fix(ci): unbreak workflow YAML and add a complete actions.lock

[hyperpolymath]

Remediates GitHub Workflow Dependency Locking (public preview, no changelog entry), which rejects runs at startup_failure — zero jobs, no logs, nothing in REST or GraphQL. Full analysis: hyperpolymath/standards#657.

Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead → 0 startup_failure, 13 running.

Five steps, in order — each blocks the next

1. Unbreak the workflow YAML. Any permissions: carrying a scalar with an indented mapping under it:

permissions: read-all
  actions: read        # <- mapping under a scalar. Unparseable.

This reaches past the one file: gh actions-lock refuses to run when any workflow in the repo fails to parse, so the repo can never acquire a lockfile and can never self-heal.

2. Repin standards reusables off commits with no actions.lock. The rejection requires the callee to be covered at the pinned SHA — unsatisfiable at a pre-lockfile commit.

3. Generate the lockfile with gh actions-lock.

4. Hand-add the reusable-caller entries the tool omits, as '<path>': [].

⚠️ Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without — because every workflow a lockfile omits is rejected. A partial lock is worse than none. Running gh actions-lock and stopping there is how this outage spread.

5. Restore SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps via head -1.

Verified before this PR was opened

0 unparseable workflows · lockfile covers every workflow, no omissions · SPDX on line 1 in every file. The script refuses to push if any of the three fails.

🤖 Generated with Claude Code

[codacy-production]

Not up to standards ⛔

🔴 Issues 1 high

Alerts:
⚠ 1 issue (≤ 0 issues of at least minor severity)

Results:
1 new issue

Category	Results
Security	1 high

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[codacy-production]

Pull Request Overview

The pull request is currently not up to standards according to Codacy, primarily due to the use of a mutable version tag instead of a commit SHA in the workflow configuration. While the PR aims to unbreak the workflow YAML and implement dependency locking, several issues persist.

First, there is a systemic redundancy across all 16 modified files where the header comment is duplicated on line 3. Second, while the PR description mentions fixing permissions: blocks, no such structural changes are present in the provided diff. Finally, the push-email-notify.yml file uses a version tag rather than a commit SHA, which fails the requirement for immutable dependency locking and introduces a potential security risk.

About this PR

• The PR description mentions fixing permissions: blocks under scalar mappings, but no such changes appear in the diff hunks. Please ensure all intended YAML fixes are included in this PR.
• A duplicate comment line '# This workflow is managed by gh actions-lock.' was added to line 3 of all 16 modified workflow files. This redundancy should be cleaned up across the repository.

Test suggestions

• Verify all GitHub workflow files are valid YAML
• Verify SPDX license header exists on the first line of all workflows
• Verify all reusable workflow calls are pinned to commit SHAs
• Verify actions.lock contains manual caller entries ('': [])

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify actions.lock contains manual caller entries ('<path>': [])

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

To ensure the action is immutable and follows the dependency locking requirements of this PR, use a full-length commit SHA instead of a version tag. This protects the workflow against supply chain attacks where a tag could be reassigned to a malicious commit.

See Issue in Codacy

[codacy-production]

_{⚪ LOW RISK}

Nitpick: This line is a duplicate of the comment on line 2. It should be removed to avoid redundancy in the workflow header.