From 2407c1b10506038cdc8b9697606aa5990954b1f6 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 27 Aug 2026 05:01:34 +0100 Subject: [PATCH] fix(ci): unbreak workflow YAML and add a complete actions.lock Remediates GitHub Workflow Dependency Locking (public preview), which rejects runs at startup_failure with zero jobs and no logs. See hyperpolymath/standards#657. Five steps, in order, because each blocks the next: 1. Unbroke any workflow whose `permissions:` carried a scalar with an indented mapping under it - blind-permissions-insertion damage. This matters beyond the one file: gh actions-lock refuses to run when ANY workflow in the repo fails to parse, so the repo could never acquire a lockfile and could never self-heal. 2. Repinned hyperpolymath/standards reusables off commits that have no actions.lock. The rejection requires the CALLEE to be covered at the pinned SHA, which is unsatisfiable at a pre-lockfile commit. 3. Generated the lockfile with gh actions-lock. 4. Hand-added the reusable-workflow caller entries the tool omits, as '': []. Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without, because every workflow a lockfile OMITS is rejected. A PARTIAL lock is worse than none - running gh actions-lock and stopping there is how this outage spread. 5. Restored SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps with head -1. Verified before push: 0 unparseable workflows, lockfile covers every workflow with no omissions, SPDX on line 1 in every file. Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead -> 0 startup_failure, 13 running. Co-Authored-By: Claude Opus 5 --- .github/workflows/actions.lock | 138 ++++++++++++++++++++++++ .github/workflows/casket-pages.yml | 15 +-- .github/workflows/codeql.yml | 7 +- .github/workflows/deploy-site.yml | 9 +- .github/workflows/governance.yml | 2 + .github/workflows/hypatia-scan.yml | 9 +- .github/workflows/push-email-notify.yml | 3 +- .github/workflows/release.yml | 13 +-- .github/workflows/scorecard.yml | 7 +- .github/workflows/secret-scanner.yml | 2 + 10 files changed, 177 insertions(+), 28 deletions(-) create mode 100644 .github/workflows/actions.lock diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..e410917 --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,138 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/governance.yml': [] + '.github/workflows/secret-scanner.yml': [] + '.github/workflows/casket-pages.yml': + - 'actions/cache@v4.3.0' + - 'actions/checkout@v4.1.1' + - 'actions/configure-pages@v5.0.0' + - 'actions/deploy-pages@v4.0.5' + - 'actions/upload-pages-artifact@v3.0.1' + - 'haskell-actions/setup@v2.7.5' + '.github/workflows/codeql.yml': + - 'actions/checkout@v6.0.1' + - 'github/codeql-action@v4.31.10' + '.github/workflows/deploy-site.yml': + - 'actions/checkout@v4.1.1' + - 'actions/configure-pages@v5.0.0' + - 'actions/deploy-pages@v4.0.5' + - 'actions/upload-pages-artifact@v3.0.1' + '.github/workflows/hypatia-scan.yml': + - 'actions/checkout@v4.1.1' + - 'actions/github-script@v7.0.1' + - 'actions/upload-artifact@v4.6.2' + - 'erlef/setup-beam@v1.17.5' + '.github/workflows/push-email-notify.yml': + - 'dawidd6/action-send-mail@v3.12.0' + '.github/workflows/release.yml': + - 'actions/checkout@v4.1.1' + - 'docker/build-push-action@v5.1.0' + - 'docker/login-action@v3.0.0' + - 'docker/metadata-action@v5.5.1' + - 'docker/setup-buildx-action@v3.0.0' + - 'softprops/action-gh-release@v2.2.2' + '.github/workflows/scorecard.yml': + - 'actions/checkout@v6.0.1' + - 'github/codeql-action@v4.31.10' + - 'ossf/scorecard-action@v2.4.3' +dependencies: + 'actions/cache@v4.3.0': + ref: 'v4.3.0' + commit: 'sha1-0057852bfaa89a56745cba8c7296529d2fc39830' + owner_id: 44036562 + repo_id: 215566462 + 'actions/checkout@v4.1.1': + ref: 'v4.1.1' + commit: 'sha1-b4ffde65f46336ab88eb53be808477a3936bae11' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v6.0.1': + ref: 'v6.0.1' + commit: 'sha1-8e8c483db84b4bee98b60c0593521ed34d9990e8' + owner_id: 44036562 + repo_id: 197814629 + 'actions/configure-pages@v5.0.0': + ref: 'v5.0.0' + commit: 'sha1-983d7736d9b0ae728b81ab479565c72886d7745b' + owner_id: 44036562 + repo_id: 513659658 + 'actions/deploy-pages@v4.0.5': + ref: 'v4.0.5' + commit: 'sha1-d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e' + owner_id: 44036562 + repo_id: 438112499 + 'actions/github-script@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-60a0d83039c74a4aee543508d2ffcb1c3799cdea' + owner_id: 44036562 + repo_id: 205262760 + 'actions/upload-artifact@v4': + ref: 'v4' + commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-artifact@v4.6.2': + ref: 'v4.6.2' + commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-pages-artifact@v3.0.1': + ref: 'v3.0.1' + commit: 'sha1-56afc609e74202658d3ffba0e8f6dda462b719fa' + owner_id: 44036562 + repo_id: 496012378 + uses: + - 'actions/upload-artifact@v4' + 'dawidd6/action-send-mail@v3.12.0': + ref: 'v3.12.0' + commit: 'sha1-6e502825a508b867ab2954ad6343b68787624c01' + owner_id: 9713907 + repo_id: 222439721 + 'docker/build-push-action@v5.1.0': + ref: 'v5.1.0' + commit: 'sha1-4a13e500e55cf31b7a5d59a38ab2040ab0f42f56' + owner_id: 5429470 + repo_id: 241092383 + 'docker/login-action@v3.0.0': + ref: 'v3.0.0' + commit: 'sha1-343f7c4344506bcbf9b4de18042ae17996df046d' + owner_id: 5429470 + repo_id: 287743349 + 'docker/metadata-action@v5.5.1': + ref: 'v5.5.1' + commit: 'sha1-8e5442c4ef9f78752691e2d8f8d19755c6f78e81' + owner_id: 5429470 + repo_id: 306769011 + 'docker/setup-buildx-action@v3.0.0': + ref: 'v3.0.0' + commit: 'sha1-f95db51fddba0c2d1ec667646a06c2ce06100226' + owner_id: 5429470 + repo_id: 288485773 + 'erlef/setup-beam@v1.17.5': + ref: 'v1.17.5' + commit: 'sha1-2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c' + owner_id: 47606891 + repo_id: 331103973 + 'github/codeql-action@v4.31.10': + ref: 'v4.31.10' + commit: 'sha1-cdefb33c0f6224e58673d9004f47f7cb3e328b89' + owner_id: 9919 + repo_id: 259445878 + 'haskell-actions/setup@v2.7.5': + ref: 'v2.7.5' + commit: 'sha1-ec49483bfc012387b227434aba94f59a6ecd0900' + owner_id: 75048950 + repo_id: 623796603 + 'ossf/scorecard-action@v2.4.3': + ref: 'v2.4.3' + commit: 'sha1-4eaacf0543bb3f2c246792bd56e8cdeffafb205a' + owner_id: 67707773 + repo_id: 421101922 + 'softprops/action-gh-release@v2.2.2': + ref: 'v2.2.2' + commit: 'sha1-da05d552573ad5aba039eaac05058a918a7bf631' + owner_id: 2242 + repo_id: 204253808 diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index f6d4979..6054ec9 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: GitHub Pages on: @@ -20,22 +21,22 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + uses: actions/checkout@v4.1.1 - name: Checkout casket-ssg - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + uses: actions/checkout@v4.1.1 with: repository: hyperpolymath/casket-ssg path: .casket-ssg - name: Setup GHCup - uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2 + uses: haskell-actions/setup@v2.7.5 with: ghc-version: '9.8.2' cabal-version: '3.10' - name: Cache Cabal - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 + uses: actions/cache@v4.3.0 with: path: | ~/.cabal/packages @@ -79,10 +80,10 @@ jobs: cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site - name: Setup Pages - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 + uses: actions/configure-pages@v5.0.0 - name: Upload artifact - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 + uses: actions/upload-pages-artifact@v3.0.1 with: path: '_site' @@ -95,4 +96,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 + uses: actions/deploy-pages@v4.0.5 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b317db1..72b7740 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: CodeQL Security Analysis on: @@ -26,15 +27,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@v6.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1 + uses: github/codeql-action/init@v4.31.10 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1 + uses: github/codeql-action/analyze@v4.31.10 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/deploy-site.yml b/.github/workflows/deploy-site.yml index e9ce4fe..b7dec46 100644 --- a/.github/workflows/deploy-site.yml +++ b/.github/workflows/deploy-site.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Deploy Landing Page on: @@ -23,7 +24,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + uses: actions/checkout@v4.1.1 - name: Convert docs to HTML run: | @@ -52,13 +53,13 @@ jobs: cp examples/*.json docs/site/examples/ - name: Setup Pages - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 + uses: actions/configure-pages@v5.0.0 - name: Upload artifact - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 + uses: actions/upload-pages-artifact@v3.0.1 with: path: 'docs/site' - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 + uses: actions/deploy-pages@v4.0.5 diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index b0b1ed6..b6c76f1 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # governance.yml — single wrapper calling the shared estate governance bundle # in hyperpolymath/standards instead of carrying per-repo copies. # @@ -19,6 +20,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 5b59919..aed7d95 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan @@ -20,12 +21,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + uses: actions/checkout@v4.1.1 with: fetch-depth: 0 # Full history for better pattern analysis - name: Setup Elixir for Hypatia scanner - uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.18.2 + uses: erlef/setup-beam@v1.17.5 with: elixir-version: '1.19.4' otp-version: '28.3' @@ -75,7 +76,7 @@ jobs: echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY - name: Upload findings artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@v4.6.2 with: name: hypatia-findings path: hypatia-findings.json @@ -146,7 +147,7 @@ jobs: - name: Comment on PR with findings if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0 - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7 + uses: actions/github-script@v7.0.1 with: script: | const fs = require('fs'); diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 4b4e754..b69c87f 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by @@ -15,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Send push notification email - uses: dawidd6/action-send-mail@6e502825a508b867ab2954ad6343b68787624c01 # pinned + uses: dawidd6/action-send-mail@v3.12.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8eb47ca..de3b834 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Release on: @@ -16,13 +17,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + uses: actions/checkout@v4.1.1 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3 + uses: docker/setup-buildx-action@v3.0.0 - name: Login to GitHub Container Registry - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3 + uses: docker/login-action@v3.0.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -30,7 +31,7 @@ jobs: - name: Extract metadata id: meta - uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5 + uses: docker/metadata-action@v5.5.1 with: images: ghcr.io/${{ github.repository }} tags: | @@ -41,7 +42,7 @@ jobs: type=sha - name: Build and push Docker image - uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5 + uses: docker/build-push-action@v5.1.0 with: context: . push: true @@ -52,7 +53,7 @@ jobs: platforms: linux/amd64,linux/arm64 - name: Create GitHub Release - uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2 + uses: softprops/action-gh-release@v2.2.2 if: startsWith(github.ref, 'refs/tags/') with: generate_release_notes: true diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 352c17a..dff0657 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: OSSF Scorecard on: schedule: @@ -14,17 +15,17 @@ jobs: security-events: write id-token: write steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - uses: actions/checkout@v6.0.1 with: persist-credentials: false - name: Run Scorecard - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1 + uses: ossf/scorecard-action@v2.4.3 with: results_file: results.sarif results_format: sarif - name: Upload results - uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.31.8 + uses: github/codeql-action/upload-sarif@v4.31.10 with: sarif_file: results.sarif diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index d325a5c..07dd1d2 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Calls the estate's shared secret scanner (gitleaks + rust-secrets + # shell-secrets). Added because this repository had NO leak scanning at all. # @@ -13,6 +14,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read jobs: secret-scan: