From 4235141b753808c4ab49896dc645ae6c04e982b3 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 3 Aug 2026 19:22:51 +0100 Subject: [PATCH 1/3] ci: adopt GitHub Actions workflow lockfile (gh actions-lock) GitHub's new workflow-lockfile enforcement kills every workflow run in affected repos with a 0-second startup_failure ('Workflow must use a lockfile'). The enforcement follows the call graph: callers of this repo's reusable workflows (e.g. my-lang) are dying because the reusables themselves have no lockfile. Generated with gh actions-lock v0.1.6 (whole-repo pass, 38 workflows): - adds .github/workflows/actions.lock pinning every direct and transitive action dependency to an immutable commit SHA + hash - rewrites uses: refs from inline SHA pins to the readable tags the lockfile resolves (the SHA now lives in the lockfile, and tampering is caught by hash verification before the action runs) - dtolnay/rust-toolchain rewrites to @master are safe: every call site already passes an explicit 'toolchain:' input Note for future dependabot bumps: the lockfile must be regenerated (gh actions-lock) whenever an action ref changes. Co-Authored-By: Claude Fable 5 --- .github/workflows/actions.lock | 207 ++++++++++++++++++ .github/workflows/affinescript-verify.yml | 7 +- .github/workflows/boj-build.yml | 5 +- .github/workflows/casket-pages.yml | 15 +- .github/workflows/changelog-reusable.yml | 5 +- .github/workflows/changelog.yml | 1 + .github/workflows/codeql-reusable.yml | 7 +- .github/workflows/codeql.yml | 1 + .github/workflows/deno-ci-reusable.yml | 5 +- .github/workflows/deno-ci.yml | 1 + .github/workflows/doc-format.yml | 3 +- .github/workflows/dyadt-verify.yml | 3 +- .github/workflows/echidna-verify.yml | 17 +- .github/workflows/elixir-ci-reusable.yml | 11 +- .github/workflows/elixir-ci.yml | 1 + .github/workflows/governance-reusable.yml | 47 ++-- .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan-reusable.yml | 11 +- .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 3 +- .../workflows/launcher-standard-lockstep.yml | 3 +- .github/workflows/makefile-blocker.yml | 3 +- .github/workflows/mirror-reusable.yml | 29 +-- .github/workflows/mirror.yml | 1 + .github/workflows/no-js-scan.yml | 3 +- .github/workflows/pages.yml | 9 +- .github/workflows/readme-derive-reusable.yml | 3 +- .github/workflows/readme-derive.yml | 1 + .github/workflows/registry-verify.yml | 3 +- .github/workflows/rust-ci-reusable.yml | 23 +- .github/workflows/rust-ci.yml | 1 + .github/workflows/scorecard-enforcer.yml | 11 +- .github/workflows/scorecard-reusable.yml | 7 +- .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner-reusable.yml | 7 +- .github/workflows/secret-scanner.yml | 1 + .github/workflows/self-test.yml | 3 +- .github/workflows/signed-push-smoke.yml | 5 +- .github/workflows/spark-theatre-gate.yml | 3 +- 39 files changed, 357 insertions(+), 112 deletions(-) create mode 100644 .github/workflows/actions.lock diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 00000000..426714ec --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,207 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/affinescript-verify.yml': + - 'actions/checkout@v7.0.1' + - 'ocaml/setup-ocaml@v3.7.0' + '.github/workflows/boj-build.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/casket-pages.yml': + - 'actions/cache@v6.1.0' + - 'actions/checkout@v7.0.1' + - 'actions/configure-pages@v6.0.0' + - 'actions/deploy-pages@v5.0.0' + - 'actions/upload-pages-artifact@v5.0.0' + - 'haskell-actions/setup@v2.11.0' + '.github/workflows/changelog-reusable.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/codeql-reusable.yml': + - 'actions/checkout@v7.0.1' + - 'github/codeql-action@v4.37.4' + '.github/workflows/deno-ci-reusable.yml': + - 'actions/checkout@v7.0.1' + - 'denoland/setup-deno@v2.0.5' + '.github/workflows/doc-format.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/dyadt-verify.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/echidna-verify.yml': + - 'actions/cache@v6.1.0' + - 'actions/checkout@v7.0.1' + - 'actions/upload-artifact@v7.0.1' + '.github/workflows/elixir-ci-reusable.yml': + - 'actions/cache@v6.1.0' + - 'actions/checkout@v7.0.1' + - 'erlef/setup-beam@v1.24.1' + '.github/workflows/governance-reusable.yml': + - 'actions/cache@v6.1.0' + - 'actions/checkout@v7.0.1' + - 'denoland/setup-deno@v2.0.5' + - 'editorconfig-checker/action-editorconfig-checker@v2.2.0' + - 'erlef/setup-beam@v1.24.1' + '.github/workflows/hypatia-scan-reusable.yml': + - 'actions/cache@v6.1.0' + - 'actions/checkout@v7.0.1' + - 'actions/upload-artifact@v7.0.1' + - 'erlef/setup-beam@v1.24.1' + - 'github/codeql-action@v4.37.4' + '.github/workflows/instant-sync.yml': + - 'peter-evans/repository-dispatch@v4.0.1' + '.github/workflows/launcher-standard-lockstep.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/makefile-blocker.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/mirror-reusable.yml': + - 'actions/checkout@v7.0.1' + - 'dtolnay/rust-toolchain@master' + - 'webfactory/ssh-agent@v0.10.0' + '.github/workflows/no-js-scan.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/pages.yml': + - 'actions/checkout@v7.0.1' + - 'actions/deploy-pages@v5.0.0' + - 'actions/upload-pages-artifact@v5.0.0' + '.github/workflows/readme-derive-reusable.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/registry-verify.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/rust-ci-reusable.yml': + - 'actions/checkout@v7.0.1' + - 'dtolnay/rust-toolchain@master' + - 'swatinem/rust-cache@v2.9.1' + '.github/workflows/scorecard-enforcer.yml': + - 'actions/checkout@v7.0.1' + - 'actions/download-artifact@v8.0.1' + - 'actions/upload-artifact@v7.0.1' + - 'ossf/scorecard-action@v2.4.4' + '.github/workflows/scorecard-reusable.yml': + - 'actions/checkout@v7.0.1' + - 'actions/upload-artifact@v7.0.1' + - 'ossf/scorecard-action@v2.4.4' + '.github/workflows/secret-scanner-reusable.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/self-test.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/signed-push-smoke.yml': + - 'actions/checkout@v7.0.1' + - 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1' + - 'asana/push-signed-commits@6e073ae68b04d4322be613a6cabf391acb03ca44' + '.github/workflows/spark-theatre-gate.yml': + - 'actions/checkout@v7.0.1' +dependencies: + 'actions/cache@v6.1.0': + ref: 'v6.1.0' + commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' + owner_id: 44036562 + repo_id: 215566462 + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/configure-pages@v6.0.0': + ref: 'v6.0.0' + commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d' + owner_id: 44036562 + repo_id: 513659658 + 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1': + ref: 'v3.2.0' + commit: 'sha1-bcd2ba49218906704ab6c1aa796996da409d3eb1' + owner_id: 44036562 + repo_id: 642580244 + 'actions/deploy-pages@v5.0.0': + ref: 'v5.0.0' + commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128' + owner_id: 44036562 + repo_id: 438112499 + 'actions/download-artifact@v8.0.1': + ref: 'v8.0.1' + commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c' + owner_id: 44036562 + repo_id: 192626254 + 'actions/setup-python@v2': + ref: 'v2' + commit: 'sha1-e9aba2c848f5ebd159c070c61ea2c4e2b122355e' + owner_id: 44036562 + repo_id: 192625525 + 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f': + ref: 'v7.0.0' + commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-artifact@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-pages-artifact@v5.0.0': + ref: 'v5.0.0' + commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9' + owner_id: 44036562 + repo_id: 496012378 + uses: + - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + 'asana/push-signed-commits@6e073ae68b04d4322be613a6cabf391acb03ca44': + ref: 'v1.3' + commit: 'sha1-d615ca88d8e1a946734c24970d1e7a6c56f34897' + owner_id: 1472111 + repo_id: 772313726 + uses: + - 'actions/setup-python@v2' + 'denoland/setup-deno@v2.0.5': + ref: 'v2.0.5' + commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' + owner_id: 42048915 + repo_id: 356423100 + 'dtolnay/rust-toolchain@master': + ref: 'master' + commit: 'sha1-2c7215f132e9ebf062739d9130488b56d53c060c' + owner_id: 1940490 + repo_id: 260749683 + 'editorconfig-checker/action-editorconfig-checker@v2.2.0': + ref: 'v2.2.0' + commit: 'sha1-840e866d93b8e032123c23bac69dece044d4d84c' + owner_id: 26415196 + repo_id: 297874902 + 'erlef/setup-beam@v1.24.1': + ref: 'v1.24.1' + commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' + owner_id: 47606891 + repo_id: 331103973 + 'github/codeql-action@v4.37.4': + ref: 'v4.37.4' + commit: 'sha1-f205ea1c3313d32999d8d6a48b4f6530d4437b38' + owner_id: 9919 + repo_id: 259445878 + 'haskell-actions/setup@v2.11.0': + ref: 'v2.11.0' + commit: 'sha1-cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553' + owner_id: 75048950 + repo_id: 623796603 + 'ocaml/setup-ocaml@v3.7.0': + ref: 'v3.7.0' + commit: 'sha1-15d660006c1d3110d77c34b7faa3bddefe8b82f0' + owner_id: 1841483 + repo_id: 220799100 + 'ossf/scorecard-action@v2.4.4': + ref: 'v2.4.4' + commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' + owner_id: 67707773 + repo_id: 421101922 + 'peter-evans/repository-dispatch@v4.0.1': + ref: 'v4.0.1' + commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697' + owner_id: 18365890 + repo_id: 220359305 + 'swatinem/rust-cache@v2.9.1': + ref: 'v2.9.1' + commit: 'sha1-c19371144df3bb44fab255c43d04cbc2ab54d1c4' + owner_id: 580492 + repo_id: 298565987 + 'webfactory/ssh-agent@v0.10.0': + ref: 'v0.10.0' + commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555' + owner_id: 135788 + repo_id: 208510314 diff --git a/.github/workflows/affinescript-verify.yml b/.github/workflows/affinescript-verify.yml index 15ab10d0..8346129b 100644 --- a/.github/workflows/affinescript-verify.yml +++ b/.github/workflows/affinescript-verify.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: AffineScript Verify # Direct pushes only on integration branches. Feature-branch validation @@ -52,7 +53,7 @@ jobs: contents: read steps: - name: Checkout standards - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 @@ -89,7 +90,7 @@ jobs: # advisory: compiler checkout is report-only until the port backlog # is cleared and BLOCKING flips to true. continue-on-error: true - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: ${{ env.COMPILER_REPO }} ref: ${{ env.COMPILER_REF }} @@ -100,7 +101,7 @@ jobs: # advisory: setup failures should surface as signal without blocking # unrelated standards changes while AffineScript verification matures. continue-on-error: true - uses: ocaml/setup-ocaml@15d660006c1d3110d77c34b7faa3bddefe8b82f0 # v3 + uses: ocaml/setup-ocaml@v3.7.0 with: ocaml-compiler: "5.1" diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index c9ad95ee..5c928a24 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # # OPTIONAL: BoJ Server Build Trigger @@ -36,7 +37,7 @@ jobs: # when unconfigured. steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Trigger BoJ Server (Casket/ssg-mcp) env: @@ -71,7 +72,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: K9-SVC Validation run: | diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index adf9add1..29526ed6 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: GitHub Pages @@ -22,22 +23,22 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 - name: Checkout casket-ssg - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/casket-ssg path: .casket-ssg - name: Setup GHCup - uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2.11.0 + uses: haskell-actions/setup@v2.11.0 with: ghc-version: '9.8.2' cabal-version: '3.10' - name: Cache Cabal - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4 + uses: actions/cache@v6.1.0 with: path: | ~/.cabal/packages @@ -81,10 +82,10 @@ jobs: cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site - name: Setup Pages - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 + uses: actions/configure-pages@v6.0.0 - name: Upload artifact - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v3 + uses: actions/upload-pages-artifact@v5.0.0 with: path: '_site' @@ -98,4 +99,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 + uses: actions/deploy-pages@v5.0.0 diff --git a/.github/workflows/changelog-reusable.yml b/.github/workflows/changelog-reusable.yml index 98b45677..d4567a5b 100644 --- a/.github/workflows/changelog-reusable.yml +++ b/.github/workflows/changelog-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) # @@ -61,7 +62,7 @@ jobs: pull-requests: write steps: - name: Checkout caller repository (full history) - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} ref: ${{ github.ref }} @@ -69,7 +70,7 @@ jobs: path: caller - name: Checkout standards (for canonical cliff.toml) - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/standards ref: main diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index f41bf2c8..7d2a6bf5 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Changelog diff --git a/.github/workflows/codeql-reusable.yml b/.github/workflows/codeql-reusable.yml index e43ad21d..6fef1edb 100644 --- a/.github/workflows/codeql-reusable.yml +++ b/.github/workflows/codeql-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # codeql-reusable.yml — Reusable CodeQL security-analysis workflow. # @@ -87,15 +88,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v3 + uses: github/codeql-action/init@v4.37.4 with: languages: ${{ inputs.language }} build-mode: ${{ inputs.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v3 + uses: github/codeql-action/analyze@v4.37.4 with: category: "/language:${{ inputs.language }}" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1ad033ba..23630107 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: CodeQL Security Analysis diff --git a/.github/workflows/deno-ci-reusable.yml b/.github/workflows/deno-ci-reusable.yml index 7232051d..f3514a54 100644 --- a/.github/workflows/deno-ci-reusable.yml +++ b/.github/workflows/deno-ci-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # deno-ci-reusable.yml — Reusable Deno CI bundle (RSR). # @@ -58,12 +59,12 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} ref: ${{ github.ref }} - - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5 + - uses: denoland/setup-deno@v2.0.5 with: deno-version: ${{ inputs.deno-version }} diff --git a/.github/workflows/deno-ci.yml b/.github/workflows/deno-ci.yml index 17c886f6..bdfcaebd 100644 --- a/.github/workflows/deno-ci.yml +++ b/.github/workflows/deno-ci.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Deno CI diff --git a/.github/workflows/doc-format.yml b/.github/workflows/doc-format.yml index ecaf690c..024b6058 100644 --- a/.github/workflows/doc-format.yml +++ b/.github/workflows/doc-format.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Documentation Format Enforcement @@ -26,7 +27,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 - name: Check for duplicate documentation formats run: | diff --git a/.github/workflows/dyadt-verify.yml b/.github/workflows/dyadt-verify.yml index 6cdb3e36..ca7c5af2 100644 --- a/.github/workflows/dyadt-verify.yml +++ b/.github/workflows/dyadt-verify.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # dyadt-verify — DYADT dogfood. Verify this repo's CLAIMS.a2ml against primary # evidence, and run the DYADT conformance vector suite. If a claim this change @@ -26,7 +27,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 # need origin/main as the DYADT diff base diff --git a/.github/workflows/echidna-verify.yml b/.github/workflows/echidna-verify.yml index d33a1a7f..ddeffe12 100644 --- a/.github/workflows/echidna-verify.yml +++ b/.github/workflows/echidna-verify.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # ECHIDNA proof verification — formal verification of Agda and Idris2 proofs. # @@ -48,7 +49,7 @@ jobs: timeout-minutes: 20 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: submodules: recursive @@ -77,7 +78,7 @@ jobs: - name: Upload log if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@v7.0.1 with: name: agda-verify-log path: agda-verify.log @@ -89,12 +90,12 @@ jobs: timeout-minutes: 20 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: submodules: recursive - name: Cache pack - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4 + uses: actions/cache@v6.1.0 with: path: | ~/.pack @@ -145,7 +146,7 @@ jobs: - name: Upload log if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@v7.0.1 with: name: idris2-a2ml-log path: idris2-a2ml.log @@ -157,12 +158,12 @@ jobs: timeout-minutes: 20 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: submodules: recursive - name: Cache pack - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4 + uses: actions/cache@v6.1.0 with: path: | ~/.pack @@ -212,7 +213,7 @@ jobs: - name: Upload log if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@v7.0.1 with: name: idris2-avow-log path: idris2-avow.log diff --git a/.github/workflows/elixir-ci-reusable.yml b/.github/workflows/elixir-ci-reusable.yml index 23d6a76b..03f2a558 100644 --- a/.github/workflows/elixir-ci-reusable.yml +++ b/.github/workflows/elixir-ci-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # elixir-ci-reusable.yml — Reusable Elixir CI bundle (RSR). # @@ -129,7 +130,7 @@ jobs: has_mix: ${{ steps.detect.outputs.has_mix }} steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} ref: ${{ github.ref }} @@ -157,26 +158,26 @@ jobs: working-directory: ${{ inputs.working_directory }} steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} ref: ${{ github.ref }} - name: Set up BEAM (OTP + Elixir) - uses: erlef/setup-beam@8736e9244717f9207464c14c6051b71d22253f60 # v1.24.1 + uses: erlef/setup-beam@v1.24.1 with: otp-version: ${{ inputs.otp-version }} elixir-version: ${{ inputs.elixir-version }} rebar3-version: ${{ inputs.rebar3-version }} - name: Cache deps - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6.1.0 with: path: ${{ inputs.working_directory }}/deps key: deps-${{ inputs.elixir-version }}-${{ hashFiles(format('{0}/mix.lock', inputs.working_directory)) }} - name: Cache _build - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6.1.0 with: path: ${{ inputs.working_directory }}/_build key: build-${{ inputs.elixir-version }}-${{ hashFiles(format('{0}/mix.lock', inputs.working_directory)) }} diff --git a/.github/workflows/elixir-ci.yml b/.github/workflows/elixir-ci.yml index 2f851c2f..36f86a0d 100644 --- a/.github/workflows/elixir-ci.yml +++ b/.github/workflows/elixir-ci.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Elixir CI diff --git a/.github/workflows/governance-reusable.yml b/.github/workflows/governance-reusable.yml index a682b88f..f3764cd2 100644 --- a/.github/workflows/governance-reusable.yml +++ b/.github/workflows/governance-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Governance checks for hyperpolymath repositories — Reusable Workflow name: Governance Reusable Workflow @@ -24,7 +25,7 @@ jobs: has_baseline: ${{ steps.check.outputs.has_baseline }} steps: - name: Checkout caller repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Check baseline existence id: check @@ -66,13 +67,13 @@ jobs: contents: read steps: - name: Checkout caller repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} ref: ${{ github.sha }} - name: Checkout standards for the allowlist gate - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/standards ref: main @@ -105,12 +106,12 @@ jobs: timeout-minutes: 15 steps: - name: Checkout caller repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - name: Setup Elixir for Hypatia scanner - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 + uses: erlef/setup-beam@v1.24.1 with: elixir-version: '1.19.4' otp-version: '28.3' @@ -130,7 +131,7 @@ jobs: echo "Resolved hypatia HEAD: $sha" - name: Cache Hex/Mix and Scanner Build - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6.1.0 with: path: | ~/.mix @@ -163,7 +164,7 @@ jobs: # mirroring the language-policy job below. Pinned to main because # github.workflow_sha resolves to the *caller* repo's SHA (which would 404). - name: Check out standards for the baseline filter - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/standards ref: main @@ -229,7 +230,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} # Pin to the concrete event SHA (the PR merge commit on @@ -260,12 +261,12 @@ jobs: # version and the script version — acceptable since scripts here # are read-only governance checks. - name: Set up Deno - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5 + uses: denoland/setup-deno@v2.0.5 with: deno-version: v2.x - name: Check out standards repo for shared scripts - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/standards ref: main @@ -574,7 +575,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} # Pin to the concrete event SHA (the PR merge commit on @@ -591,7 +592,7 @@ jobs: # scripts. Sparse-check-out standards' scripts/ to get # check-package-policy.sh, mirroring the baseline-filter job above. - name: Check out standards for the package-policy gate - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/standards ref: main @@ -617,7 +618,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} # Pin to the concrete event SHA (the PR merge commit on @@ -856,7 +857,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} # Pin to the concrete event SHA (the PR merge commit on @@ -885,14 +886,14 @@ jobs: continue-on-error: true # advisory: informational only; repos can opt into blocking locally - name: EditorConfig check - uses: editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c # v2.2.0 + uses: editorconfig-checker/action-editorconfig-checker@v2.2.0 # advisory: formatting hygiene is reported from the reusable estate # bundle; repos opt into blocking formatter checks locally when ready. continue-on-error: true # Sparse-check-out standards' scripts/ for the docs gate (a reusable # workflow only auto-checks-out its own YAML, not sibling scripts). - name: Check out standards for the docs gate - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/standards ref: main @@ -918,7 +919,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} # Pin to the concrete event SHA (the PR merge commit on @@ -984,7 +985,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} # Pin to the concrete event SHA (the PR merge commit on @@ -1027,7 +1028,7 @@ jobs: # files. An unresolvable `uses:` yields NO check run, so those repos look # green while the job never ran. This step closes that gap. - name: Checkout standards for the pin-existence gate - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/standards ref: main @@ -1061,7 +1062,7 @@ jobs: contents: read steps: - name: Checkout caller repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} # Pin to the concrete event SHA (the PR merge commit on @@ -1075,7 +1076,7 @@ jobs: ref: ${{ github.sha }} path: caller - name: Checkout standards (for the check script) - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/standards ref: main @@ -1092,7 +1093,7 @@ jobs: contents: read steps: - name: Checkout caller repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} # Pin to the concrete event SHA (the PR merge commit on @@ -1106,7 +1107,7 @@ jobs: ref: ${{ github.sha }} path: caller - name: Checkout standards (for the check script) - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/standards ref: main diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index c9f7c68f..910ff38f 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Governance diff --git a/.github/workflows/hypatia-scan-reusable.yml b/.github/workflows/hypatia-scan-reusable.yml index 6cdfaa3f..3311a8af 100644 --- a/.github/workflows/hypatia-scan-reusable.yml +++ b/.github/workflows/hypatia-scan-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Hypatia Neurosymbolic CI/CD Security Scan — Reusable Workflow name: Hypatia Reusable Scan @@ -17,12 +18,12 @@ jobs: timeout-minutes: 20 steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - name: Setup Elixir for Hypatia scanner - uses: erlef/setup-beam@8736e9244717f9207464c14c6051b71d22253f60 # v1.24.1 + uses: erlef/setup-beam@v1.24.1 with: elixir-version: '1.19.4' otp-version: '28.3' @@ -42,7 +43,7 @@ jobs: echo "Resolved hypatia HEAD: $sha" - name: Cache Hex/Mix and Scanner Build - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6.1.0 with: path: | ~/.mix @@ -132,7 +133,7 @@ jobs: # This flag only tolerates a genuine upload failure (e.g. Advanced # Security disabled on a private repo) once the job is actually running. continue-on-error: true - uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v3 + uses: github/codeql-action/upload-sarif@v4.37.4 with: sarif_file: hypatia.sarif category: hypatia @@ -149,7 +150,7 @@ jobs: - name: Upload findings artifacts if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@v7.0.1 with: name: hypatia-scan-findings path: | diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index f0b2ba64..9627bfa6 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Hypatia Security Scan diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index c7278537..930c8296 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync @@ -40,7 +41,7 @@ jobs: # propagated, instead of red-ing main on every push. - name: Trigger Propagation if: ${{ env.FARM_DISPATCH_TOKEN != '' }} - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3 + uses: peter-evans/repository-dispatch@v4.0.1 with: token: ${{ secrets.FARM_DISPATCH_TOKEN }} repository: hyperpolymath/.git-private-farm diff --git a/.github/workflows/launcher-standard-lockstep.yml b/.github/workflows/launcher-standard-lockstep.yml index b9c6c085..ebae77b2 100644 --- a/.github/workflows/launcher-standard-lockstep.yml +++ b/.github/workflows/launcher-standard-lockstep.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: launcher-standard lock-step @@ -32,7 +33,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout (full history for base/head diff) - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/makefile-blocker.yml b/.github/workflows/makefile-blocker.yml index 2bc3b631..0faca0ce 100644 --- a/.github/workflows/makefile-blocker.yml +++ b/.github/workflows/makefile-blocker.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Makefile Blocker @@ -32,7 +33,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 - name: Fail on Makefile presence run: | diff --git a/.github/workflows/mirror-reusable.yml b/.github/workflows/mirror-reusable.yml index 79a6b503..f6103176 100644 --- a/.github/workflows/mirror-reusable.yml +++ b/.github/workflows/mirror-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # mirror-reusable.yml — Reusable git-forge mirror bundle. # @@ -59,10 +60,10 @@ jobs: env: GITLAB_KEY: ${{ secrets.GITLAB_SSH_KEY }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 + - uses: webfactory/ssh-agent@v0.10.0 if: ${{ env.GITLAB_KEY != '' }} with: ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }} @@ -92,10 +93,10 @@ jobs: env: BITBUCKET_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 + - uses: webfactory/ssh-agent@v0.10.0 if: ${{ env.BITBUCKET_KEY != '' }} with: ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }} @@ -119,10 +120,10 @@ jobs: env: CODEBERG_KEY: ${{ secrets.CODEBERG_SSH_KEY }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 + - uses: webfactory/ssh-agent@v0.10.0 if: ${{ env.CODEBERG_KEY != '' }} with: ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }} @@ -146,10 +147,10 @@ jobs: env: SOURCEHUT_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 + - uses: webfactory/ssh-agent@v0.10.0 if: ${{ env.SOURCEHUT_KEY != '' }} with: ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }} @@ -173,10 +174,10 @@ jobs: env: DISROOT_KEY: ${{ secrets.DISROOT_SSH_KEY }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 + - uses: webfactory/ssh-agent@v0.10.0 if: ${{ env.DISROOT_KEY != '' }} with: ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }} @@ -200,10 +201,10 @@ jobs: env: GITEA_KEY: ${{ secrets.GITEA_SSH_KEY }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 + - uses: webfactory/ssh-agent@v0.10.0 if: ${{ env.GITEA_KEY != '' }} with: ssh-private-key: ${{ secrets.GITEA_SSH_KEY }} @@ -229,7 +230,7 @@ jobs: env: RADICLE_KEY: ${{ secrets.RADICLE_KEY }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 # All Radicle steps gate on secrets.RADICLE_KEY being set on the @@ -244,7 +245,7 @@ jobs: # answers "are we configured to actually do it?". - name: Setup Rust if: ${{ env.RADICLE_KEY != '' }} - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable + uses: dtolnay/rust-toolchain@master with: toolchain: stable - name: Install Radicle diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index c25d3bcb..08901e08 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Mirror to Git Forges diff --git a/.github/workflows/no-js-scan.yml b/.github/workflows/no-js-scan.yml index cfd77d0b..fcb59053 100644 --- a/.github/workflows/no-js-scan.yml +++ b/.github/workflows/no-js-scan.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: No-JS Scan (warn-first) @@ -41,7 +42,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 - name: Report authored JS/TS (warn-first, non-blocking) shell: bash diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 31f3ddc2..c97b9382 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: GitHub Pages (Ddraig SSG) on: @@ -20,9 +21,9 @@ jobs: image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff steps: - name: Checkout Site - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Checkout Ddraig SSG - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/ddraig-ssg path: .ddraig-ssg @@ -39,7 +40,7 @@ jobs: fi ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/} - name: Upload artifact - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 + uses: actions/upload-pages-artifact@v5.0.0 with: path: '_site' deploy: @@ -52,4 +53,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 + uses: actions/deploy-pages@v5.0.0 diff --git a/.github/workflows/readme-derive-reusable.yml b/.github/workflows/readme-derive-reusable.yml index e6ec627d..e9c7617b 100644 --- a/.github/workflows/readme-derive-reusable.yml +++ b/.github/workflows/readme-derive-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # README single-source derivation — Reusable Workflow (ADR-004) # @@ -45,7 +46,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout caller repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 - name: Read publishing declaration id: decl diff --git a/.github/workflows/readme-derive.yml b/.github/workflows/readme-derive.yml index 4a0e5376..7d511c6f 100644 --- a/.github/workflows/readme-derive.yml +++ b/.github/workflows/readme-derive.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: README Derive diff --git a/.github/workflows/registry-verify.yml b/.github/workflows/registry-verify.yml index dd0bd245..c1ed8c0d 100644 --- a/.github/workflows/registry-verify.yml +++ b/.github/workflows/registry-verify.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # registry-verify — fail the build if the spec registry or the DERIVED # topology map has drifted from the file tree. This is the in-repo half of @@ -26,7 +27,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 # full history so `git ls-files -s` hashes are stable diff --git a/.github/workflows/rust-ci-reusable.yml b/.github/workflows/rust-ci-reusable.yml index f4c3ba51..e8d5c5e2 100644 --- a/.github/workflows/rust-ci-reusable.yml +++ b/.github/workflows/rust-ci-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # rust-ci-reusable.yml — Reusable Rust CI bundle (RSR). # @@ -128,7 +129,7 @@ jobs: has_cargo: ${{ steps.detect.outputs.has_cargo }} steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} ref: ${{ github.ref }} @@ -154,7 +155,7 @@ jobs: working-directory: ${{ inputs.working_directory }} steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} ref: ${{ github.ref }} @@ -165,13 +166,13 @@ jobs: # `@stable`), but a SHA ref carries no version, so the action's "parse # toolchain version" step fails with `'toolchain' is a required input`. # See standards estate-wide rust-ci red. - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable + uses: dtolnay/rust-toolchain@master with: toolchain: stable components: clippy, rustfmt - name: Cache cargo registry and build - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 + uses: Swatinem/rust-cache@v2.9.1 with: workspaces: ${{ inputs.working_directory }} @@ -201,19 +202,19 @@ jobs: working-directory: ${{ inputs.working_directory }} steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} ref: ${{ github.ref }} - name: Install Rust toolchain # `toolchain:` mandatory under SHA pin — see Cargo check job above. - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable + uses: dtolnay/rust-toolchain@master with: toolchain: stable - name: Cache cargo registry and build - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 + uses: Swatinem/rust-cache@v2.9.1 with: workspaces: ${{ inputs.working_directory }} @@ -244,14 +245,14 @@ jobs: working-directory: ${{ inputs.working_directory }} steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} ref: ${{ github.ref }} - name: Install Rust toolchain # `toolchain:` mandatory under SHA pin — see Cargo check job above. - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable + uses: dtolnay/rust-toolchain@master with: toolchain: stable @@ -280,14 +281,14 @@ jobs: FLOOR: ${{ inputs.coverage_floor }} steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: ${{ github.repository }} ref: ${{ github.ref }} - name: Install Rust toolchain # `toolchain:` mandatory under SHA pin — see Cargo check job above. - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable + uses: dtolnay/rust-toolchain@master with: toolchain: stable components: llvm-tools-preview diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 66e8c03e..751e7e03 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Rust CI diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml index b489d79e..23230262 100644 --- a/.github/workflows/scorecard-enforcer.yml +++ b/.github/workflows/scorecard-enforcer.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - runs OpenSSF Scorecard and fails on low scores name: OpenSSF Scorecard Enforcer @@ -21,18 +22,18 @@ jobs: security-events: write id-token: write # For OIDC steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Run Scorecard - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + uses: ossf/scorecard-action@v2.4.4 with: results_file: results.json results_format: json publish_results: true - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@v7.0.1 with: name: scorecard-results path: results.json @@ -43,7 +44,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@v8.0.1 with: name: scorecard-results @@ -66,7 +67,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: Check SECURITY.md exists run: | diff --git a/.github/workflows/scorecard-reusable.yml b/.github/workflows/scorecard-reusable.yml index 2cb90dc2..5a367766 100644 --- a/.github/workflows/scorecard-reusable.yml +++ b/.github/workflows/scorecard-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: OSSF Scorecard Reusable Workflow @@ -18,19 +19,19 @@ jobs: id-token: write steps: - name: Checkout code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Run Scorecard Analysis - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + uses: ossf/scorecard-action@v2.4.4 with: results_file: results.json results_format: json publish_results: true - name: Upload results artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@v7.0.1 with: name: scorecard-results path: results.json diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index fad266ef..dbffff92 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Scorecard diff --git a/.github/workflows/secret-scanner-reusable.yml b/.github/workflows/secret-scanner-reusable.yml index 33fd59c1..9dc9b284 100644 --- a/.github/workflows/secret-scanner-reusable.yml +++ b/.github/workflows/secret-scanner-reusable.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # secret-scanner-reusable.yml — Reusable secret-scanner bundle. # @@ -110,7 +111,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 # Gitleaks runs as a pinned, checksum-verified binary rather than via # gitleaks/gitleaks-action. The action injects gitleaks into the runner @@ -291,7 +292,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: Check for hardcoded secrets in Rust env: @@ -452,7 +453,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: Check for hardcoded secrets in shell scripts run: | diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 8f4287a2..3e7e3341 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Secret Scanner diff --git a/.github/workflows/self-test.yml b/.github/workflows/self-test.yml index 1098d356..b1d1dec9 100644 --- a/.github/workflows/self-test.yml +++ b/.github/workflows/self-test.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # self-test — run this repo's own test suite. # @@ -32,7 +33,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 # PyYAML is required by the secret-scanner canary, which extracts the # shipping step body from the reusable rather than testing a copy. diff --git a/.github/workflows/signed-push-smoke.yml b/.github/workflows/signed-push-smoke.yml index caa6883c..e2b6303b 100644 --- a/.github/workflows/signed-push-smoke.yml +++ b/.github/workflows/signed-push-smoke.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # End-to-end check for the signed-push composite action: pushes a throwaway commit # via the GitHub App and asserts GitHub marks it "Verified". Manual trigger only. @@ -24,7 +25,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 @@ -49,7 +50,7 @@ jobs: git commit -m "test(signed-push): verified-commit smoke [run ${GITHUB_RUN_ID}]" - name: Push the local commit as Verified (via the App) - uses: ./.github/actions/signed-push + uses: $/.github/actions/signed-push with: app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml index 0f937ead..6af70e16 100644 --- a/.github/workflows/spark-theatre-gate.yml +++ b/.github/workflows/spark-theatre-gate.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: SPARK Theatre Gate @@ -65,7 +66,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Scan for SPARK proof theatre env: From 20f3cc2806afc7b44620f608e6c446313910eda5 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 3 Aug 2026 19:29:57 +0100 Subject: [PATCH 2/3] fix: repair phantom Asana/push-signed-commits pin; rebuild lockfile The signed-push composite pinned Asana/push-signed-commits@6e073ae which does not exist upstream (the estate's known phantom-SHA class). gh actions-lock v0.1.6 half-tolerates it: it keys the lockfile entry by the phantom ref but records the real v1.3 commit (d615ca8) as digest, making the lockfile fail its own validation ('pin key ref is a full SHA but commit digest does not match'). Re-pin to the real v1.3 SHA and rebuild; the lockfile now passes 'gh actions-lock --no-fix' cleanly. Co-Authored-By: Claude Fable 5 --- .github/actions/signed-push/action.yml | 2 +- .github/workflows/actions.lock | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/actions/signed-push/action.yml b/.github/actions/signed-push/action.yml index eb31586f..465173f5 100644 --- a/.github/actions/signed-push/action.yml +++ b/.github/actions/signed-push/action.yml @@ -39,7 +39,7 @@ runs: # and auto-marks the resulting commits as "Verified". A PAT would leave them # Unverified — which is why this must be an App token, not GITHUB_TOKEN/PAT. - name: Push local commits as Verified - uses: Asana/push-signed-commits@6e073ae68b04d4322be613a6cabf391acb03ca44 # v1 + uses: Asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897 # v1.3 with: github-token: ${{ steps.app-token.outputs.token }} local_branch_name: ${{ steps.branch.outputs.name }} diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 426714ec..e461e1cb 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -87,7 +87,7 @@ workflows: '.github/workflows/signed-push-smoke.yml': - 'actions/checkout@v7.0.1' - 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1' - - 'asana/push-signed-commits@6e073ae68b04d4322be613a6cabf391acb03ca44' + - 'asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897' '.github/workflows/spark-theatre-gate.yml': - 'actions/checkout@v7.0.1' dependencies: @@ -143,7 +143,7 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' - 'asana/push-signed-commits@6e073ae68b04d4322be613a6cabf391acb03ca44': + 'asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897': ref: 'v1.3' commit: 'sha1-d615ca88d8e1a946734c24970d1e7a6c56f34897' owner_id: 1472111 From ff130c36aa7e4e4d138e376bab15cb4c882caf3e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 3 Aug 2026 19:32:21 +0100 Subject: [PATCH 3/3] chore: regenerate registry after workflow changes (Registry Verify drift gate) Co-Authored-By: Claude Fable 5 --- .machine_readable/REGISTRY.a2ml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.machine_readable/REGISTRY.a2ml b/.machine_readable/REGISTRY.a2ml index 52ae7325..5107c3aa 100644 --- a/.machine_readable/REGISTRY.a2ml +++ b/.machine_readable/REGISTRY.a2ml @@ -45,7 +45,7 @@ name = "A2ML — Attested Markup Language" stream = "foundation" home = "a2ml/" canonical_doc = "a2ml/README.adoc" -source_hash = "sha256:3409e79367d002ba52f4ed1742b2846c1beffdf8acf78c53997a69a32bd46617" +source_hash = "sha256:cedda748a39bbc6016c8548193b844fc028e8822883bc54ef01a905dfa63dc64" route = "the typed/verified machine-readable document format" [[spec]] @@ -189,7 +189,7 @@ name = "ARG — Adoption Readiness Grades" stream = "readiness" home = "adoption-readiness-grades/" canonical_doc = "adoption-readiness-grades/README.adoc" -source_hash = "sha256:77e3c0d74e9fd037b57dc883804501be1117ac12534d3d817654f2c96919a0e8" +source_hash = "sha256:8943491cf3991b8c6fd5a53bd83657c63978592510cbe79996b4034ab34ae40d" route = "per-language adoption-maturity profile templates" [[spec]] @@ -225,7 +225,7 @@ name = "RSR — Rhodium Standard Repositories" stream = "governance" home = "rhodium-standard-repositories/" canonical_doc = "rhodium-standard-repositories/README.adoc" -source_hash = "sha256:03252ce83c0361887c6a96530c8bba15c4c7f816c07d6d2ffbffd53250e3bf61" +source_hash = "sha256:8fed9183e492705f17d40cc9a4394578ca1de909ba8233160600dc19cfdc939d" route = "the repository-compliance standard every repo is graded against" [[spec]] @@ -269,8 +269,8 @@ id = "publication-pre-flight" name = "Publication Pre-Flight" stream = "governance" home = "publication-pre-flight/" -canonical_doc = "publication-pre-flight/ESTATE-AUDIT-BASELINE-2026-03-30.adoc" -source_hash = "sha256:8e1f3bb0515e80636046332b99639346655d87412e1f2f3613903854213025a1" +canonical_doc = "publication-pre-flight/HOL-SUITABILITY-CHECKLIST.adoc" +source_hash = "sha256:86e93a00784d646d99dcaf412efc3d647a02ff7ac2e38cc1f94c1d6bc775c188" route = "submission gate (HOL + Zenodo checklists)" [[spec]]