fix: clear the three gates tripped by the lockfile adoption - #572
Conversation
Rebuilt on current main (post-#570). Restores all inline SHA pins, re-keys actions.lock to SHA form via scripts/relock-sha-keys.py (digest-matched, subpath-aware; run after every gh actions-lock regeneration), aligns two mislabeled erlef/setup-beam pins to the real v1.24.1 SHA, and keeps the $/ local-action migration and managed-by markers. gh actions-lock --no-fix: valid, zero errors. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- SPDX header back on line 1 of all 38 workflows (the managed-by marker had displaced it; workflow security linter requires SPDX first) - check-allowed-actions.sh: treat gh actions-lock's $/ same-repo form like ./ (inherently pinned, not an allowlist gap) - relock-sha-keys: ship as bash + embedded python heredoc (same pattern as check-allowed-actions.sh) — standalone .py files are a banned language under the estate policy. End-to-end verified: fresh 'gh actions-lock' + workflow restore + this script reproduces the committed lockfile byte-for-byte. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedRestores SPDX headers, updates the action allowlist preflight script to support same-repo pinned actions, and converts the Python relock script to a bash wrapper with an embedded heredoc. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 7 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
1 participant
Follow-up to #571 (thanks for the fast merges — this closes out the board):
check-allowed-actions.shnow treats$/(gh actions-lock's inherently-pinned same-repo form) like./relock-sha-keys.py→relock-sha-keys.sh(bash + embedded python heredoc, the same patterncheck-allowed-actions.shuses; standalone.pyis a banned-language file)End-to-end verified: fresh
gh actions-lock+ workflow restore +scripts/relock-sha-keys.shreproduces the committed lockfile byte-for-byte.Expected board after this: everything green except Deno CI, which was already red on main this morning (pre-existing
k9-coordination-protocol/mcp-repo-guardianlint errors, unrelated to the lockfile work).🤖 Generated with Claude Code