fix(ci): unbreak workflow YAML and add a complete actions.lock

[hyperpolymath]

Remediates GitHub Workflow Dependency Locking (public preview, no changelog entry), which rejects runs at startup_failure — zero jobs, no logs, nothing in REST or GraphQL. Full analysis: hyperpolymath/standards#657.

Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead → 0 startup_failure, 13 running.

Five steps, in order — each blocks the next

1. Unbreak the workflow YAML. Any permissions: carrying a scalar with an indented mapping under it:

permissions: read-all
  actions: read        # <- mapping under a scalar. Unparseable.

This reaches past the one file: gh actions-lock refuses to run when any workflow in the repo fails to parse, so the repo can never acquire a lockfile and can never self-heal.

2. Repin standards reusables off commits with no actions.lock. The rejection requires the callee to be covered at the pinned SHA — unsatisfiable at a pre-lockfile commit.

3. Generate the lockfile with gh actions-lock.

4. Hand-add the reusable-caller entries the tool omits, as '<path>': [].

⚠️ Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without — because every workflow a lockfile omits is rejected. A partial lock is worse than none. Running gh actions-lock and stopping there is how this outage spread.

5. Restore SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps via head -1.

Verified before this PR was opened

0 unparseable workflows · lockfile covers every workflow, no omissions · SPDX on line 1 in every file. The script refuses to push if any of the three fails.

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fa32b0a2-3ded-408f-a8dc-6522635dc9f5

📥 Commits

Reviewing files that changed from the base of the PR and between 984ebc4 and c202edf.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (6)

• .github/workflows/ada-ci.yml
• .github/workflows/dogfood-gate.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/openssf-compliance.yml
• .github/workflows/static-analysis-gate.yml
• .github/workflows/workflow-linter.yml

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated automated workflows to use current, pinned action versions.
  • Improved workflow permission declarations for security scanning.
  • Added workflow management and licensing metadata.

Walkthrough

The pull request updates action version references across six GitHub Actions workflows. It adds gh actions-lock management comments, an SPDX header, and actions: read permission.

Changes

Workflow maintenance

Layer / File(s)	Summary
ADA CI action references .github/workflows/ada-ci.yml	The ADA CI jobs use updated versions for checkout, upload-artifact, and download-artifact.
Validation workflow metadata and checkout .github/workflows/dogfood-gate.yml, .github/workflows/hypatia-scan.yml, .github/workflows/openssf-compliance.yml	The workflows add management markers. Hypatia adds actions: read. Checkout references use version tags.
Static analysis and linter action references .github/workflows/static-analysis-gate.yml, .github/workflows/workflow-linter.yml	The jobs use updated version tags for checkout, artifact actions, and BEAM setup.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Poem

A rabbit checks each workflow line,
With action tags in tidy design.
The locks now mark the files with care,
Read permissions rest in place there.
CI hops onward, neat and bright.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[codacy-production]

Not up to standards ⛔

🔴 Issues 1 high

Alerts:
⚠ 1 issue (≤ 0 issues of at least minor severity)

Results:
1 new issue

Category	Results
Security	1 high

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The pull request is not up to standards according to Codacy analysis. The most critical issue is the absence of the 'actions.lock' file from the diff, which is central to the PR's stated intent of implementing dependency locking. Additionally, the new 'workflow-linter.yml' enforces security standards (top-level permissions) that several workflows in this PR fail to meet. A logic error was also identified in the 'diagnostics' job, which lacks the necessary dependencies to access the build binary.

About this PR

• The 'actions.lock' file is missing from the pull request. This file is a central component of the intended dependency management system; its absence prevents verification of the manual overrides and the overall locking strategy.

2 comments outside of the diff

[REDACTED:HIGH_ENTROPY]

_{line 1 🔴 HIGH RISK}
Add a top-level 'permissions:' block (e.g., 'permissions: contents: read') to comply with the security standards enforced by the 'workflow-linter.yml' added in this PR.

_{line 148 🟡 MEDIUM RISK}
The 'diagnostics' job is missing a 'needs: build' requirement and an 'actions/download-artifact' step. Add these to ensure the binary is available for the check; otherwise, the job will fail to find the file and default to a fallback state.

Test suggestions

• Verify that the SPDX license header is located on the first line of all updated workflows.
• Confirm that the 'managed by gh actions-lock' banner is added consistently across workflows.
• Verify that actions/checkout and artifact-related actions are pinned to specific semantic tags (e.g., @v4.4.0).
• Confirm that the actions.lock file is present and contains the required manual overrides for callers.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Confirm that the actions.lock file is present and contains the required manual overrides for callers.

Low confidence findings

• The YAML mapping-scalar conflict mentioned in the PR description is not explicitly visible in the provided hunks. Please verify that the syntax fix was correctly staged and committed.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}