Claim
A phantom actions/upload-artifact pin ea165f8d65b6db9a8b71b5c2d1a090c0daf9c8bb is live on the remote default branch of 11 repos. The commit never existed (API returns 422). It is a spliced mutant of the healthy v4 pin ea165f8d65b6e75b… — first 12 hex chars of the real SHA, alien tail — i.e. a corrupted find/replace or hand-edit, not a force-push orphan.
Affected (each remote-verified on a live, non-comment line, 2026-08-31)
asdf-tool-plugins, BowtieRisk.jl, Causals.jl, developer-ecosystem, Exnovation.jl, HackenbushGames.jl, maa-framework, patallm-gallery, PolyglotFormalisms.jl, standards, wordpress-tools
Why it matters
Unlike an orphaned-but-existing commit (which Actions can still fetch), a SHA that never existed fails resolution outright — any workflow referencing it dies at startup. This is the same class as the known phantom pins (#669 tracks the post-remediation stragglers) but a distinct root cause: mutation during an edit, not upstream history rewrite. The known-good remap target from the 08-26/27 remediation is 043fb46d1a93 (upload-artifact v4).
First step
Sweep the 11 repos, replacing the mutant SHA with the healthy v4 pin (and regenerate actions.lock where present — remember callers need their own entry). Then grep the estate for other 40-hex strings whose 12-char prefix matches a known action pin but whose tail doesn't — there may be sibling mutants.
Found while re-verifying #669; filed per the discoveries-become-issues rule.
Claim
A phantom actions/upload-artifact pin
ea165f8d65b6db9a8b71b5c2d1a090c0daf9c8bbis live on the remote default branch of 11 repos. The commit never existed (API returns 422). It is a spliced mutant of the healthy v4 pinea165f8d65b6e75b…— first 12 hex chars of the real SHA, alien tail — i.e. a corrupted find/replace or hand-edit, not a force-push orphan.Affected (each remote-verified on a live, non-comment line, 2026-08-31)
asdf-tool-plugins, BowtieRisk.jl, Causals.jl, developer-ecosystem, Exnovation.jl, HackenbushGames.jl, maa-framework, patallm-gallery, PolyglotFormalisms.jl, standards, wordpress-tools
Why it matters
Unlike an orphaned-but-existing commit (which Actions can still fetch), a SHA that never existed fails resolution outright — any workflow referencing it dies at startup. This is the same class as the known phantom pins (#669 tracks the post-remediation stragglers) but a distinct root cause: mutation during an edit, not upstream history rewrite. The known-good remap target from the 08-26/27 remediation is
043fb46d1a93(upload-artifact v4).First step
Sweep the 11 repos, replacing the mutant SHA with the healthy v4 pin (and regenerate actions.lock where present — remember callers need their own entry). Then grep the estate for other 40-hex strings whose 12-char prefix matches a known action pin but whose tail doesn't — there may be sibling mutants.
Found while re-verifying #669; filed per the discoveries-become-issues rule.