

Suggested change

# This workflow is managed by gh actions-lock.

name: BoJ Server Build Trigger

github-actions · 2026-08-27T06:25:06Z

🔍 Hypatia Security Scan

Findings: 59 issues detected

Severity	Count
🔴 Critical	6
🟠 High	28
🟡 Medium	25

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_workflow",
    "file": "scorecard.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
    "type": "codeql_language_matrix_mismatch",
    "file": "codeql.yml",
    "action": "switch_codeql_matrix_to_actions",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in hypatia-scan.yml",
    "type": "missing_timeout_minutes",
    "file": "hypatia-scan.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "missing_timeout_minutes",
    "file": "instant-sync.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

hyperpolymath merged commit 5935a5a into main Aug 27, 2026
3 of 5 checks passed

hyperpolymath deleted the fix/workflow-dependency-locking branch August 27, 2026 05:54

codacy-production Bot reviewed Aug 27, 2026

View reviewed changes

Navigation Menu

Uh oh!

fix(ci): unbreak workflow YAML and add a complete actions.lock - #49

fix(ci): unbreak workflow YAML and add a complete actions.lock#49
hyperpolymath merged 1 commit into
mainfrom
fix/workflow-dependency-locking

hyperpolymath commented Aug 27, 2026

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 27, 2026 •

edited

Loading

Review failed

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

gitar-bot Bot commented Aug 27, 2026

Uh oh!

codacy-production Bot commented Aug 27, 2026

Uh oh!

codacy-production Bot left a comment

Uh oh!

codacy-production Bot Aug 27, 2026

Uh oh!

codacy-production Bot Aug 27, 2026

Uh oh!

codacy-production Bot Aug 27, 2026

Uh oh!

github-actions Bot commented Aug 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	# This workflow is managed by gh actions-lock.
	name: BoJ Server Build Trigger

Uh oh!

Conversation

hyperpolymath commented Aug 27, 2026

Five steps, in order — each blocks the next

Verified before this PR was opened

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

gitar-bot Bot commented Aug 27, 2026

Uh oh!

codacy-production Bot commented Aug 27, 2026

Not up to standards ⛔

Uh oh!

codacy-production Bot left a comment

Choose a reason for hiding this comment

Pull Request Overview

About this PR

Test suggestions

Uh oh!

codacy-production Bot Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Aug 27, 2026

🔍 Hypatia Security Scan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Aug 27, 2026 •

edited

Loading