fix(ci): unbreak workflow YAML and add a complete actions.lock

[hyperpolymath]

Remediates GitHub Workflow Dependency Locking (public preview, no changelog entry), which rejects runs at startup_failure — zero jobs, no logs, nothing in REST or GraphQL. Full analysis: hyperpolymath/standards#657.

Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead → 0 startup_failure, 13 running.

Five steps, in order — each blocks the next

1. Unbreak the workflow YAML. Any permissions: carrying a scalar with an indented mapping under it:

permissions: read-all
  actions: read        # <- mapping under a scalar. Unparseable.

This reaches past the one file: gh actions-lock refuses to run when any workflow in the repo fails to parse, so the repo can never acquire a lockfile and can never self-heal.

2. Repin standards reusables off commits with no actions.lock. The rejection requires the callee to be covered at the pinned SHA — unsatisfiable at a pre-lockfile commit.

3. Generate the lockfile with gh actions-lock.

4. Hand-add the reusable-caller entries the tool omits, as '<path>': [].

⚠️ Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without — because every workflow a lockfile omits is rejected. A partial lock is worse than none. Running gh actions-lock and stopping there is how this outage spread.

5. Restore SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps via head -1.

Verified before this PR was opened

0 unparseable workflows · lockfile covers every workflow, no omissions · SPDX on line 1 in every file. The script refuses to push if any of the three fails.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c94c2ee4-693d-45dc-826e-962fb26b9af1

📥 Commits

Reviewing files that changed from the base of the PR and between 9df2286 and d3e24f4.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (26)

• .github/workflows/boj-build.yml
• .github/workflows/codeql.yml
• .github/workflows/dependabot-automerge.yml
• .github/workflows/dogfood-gate.yml
• .github/workflows/e2e.yml
• .github/workflows/estate-rules.yml
• .github/workflows/governance.yml
• .github/workflows/guix-nix-policy.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/instant-sync.yml
• .github/workflows/mirror.yml
• .github/workflows/openssf-compliance.yml
• .github/workflows/pages.yml
• .github/workflows/push-email-notify.yml
• .github/workflows/quality.yml
• .github/workflows/release.yml
• .github/workflows/rhodibot.yml
• .github/workflows/rsr-antipattern.yml
• .github/workflows/runtime-policy.yml
• .github/workflows/rust-ci.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml
• .github/workflows/security-policy.yml
• .github/workflows/static-analysis-gate.yml
• .github/workflows/wellknown-enforcement.yml
• .github/workflows/workflow-linter.yml

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated automation workflows to newer action versions and reusable workflow revisions.
  • Improved workflow permissions for required read-only access.
  • Standardised workflow action references and documented automated action management.
  • Updated security, compliance, build, release, deployment and validation automation.
  • Upgraded release, analysis, artifact and environment setup tooling.

Walkthrough

This change updates 26 GitHub Actions workflows. It adds gh actions-lock comments, replaces several SHA references with version tags, updates selected action versions, revises reusable workflow commits, and adds actions: read permissions where required.

Changes

Workflow maintenance

Layer / File(s)	Summary
Action reference updates .github/workflows/{boj-build,codeql,dependabot-automerge,dogfood-gate,guix-nix-policy,instant-sync,openssf-compliance,pages,push-email-notify,quality,release,rhodibot,rsr-antipattern,runtime-policy,security-policy,static-analysis-gate,wellknown-enforcement,workflow-linter}.yml	Action references now use version tags. Selected actions also receive major or minor version updates.
Reusable workflow permissions and revisions .github/workflows/{governance,hypatia-scan,mirror,rust-ci,scorecard,secret-scanner}.yml	Reusable workflow callers add actions: read and update referenced commit SHAs.
Workflow management annotations .github/workflows/{e2e,estate-rules}.yml	The workflows identify gh actions-lock as their manager.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit checks each workflow line
Tags replace the hashes in a tidy sign
Permissions read what actions need
Lock comments mark the files with speed
“Hop,” says the rabbit, “the updates are aligned!”

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[codacy-production]

Not up to standards ⛔

🔴 Issues 8 high

Alerts:
⚠ 8 issues (≤ 0 issues of at least minor severity)

Results:
8 new issues

Category	Results
Security	8 high

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR aims to stabilize CI workflows by fixing YAML syntax and implementing dependency locking. However, the analysis shows that the repository is currently not up to standards according to Codacy, primarily due to high-risk security practices introduced or maintained in this change.

Several workflows are pinning actions to the @main branch or reverting from immutable SHAs to mutable tags, which creates significant supply-chain risks. Additionally, a logical error in the Scorecard workflow causes a required permission to be dropped. A critical blocker for verification is that the actions.lock file mentioned in the PR title is missing from the diff, making it impossible to confirm the completeness of the locking strategy.

About this PR

• The '.github/workflows/actions.lock' file is excluded from the diff. This prevents verification of the dependency locking completeness and the manual entries for reusable callers described in the PR intent.

1 comment outside of the diff

.github/workflows/workflow-linter.yml

_{line 41 ⚪ LOW RISK}
The suggested license header in the error message (MPL-2.0) contradicts the project's actual license (AGPL-3.0-or-later) seen in other workflow files.

Test suggestions

• Verify that all workflow YAML files are parseable and valid.
• Verify that every workflow file starts with the correct SPDX license identifier.
• Verify that 'actions: read' permission is present in all workflows that call external reusables (e.g., Governance, Hypatia, Mirror).
• Verify that the 'actions.lock' file contains entries for all workflows, including manually added path entries for reusable callers.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that the 'actions.lock' file contains entries for all workflows, including manually added path entries for reusable callers.

Low confidence findings

• The diff for '.github/workflows/e2e.yml' shows 'permissions: read-all' but lacks sufficient context to verify if the syntax error (indented mapping under a scalar) has been fully resolved.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

This change replaces a previously pinned commit SHA with a version tag (v3.0.2). While tags are more readable, they are mutable—an owner of the softprops/action-gh-release repository could move the tag to point to a different commit. For workflows like release.yml that possess elevated permissions (contents: write), pinning to an immutable SHA is the recommended security best practice to prevent supply-chain attacks.

Try running the following prompt in your IDE agent:

Resolve the commit SHA for tag 'v3.0.2' of 'softprops/action-gh-release' and update its reference in .github/workflows/release.yml to use the SHA for improved security.

See Issue in Codacy

[codacy-production]

_{🔴 HIGH RISK}

Using the main branch for a third-party action is insecure as it makes your CI pipeline vulnerable to breaking changes or malicious injections if the upstream repository is compromised. Version tags or SHAs should be used instead.

Try running the following prompt in your IDE agent:

Pin the GitHub Action 'hyperpolymath/k9-ecosystem/validate-action' in .github/workflows/dogfood-gate.yml to its current commit SHA instead of the 'main' branch.

See Issue in Codacy

[codacy-production]

_{🔴 HIGH RISK}

Sourcing an action from a branch reference (@main) is a significant security risk. Unlike version tags, a branch is a moving target; any commit to the upstream repository will immediately affect your CI pipeline. Even when using a lockfile manager like actions-lock, the primary workflow definition should ideally point to a stable tag or SHA to ensure auditability and defense-in-depth.

Try running the following prompt in your IDE agent:

Pin the GitHub Action 'hyperpolymath/a2ml-ecosystem/validate-action' in .github/workflows/dogfood-gate.yml to its current commit SHA instead of the 'main' branch.

See Issue in Codacy

[codacy-production]

_{🟡 MEDIUM RISK}

The job-level permissions block for the scorecard job overrides the workflow-level declaration and omits the newly added actions: read permission. This may cause failures in the 'actions-lock' audit or the reusable workflow execution. Add actions: read to the job-level permissions block.