fix(ci): repin standards reusables to a commit that has a lockfile - #82
Merged
hyperpolymath merged 1 commit intoAug 27, 2026
Merged
Conversation
Every workflow here calls a standards reusable pinned to a commit with NO
.github/workflows/actions.lock:
81dbf2dd 2026-07-21 no lockfile
892497fe 2026-08-12 no lockfile
84355587 HEAD lockfile present, 11754 bytes, 38 workflows onboarded
GitHub's Workflow Dependency Locking (public preview) rejects a run when
the callee at the pinned SHA is not covered by a lockfile. It does so at
startup_failure - zero jobs, no logs, no annotations in REST or GraphQL.
The reason is visible only in the run page banner:
Workflow must use a lockfile. Run "gh actions pin" to generate one.
The following workflows are missing a lockfile:
- .github/workflows/governance.yml
- hyperpolymath/standards@81dbf2dd
That requirement can never be satisfied at 81dbf2dd or 892497fe, because
no lockfile existed anywhere in standards on either date. Repinning to
HEAD is the fix; hand-adding entries to this repo's own lockfile is not,
because it addresses only the first line of the message.
(Note: "gh actions pin" is not a released command - it is an open RFC,
cli/cli#13314. The shipped tool is the gh actions-lock extension. The
server's own error text names a command that has never existed.)
Pilot for an estate-wide repin. Verified before pushing: 0 residual
references to either stale SHA.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
hyperpolymath
force-pushed
the
fix/repin-standards-reusables-to-lockfile-head
branch
from
August 27, 2026 00:25
f5d4a5c to
75cd6d1
Compare
hyperpolymath
deleted the
fix/repin-standards-reusables-to-lockfile-head
branch
August 27, 2026 00:26
|
|
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Up to standards ✅🟢 Issues
|
Contributor
There was a problem hiding this comment.
Pull Request Overview
The PR repins reusable workflows to a commit SHA that includes an actions.lock file, ensuring compliance with GitHub's dependency locking policy. This change is necessary to prevent workflow initialization failures (startup_failure). Codacy reports that the PR is up to standards with no new quality issues. No security flaws or major logic bugs were identified. Verification is required to ensure all workflow references are updated and that the modified pipelines execute successfully.
Test suggestions
- Verify all CI workflow files in the repository have been updated to the correct SHA via static analysis or linting.
- Trigger a manual or push-based CI run for each modified workflow to verify successful initialization and execution.
- Scan the entire repository for the old workflow versions to ensure complete removal.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify all CI workflow files in the repository have been updated to the correct SHA via static analysis or linting.
2. Trigger a manual or push-based CI run for each modified workflow to verify successful initialization and execution.
3. Scan the entire repository for the old workflow versions to ensure complete removal.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
hyperpolymath
added a commit
that referenced
this pull request
Aug 27, 2026
…83) Pilot for the estate remediation of GitHub **Workflow Dependency Locking**. See `hyperpolymath/standards#657`. Four steps, in this order, because each blocks the next. **1. `workflow-linter.yml` was unparseable.** ```yaml permissions: read-all actions: read # <- mapping indented under a scalar ``` Blind-`permissions:`-insertion damage. The consequence reaches far past the one file: **`gh actions-lock` refuses to run when ANY workflow in the repo fails to parse**, so the repo can never acquire a lockfile, so every workflow that needs one stays dead. One broken file kills the repo. **2. Generated the lockfile** with `gh actions-lock` v0.1.6. **3. The generated lockfile was PARTIAL — 10 of 15.** The five omitted are exactly the reusable-workflow callers; the tool emits no entries for them. Hand-added each as `'<path>': []`.⚠️ This is the estate-wide trap: **a partial lock is worse than none.** Measured across 218 repos, `P(startup_failure | has lock) = 91.7%` vs `15.8%` without — because every workflow the lock *omits* is rejected. Running `gh actions-lock` and stopping there is how 55 repos got into that state. **4. The tool restamps its banner above line 1**, displacing the SPDX header that the workflow-security linter greps with `head -1`. Restored in 14 files; `main-estate-audit.yml` had none at all, so one was authored (MPL-2.0, Rule 1 default — a new header, not a relicensing, so A2 is not engaged). **Verified before pushing:** 0 unparseable workflows · SPDX on line 1 in **15/15** · lockfile covers **15/15**, no omissions. Follows #82, which repinned the `standards` callee off a pre-lockfile SHA and removed the other half of the rejection. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pilot for an estate-wide repin. See
hyperpolymath/standards#657.Every workflow here calls a
standardsreusable pinned to a commit with no lockfile:actions.lock81dbf2dd892497fe84355587(HEAD)GitHub's Workflow Dependency Locking (public preview, no changelog entry) rejects a run when the callee at the pinned SHA is not covered by a lockfile — at
startup_failure, with zero jobs and nothing in REST or GraphQL. The reason exists only in the run-page banner.That requirement is unsatisfiable at either stale SHA, because no lockfile existed anywhere in
standardson either date. Repinning to HEAD is the fix. Hand-adding entries to this repo's lockfile is not — it addresses only the first line of the rejection, never the second.Verified before pushing: 0 residual references to either stale SHA.
🤖 Generated with Claude Code