fix(ci): unbreak workflow YAML and add a complete actions.lock

[hyperpolymath]

Remediates GitHub Workflow Dependency Locking (public preview, no changelog entry), which rejects runs at startup_failure — zero jobs, no logs, nothing in REST or GraphQL. Full analysis: hyperpolymath/standards#657.

Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead → 0 startup_failure, 13 running.

Five steps, in order — each blocks the next

1. Unbreak the workflow YAML. Any permissions: carrying a scalar with an indented mapping under it:

permissions: read-all
  actions: read        # <- mapping under a scalar. Unparseable.

This reaches past the one file: gh actions-lock refuses to run when any workflow in the repo fails to parse, so the repo can never acquire a lockfile and can never self-heal.

2. Repin standards reusables off commits with no actions.lock. The rejection requires the callee to be covered at the pinned SHA — unsatisfiable at a pre-lockfile commit.

3. Generate the lockfile with gh actions-lock.

4. Hand-add the reusable-caller entries the tool omits, as '<path>': [].

⚠️ Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without — because every workflow a lockfile omits is rejected. A partial lock is worse than none. Running gh actions-lock and stopping there is how this outage spread.

5. Restore SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps via head -1.

Verified before this PR was opened

0 unparseable workflows · lockfile covers every workflow, no omissions · SPDX on line 1 in every file. The script refuses to push if any of the three fails.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[codacy-production]

Not up to standards ⛔

🔴 Issues 1 high

Alerts:
⚠ 1 issue (≤ 0 issues of at least minor severity)

Results:
1 new issue

Category	Results
Security	1 high

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR attempts to remediate GitHub Actions startup failures by fixing workflow YAML syntax, pinning dependencies, and adding management headers. However, the current state is not up to standards due to a security regression and several implementation gaps.

Major concerns include the reversion from an immutable commit SHA to a mutable version tag in the email notification workflow, which increases the risk of supply-chain attacks. Additionally, while the PR description mentions an actions.lock file and specific permission requirements, the diff does not include the lock file, and several workflows appear to lack the mandatory 'actions: read' permissions for reusable components.

Finally, there is a systemic issue where management headers are being duplicated on consecutive lines across multiple workflow files. These should be cleaned up to maintain file integrity.

About this PR

• The '.github/workflows/actions.lock' file is referenced in the PR description but is excluded from the current diff. This prevents verification of the manual caller entries and the integrity of the locking mechanism.
• Several files (including boj-build.yml, dogfood-gate.yml, mirror.yml, and rust-ci.yml) contain redundant duplicate management comments ('# This workflow is managed by gh actions-lock.') on lines 2 and 3. Please ensure the automation tool is configured to avoid these duplications.

Test suggestions

• Verify that SPDX-License-Identifier is preserved on line 1 across all modified files.
• Verify that actions/checkout is correctly pinned to v7.0.1 in all occurrences.
• Confirm that actions: read permission is present in all workflows using the 'uses' keyword for reusables.
• Validate that no duplicate management comments exist in the workflow headers.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that SPDX-License-Identifier is preserved on line 1 across all modified files.
2. Verify that actions/checkout is correctly pinned to v7.0.1 in all occurrences.
3. Confirm that actions: read permission is present in all workflows using the 'uses' keyword for reusables.
4. Validate that no duplicate management comments exist in the workflow headers.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

Reverting from a commit SHA to a version tag reduces the security of the workflow. While version tags are human-readable, they are mutable; pinning to a full-length SHA ensures that the workflow remains immutable and protects against potential supply-chain attacks where a tag could be redirected to malicious code.

See Issue in Codacy

[codacy-production]

_{⚪ LOW RISK}

Nitpick: Line 2 already contains this management comment; this addition is redundant.

[codacy-production]

_{⚪ LOW RISK}

Nitpick: Line 2 already contains this management comment; this addition is redundant.

[codacy-production]

_{⚪ LOW RISK}

Nitpick: Line 2 already contains this management comment; this addition is redundant.

[codacy-production]

_{⚪ LOW RISK}

Nitpick: Line 2 already contains this management comment; this addition is redundant. Please remove the duplicate line.

Suggested change

# This workflow is managed by gh actions-lock.