fix(ci): unbreak workflow YAML and add a complete actions.lock

[hyperpolymath]

Remediates GitHub Workflow Dependency Locking (public preview, no changelog entry), which rejects runs at startup_failure — zero jobs, no logs, nothing in REST or GraphQL. Full analysis: hyperpolymath/standards#657.

Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead → 0 startup_failure, 13 running.

Five steps, in order — each blocks the next

1. Unbreak the workflow YAML. Any permissions: carrying a scalar with an indented mapping under it:

permissions: read-all
  actions: read        # <- mapping under a scalar. Unparseable.

This reaches past the one file: gh actions-lock refuses to run when any workflow in the repo fails to parse, so the repo can never acquire a lockfile and can never self-heal.

2. Repin standards reusables off commits with no actions.lock. The rejection requires the callee to be covered at the pinned SHA — unsatisfiable at a pre-lockfile commit.

3. Generate the lockfile with gh actions-lock.

4. Hand-add the reusable-caller entries the tool omits, as '<path>': [].

⚠️ Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without — because every workflow a lockfile omits is rejected. A partial lock is worse than none. Running gh actions-lock and stopping there is how this outage spread.

5. Restore SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps via head -1.

Verified before this PR was opened

0 unparseable workflows · lockfile covers every workflow, no omissions · SPDX on line 1 in every file. The script refuses to push if any of the three fails.

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b1282565-81f8-4cbe-967d-d739ee6a6edd

📥 Commits

Reviewing files that changed from the base of the PR and between d34c7c0 and 728356d.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/lean.yml
• .github/workflows/push-email-notify.yml
• .github/workflows/secret-scanner.yml

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated automated governance, security scanning, notification, and build workflows.
  • Improved workflow permission settings for safer action execution.
  • Updated workflow action versions and references for consistency and maintenance.
  • Added workflow management annotations to support ongoing maintenance.

Walkthrough

The workflows add actions: read permissions, update reusable workflow revisions, pin checkout to v4.4.0, change the mail action to v3.12.0, and identify files managed by gh actions-lock.

Changes

Workflow maintenance

Layer / File(s)	Summary
Reusable workflow permissions and revisions .github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/secret-scanner.yml	These workflows add actions: read, use commit 84355587cb2a1f86e6882de83514a32db2646e7a, and include gh actions-lock management comments.
Direct action references .github/workflows/lean.yml, .github/workflows/push-email-notify.yml	The checkout action is pinned to v4.4.0. The mail action uses v3.12.0. Both workflows include gh actions-lock management comments.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: metadatastician

Poem

A rabbit checks the workflow gate

Read permissions now align their state
Pins are neat and versions clear
Action-lock notes appear here
Green hops guide the changes straight

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[codacy-production]

Not up to standards ⛔

🔴 Issues 1 high

Alerts:
⚠ 1 issue (≤ 0 issues of at least minor severity)

Results:
1 new issue

Category	Results
Security	1 high

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR aims to resolve GitHub Action startup failures and implement dependency locking. However, Codacy reports the changes are not up to standards. Key concerns include a security regression where third-party actions were reverted from immutable commit SHAs to mutable version tags, and a missing permission in the secret scanner workflow that prevents findings from being reported to the repository's security tab.

There is a notable discrepancy between the PR intent and the provided changes: the primary artifact, .github/workflows/actions.lock, is missing from the file list, and the YAML syntax fixes mentioned in the description are not clearly visible in the diff. These gaps should be addressed before the PR is merged.

About this PR

• The .github/workflows/actions.lock file is excluded from the provided code changes. This makes it impossible to verify the claim that it is 'complete' or that it includes the manually added entries required for reusable workflows.

Test suggestions

• Verify that 'SPDX-License-Identifier' is on line 1 of every modified workflow.
• Verify that 'actions: read' permission is present in workflows using external/reusable actions.
• Confirm that actions are pinned to specific versions.
• Verify that the actions.lock file contains entries for all workflows including manual caller entries.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that the `actions.lock` file contains entries for all workflows including manual caller entries.

Low confidence findings

• The PR description mentions fixing unparseable YAML where mappings were nested under scalars, but the provided diff only shows additions/updates to existing blocks rather than the removal of the invalid syntax.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

Pinning third-party actions to a full-length commit SHA ensures that the workflow is immutable and protected against tag-switching or malicious updates to the action's repository. Reverting from a SHA to a version tag removes this safeguard. It is recommended to identify the commit SHA associated with the desired version and use that instead.

See Issue in Codacy

[codacy-production]

_{🟡 MEDIUM RISK}

The workflow is missing the security-events: write permission. Since this is a security scan intended to report findings, it requires write access to the security events scope to upload SARIF data. Current permissions are insufficient for this integration.