fix(ci): unbreak workflow YAML and add a complete actions.lock - #51
Conversation
Remediates GitHub Workflow Dependency Locking (public preview), which rejects runs at startup_failure with zero jobs and no logs. See hyperpolymath/standards#657. Five steps, in order, because each blocks the next: 1. Unbroke any workflow whose `permissions:` carried a scalar with an indented mapping under it - blind-permissions-insertion damage. This matters beyond the one file: gh actions-lock refuses to run when ANY workflow in the repo fails to parse, so the repo could never acquire a lockfile and could never self-heal. 2. Repinned hyperpolymath/standards reusables off commits that have no actions.lock. The rejection requires the CALLEE to be covered at the pinned SHA, which is unsatisfiable at a pre-lockfile commit. 3. Generated the lockfile with gh actions-lock. 4. Hand-added the reusable-workflow caller entries the tool omits, as '<path>': []. Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without, because every workflow a lockfile OMITS is rejected. A PARTIAL lock is worse than none - running gh actions-lock and stopping there is how this outage spread. 5. Restored SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps with head -1. Verified before push: 0 unparseable workflows, lockfile covers every workflow with no omissions, SPDX on line 1 in every file. Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead -> 0 startup_failure, 13 running. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (8)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe pull request adds ChangesWorkflow metadata
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested reviewers: Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
This PR successfully addresses GitHub Actions startup failures by generating a complete actions.lock file and ensuring workflows are properly pinned. The Codacy analysis confirms the code is up to standards with no new quality issues.
However, a consistent nitpick was identified regarding the duplication of the '# This workflow is managed by gh actions-lock.' comment on consecutive lines across multiple files. Additionally, while the PR description mentions fixing a 'scalar with indented mapping' YAML error, the provided diffs do not appear to show this specific transition; the permissions blocks in the files shown already follow standard mapping syntax.
Test suggestions
- Verify that all modified workflow files have the SPDX header on line 1.
- Confirm that workflow YAML syntax for permissions is valid (mapping vs scalar).
- Ensure the actions.lock file is generated and includes manual path entries.
Low confidence findings
- The PR description mentions a specific fix for a 'scalar with indented mapping' YAML error in permissions, but the diff for the provided workflow files does not clearly show this transition. Please verify if the problematic syntax was present in a file or block not included in this diff.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| @@ -1,5 +1,6 @@ | |||
| # SPDX-License-Identifier: MPL-2.0 | |||
| # This workflow is managed by gh actions-lock. | |||
| # This workflow is managed by gh actions-lock. | |||
There was a problem hiding this comment.
⚪ LOW RISK
Nitpick: Redundant duplication of the 'managed by gh actions-lock' comment. Line 2 already contains this text.
| @@ -1,5 +1,6 @@ | |||
| # SPDX-License-Identifier: MPL-2.0 | |||
| # This workflow is managed by gh actions-lock. | |||
| # This workflow is managed by gh actions-lock. | |||
There was a problem hiding this comment.
⚪ LOW RISK
Nitpick: Redundant duplication of the 'managed by gh actions-lock' comment. Line 2 already contains this text.
| @@ -1,5 +1,6 @@ | |||
| # SPDX-License-Identifier: MPL-2.0 | |||
| # This workflow is managed by gh actions-lock. | |||
| # This workflow is managed by gh actions-lock. | |||
There was a problem hiding this comment.
⚪ LOW RISK
Nitpick: Redundant duplication of the '# This workflow is managed by gh actions-lock.' comment. Line 2 already contains this text. This duplication is consistent across the modified workflows. You can resolve this by removing the redundant comment on line 3 across all workflow files.
1 participant
Remediates GitHub Workflow Dependency Locking (public preview, no changelog entry), which rejects runs at
startup_failure— zero jobs, no logs, nothing in REST or GraphQL. Full analysis:hyperpolymath/standards#657.Proven on
hyperpolymath/anamnesis: 6 of 6 workflows dead → 0startup_failure, 13 running.Five steps, in order — each blocks the next
1. Unbreak the workflow YAML. Any
permissions:carrying a scalar with an indented mapping under it:This reaches past the one file:
gh actions-lockrefuses to run when any workflow in the repo fails to parse, so the repo can never acquire a lockfile and can never self-heal.2. Repin
standardsreusables off commits with noactions.lock. The rejection requires the callee to be covered at the pinned SHA — unsatisfiable at a pre-lockfile commit.3. Generate the lockfile with
gh actions-lock.4. Hand-add the reusable-caller entries the tool omits, as
'<path>': [].P(startup_failure | has lockfile) = 91.7%vs15.8%without — because every workflow a lockfile omits is rejected. A partial lock is worse than none. Runninggh actions-lockand stopping there is how this outage spread.5. Restore
SPDX-License-Identifierto line 1, which the tool displaces with its own banner and which the workflow-security linter greps viahead -1.Verified before this PR was opened
0unparseable workflows · lockfile covers every workflow, no omissions · SPDX on line 1 in every file. The script refuses to push if any of the three fails.🤖 Generated with Claude Code