fix(ci): unbreak workflow YAML and add a complete actions.lock

[hyperpolymath]

Remediates GitHub Workflow Dependency Locking (public preview, no changelog entry), which rejects runs at startup_failure — zero jobs, no logs, nothing in REST or GraphQL. Full analysis: hyperpolymath/standards#657.

Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead → 0 startup_failure, 13 running.

Five steps, in order — each blocks the next

1. Unbreak the workflow YAML. Any permissions: carrying a scalar with an indented mapping under it:

permissions: read-all
  actions: read        # <- mapping under a scalar. Unparseable.

This reaches past the one file: gh actions-lock refuses to run when any workflow in the repo fails to parse, so the repo can never acquire a lockfile and can never self-heal.

2. Repin standards reusables off commits with no actions.lock. The rejection requires the callee to be covered at the pinned SHA — unsatisfiable at a pre-lockfile commit.

3. Generate the lockfile with gh actions-lock.

4. Hand-add the reusable-caller entries the tool omits, as '<path>': [].

⚠️ Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without — because every workflow a lockfile omits is rejected. A partial lock is worse than none. Running gh actions-lock and stopping there is how this outage spread.

5. Restore SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps via head -1.

Verified before this PR was opened

0 unparseable workflows · lockfile covers every workflow, no omissions · SPDX on line 1 in every file. The script refuses to push if any of the three fails.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[codacy-production]

Not up to standards ⛔

🔴 Issues 1 high

Alerts:
⚠ 1 issue (≤ 0 issues of at least minor severity)

Results:
1 new issue

Category	Results
Security	1 high

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

While this PR successfully introduces the actions.lock file and pins most dependencies, it is currently not up to standards due to logic errors in permission declarations and a failure to meet mandatory security linting criteria. Specifically, the 'scorecard' and 'scan' jobs will fail at runtime because their job-level permission blocks do not inherit the required 'actions: read' permission declared at the workflow level.

Additionally, the security linter will fail for the 'Deploy Now' workflow because the SPDX header was placed on the second line instead of the first. There is also a systemic issue across multiple files where the management banner was duplicated. These issues must be addressed before merging to ensure CI stability and security compliance.

About this PR

• There is a systemic pattern of redundant management comments ('managed by gh actions-lock') being duplicated on consecutive lines across several workflow files. This likely stems from a configuration overlap between manual edits and the locking tool.

Test suggestions

• Verify 'SPDX-License-Identifier' is on line 1 of every workflow file
• Verify 'actions: read' permission is added to workflows calling reusable workflows
• Verify that actions/reusables are pinned to specific versions or SHAs compatible with locking
• Verify 'actions.lock' existence and coverage of all repository workflows

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify 'SPDX-License-Identifier' is on line 1 of every workflow file

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

The scan job defines its own permissions block on line 17, which prevents it from inheriting this workflow-level actions: read permission. To avoid runtime access errors, add actions: read directly to the job-level permissions.

[codacy-production]

_{🔴 HIGH RISK}

This top-level permission is ineffective for the scorecard job because it defines its own explicit permissions block starting on line 18. Move actions: read into the job-level permissions block to ensure the reusable workflow has the necessary access.

[codacy-production]

_{🟡 MEDIUM RISK}

The SPDX-License-Identifier must be on line 1 to satisfy the 'Workflow Security Linter'. Current placement on line 2 will trigger a linting error. Move this identifier to the very first line of the file.

[codacy-production]

_{⚪ LOW RISK}

Nitpick: Duplicate management banner. This line is identical to the one preceding it. This redundancy appears in several files (e.g., boj-build.yml, mirror.yml) and should be cleaned up to maintain workflow readability.