fix(ci): unbreak workflow YAML and add a complete actions.lock

[hyperpolymath]

Remediates GitHub Workflow Dependency Locking (public preview, no changelog entry), which rejects runs at startup_failure — zero jobs, no logs, nothing in REST or GraphQL. Full analysis: hyperpolymath/standards#657.

Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead → 0 startup_failure, 13 running.

Five steps, in order — each blocks the next

1. Unbreak the workflow YAML. Any permissions: carrying a scalar with an indented mapping under it:

permissions: read-all
  actions: read        # <- mapping under a scalar. Unparseable.

This reaches past the one file: gh actions-lock refuses to run when any workflow in the repo fails to parse, so the repo can never acquire a lockfile and can never self-heal.

2. Repin standards reusables off commits with no actions.lock. The rejection requires the callee to be covered at the pinned SHA — unsatisfiable at a pre-lockfile commit.

3. Generate the lockfile with gh actions-lock.

4. Hand-add the reusable-caller entries the tool omits, as '<path>': [].

⚠️ Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without — because every workflow a lockfile omits is rejected. A partial lock is worse than none. Running gh actions-lock and stopping there is how this outage spread.

5. Restore SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps via head -1.

Verified before this PR was opened

0 unparseable workflows · lockfile covers every workflow, no omissions · SPDX on line 1 in every file. The script refuses to push if any of the three fails.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[codacy-production]

Not up to standards ⛔

🔴 Issues 1 high

Alerts:
⚠ 1 issue (≤ 0 issues of at least minor severity)

Results:
1 new issue

Category	Results
Security	1 high

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The pull request is currently not up to standards according to quality analysis. While the intent is to remediate GitHub Workflow dependency locking and fix syntax errors, the implementation is incomplete. Crucially, the actions.lock file is missing from the submission, and the specific YAML parsing errors described in the PR intent are not visible in the provided changes. Additionally, there is a security regression across multiple files where immutable commit SHAs have been replaced with mutable version tags, which reduces supply-chain security visibility and contradicts best practices for pinned environments.

About this PR

• There is a systemic transition from immutable commit SHAs to mutable version tags (e.g., in codeql.yml and push-email-notify.yml). This reduces the security posture of the CI pipeline by introducing vulnerability to tag-switching or supply-chain attacks.
• The actions.lock file, which is a primary objective of this PR, is missing from the submitted changes. This file is necessary to verify the dependency locking implementation.
• The YAML syntax remediation (fixing invalid mappings under scalars in 'permissions') could not be verified. Ensure all intended 'unbreak' changes are included in the commit.

Test suggestions

• Verify that 'SPDX-License-Identifier' is preserved on line 1 in all modified workflows.
• Verify that 'Secret Scanner' and other workflows are pinned to specific commits or versions as required by the locking strategy.
• Verify the 'actions.lock' file exists in '.github/workflows/' and contains entries for all workflows.
• Verify that 'actions: read' permission is added to workflows that previously lacked it (e.g., Secret Scanner).

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify the 'actions.lock' file exists in '.github/workflows/' and contains entries for all workflows.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}