Skip to content

Commit 4bfa20f

Browse files
hyperpolymathhyperpolymath
committed
chore(ci): SPDX headers on line 1 and Actions lockfile minted
Two estate gates, one change. **SPDX.** `governance / Workflow security linter` checks `head -1 | grep`, so a workflow carrying its identifier below a managed-by comment reports as missing one. Each file's OWN identifier is moved to line 1 — nothing is imposed, because repositories here are variously MPL-2.0, PMPL-1.0-or-later and AGPL-3.0-or-later and a default would mis-declare the minority. Licences seen here: MPL-2.0. **Lockfile.** `gh actions-lock` resolves each symbolic ref to a verified commit plus owner_id, repo_id and the transitive dependencies of composite actions — which is what OSSF Scorecard's Pinned-Dependencies check is asking for, and what an inline SHA cannot express. ⚠ Do NOT additionally SHA-pin inline. The mechanisms are mutually exclusive: `gh actions-lock` refuses a ref no tag or branch contains, so inline pinning REMOVES actions from the lockfile. Measured on hypatia 2026-08-07 — 40 inline pins caused 14 startup_failures and dropped 7 lockfile entries. Verified: all workflows parse, no duplicate identifiers, lockfile verify says "All 15 workflows have complete lockfile coverage.".
1 parent 38d9936 commit 4bfa20f

16 files changed

Lines changed: 165 additions & 36 deletions

‎.github/workflows/actions.lock‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
# This file is machine-generated by `gh actions-lock`.
2+
# Do not edit by hand; run `gh actions-lock` to update.
3+
# Docs: https://gh.io/actions-lockfile
4+
version: 'v0.0.2'
5+
workflows:
6+
'.github/workflows/boj-build.yml':
7+
- 'actions/checkout@v7.0.1'
8+
'.github/workflows/casket-pages.yml':
9+
- 'actions/cache@v6.1.0'
10+
- 'actions/checkout@v7.0.1'
11+
- 'actions/configure-pages@v6.0.0'
12+
- 'actions/deploy-pages@v5.0.0'
13+
- 'actions/upload-pages-artifact@v5.0.0'
14+
- 'haskell-actions/setup@v2.11.0'
15+
'.github/workflows/codeql.yml':
16+
- 'actions/checkout@v7.0.1'
17+
- 'github/codeql-action@v4.37.4'
18+
'.github/workflows/dependabot-automerge.yml':
19+
- 'dependabot/fetch-metadata@v3.1.0'
20+
'.github/workflows/dogfood-gate.yml':
21+
- 'actions/checkout@v7.0.1'
22+
'.github/workflows/instant-sync.yml':
23+
- 'peter-evans/repository-dispatch@v4.0.1'
24+
'.github/workflows/push-email-notify.yml':
25+
- 'dawidd6/action-send-mail@v3.12.0'
26+
'.github/workflows/release.yml':
27+
- 'actions/checkout@v7.0.1'
28+
- 'actions/upload-artifact@v7.0.1'
29+
- 'softprops/action-gh-release@v3.0.2'
30+
'.github/workflows/rhodibot.yml':
31+
- 'actions/checkout@v7.0.1'
32+
'.github/workflows/static-analysis-gate.yml':
33+
- 'actions/checkout@v7.0.1'
34+
- 'actions/download-artifact@v8.0.1'
35+
- 'actions/upload-artifact@v7.0.1'
36+
- 'erlef/setup-beam@v1.24.1'
37+
dependencies:
38+
'actions/cache@v6.1.0':
39+
ref: 'v6.1.0'
40+
commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
41+
owner_id: 44036562
42+
repo_id: 215566462
43+
'actions/checkout@v7.0.1':
44+
ref: 'v7.0.1'
45+
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
46+
owner_id: 44036562
47+
repo_id: 197814629
48+
'actions/configure-pages@v6.0.0':
49+
ref: 'v6.0.0'
50+
commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d'
51+
owner_id: 44036562
52+
repo_id: 513659658
53+
'actions/deploy-pages@v5.0.0':
54+
ref: 'v5.0.0'
55+
commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128'
56+
owner_id: 44036562
57+
repo_id: 438112499
58+
'actions/download-artifact@v8.0.1':
59+
ref: 'v8.0.1'
60+
commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
61+
owner_id: 44036562
62+
repo_id: 192626254
63+
'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
64+
ref: 'v7.0.0'
65+
commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
66+
owner_id: 44036562
67+
repo_id: 192625955
68+
'actions/upload-artifact@v7.0.1':
69+
ref: 'v7.0.1'
70+
commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
71+
owner_id: 44036562
72+
repo_id: 192625955
73+
'actions/upload-pages-artifact@v5.0.0':
74+
ref: 'v5.0.0'
75+
commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
76+
owner_id: 44036562
77+
repo_id: 496012378
78+
uses:
79+
- 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
80+
'dawidd6/action-send-mail@v3.12.0':
81+
ref: 'v3.12.0'
82+
commit: 'sha1-2e600f3776677e493bf0da7aaec39a586d19a5ed'
83+
owner_id: 9713907
84+
repo_id: 222439721
85+
'dependabot/fetch-metadata@v3.1.0':
86+
ref: 'v3.1.0'
87+
commit: 'sha1-25dd0e34f4fe68f24cc83900b1fe3fe149efef98'
88+
owner_id: 27347476
89+
repo_id: 371068214
90+
'erlef/setup-beam@v1.24.1':
91+
ref: 'v1.24.1'
92+
commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
93+
owner_id: 47606891
94+
repo_id: 331103973
95+
'github/codeql-action@v4.37.4':
96+
ref: 'v4.37.4'
97+
commit: 'sha1-f205ea1c3313d32999d8d6a48b4f6530d4437b38'
98+
owner_id: 9919
99+
repo_id: 259445878
100+
'haskell-actions/setup@v2.11.0':
101+
ref: 'v2.11.0'
102+
commit: 'sha1-cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553'
103+
owner_id: 75048950
104+
repo_id: 623796603
105+
'peter-evans/repository-dispatch@v4.0.1':
106+
ref: 'v4.0.1'
107+
commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
108+
owner_id: 18365890
109+
repo_id: 220359305
110+
'softprops/action-gh-release@v3.0.2':
111+
ref: 'v3.0.2'
112+
commit: 'sha1-3d0d9888cb7fd7b750713d6e236d1fcb99157228'
113+
owner_id: 2242
114+
repo_id: 204253808

‎.github/workflows/boj-build.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
#
34
# OPTIONAL: BoJ Server Build Trigger
@@ -16,7 +17,7 @@ jobs:
1617
runs-on: ubuntu-latest
1718
steps:
1819
- name: Checkout
19-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
20+
uses: actions/checkout@v7.0.1
2021
- name: Trigger BoJ Server (Casket/ssg-mcp)
2122
env:
2223
BOJ_URL: ${{ secrets.BOJ_SERVER_URL || vars.BOJ_SERVER_URL }}

‎.github/workflows/casket-pages.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
name: GitHub Pages
34

@@ -21,22 +22,22 @@ jobs:
2122
runs-on: ubuntu-latest
2223
steps:
2324
- name: Checkout
24-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
25+
uses: actions/checkout@v7.0.1
2526

2627
- name: Checkout casket-ssg
27-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
28+
uses: actions/checkout@v7.0.1
2829
with:
2930
repository: hyperpolymath/casket-ssg
3031
path: .casket-ssg
3132

3233
- name: Setup GHCup
33-
uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2
34+
uses: haskell-actions/setup@v2.11.0
3435
with:
3536
ghc-version: '9.8.2'
3637
cabal-version: '3.10'
3738

3839
- name: Cache Cabal
39-
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
40+
uses: actions/cache@v6.1.0
4041
with:
4142
path: |
4243
~/.cabal/packages
@@ -98,10 +99,10 @@ jobs:
9899
touch ../_site/.nojekyll
99100
100101
- name: Setup Pages
101-
uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
102+
uses: actions/configure-pages@v6.0.0
102103

103104
- name: Upload artifact
104-
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
105+
uses: actions/upload-pages-artifact@v5.0.0
105106
with:
106107
path: '_site'
107108

@@ -114,4 +115,4 @@ jobs:
114115
steps:
115116
- name: Deploy to GitHub Pages
116117
id: deployment
117-
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
118+
uses: actions/deploy-pages@v5.0.0

‎.github/workflows/codeql.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
name: CodeQL Security Analysis
34

@@ -36,15 +37,15 @@ jobs:
3637

3738
steps:
3839
- name: Checkout
39-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
40+
uses: actions/checkout@v7.0.1
4041

4142
- name: Initialize CodeQL
42-
uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v3
43+
uses: github/codeql-action/init@v4.37.4
4344
with:
4445
languages: ${{ matrix.language }}
4546
build-mode: ${{ matrix.build-mode }}
4647

4748
- name: Perform CodeQL Analysis
48-
uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v3
49+
uses: github/codeql-action/analyze@v4.37.4
4950
with:
5051
category: "/language:${{ matrix.language }}"

‎.github/workflows/dependabot-automerge.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
#
34
# dependabot-automerge.yml — enable GitHub's native auto-merge on
@@ -55,7 +56,7 @@ jobs:
5556
steps:
5657
- name: Fetch Dependabot metadata
5758
id: meta
58-
uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
59+
uses: dependabot/fetch-metadata@v3.1.0
5960
with:
6061
github-token: ${{ secrets.GITHUB_TOKEN }}
6162

‎.github/workflows/dogfood-gate.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
34
#
@@ -26,7 +27,7 @@ jobs:
2627

2728
steps:
2829
- name: Checkout repository
29-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
30+
uses: actions/checkout@v7.0.1
3031

3132
- name: Check for A2ML files
3233
id: detect
@@ -66,7 +67,7 @@ jobs:
6667

6768
steps:
6869
- name: Checkout repository
69-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
70+
uses: actions/checkout@v7.0.1
7071

7172
- name: Check for K9 files
7273
id: detect
@@ -111,7 +112,7 @@ jobs:
111112

112113
steps:
113114
- name: Checkout repository
114-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
115+
uses: actions/checkout@v7.0.1
115116

116117
- name: Scan for invisible characters
117118
id: lint
@@ -175,7 +176,7 @@ jobs:
175176

176177
steps:
177178
- name: Checkout repository
178-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
179+
uses: actions/checkout@v7.0.1
179180

180181
- name: Check for Groove manifest
181182
id: groove
@@ -235,7 +236,7 @@ jobs:
235236

236237
steps:
237238
- name: Checkout repository
238-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
239+
uses: actions/checkout@v7.0.1
239240

240241
- name: Generate dogfooding scorecard
241242
run: |

‎.github/workflows/governance.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
name: Governance
34

‎.github/workflows/hypatia-scan.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
name: Hypatia Security Scan
34

‎.github/workflows/instant-sync.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# Instant Forge Sync - Triggers propagation to all forges on push/release
34
name: Instant Sync
@@ -17,7 +18,7 @@ jobs:
1718
runs-on: ubuntu-latest
1819
steps:
1920
- name: Trigger Propagation
20-
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
21+
uses: peter-evans/repository-dispatch@v4.0.1
2122
with:
2223
token: ${{ secrets.FARM_DISPATCH_TOKEN }}
2324
repository: hyperpolymath/.git-private-farm

‎.github/workflows/mirror.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
name: Mirror to Git Forges
34

0 commit comments

Comments
 (0)