From c202edf77ff9ca9ea131acca133f192fb8b87262 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 27 Aug 2026 13:33:11 +0100 Subject: [PATCH] fix(ci): unbreak workflow YAML and add a complete actions.lock Remediates GitHub Workflow Dependency Locking (public preview), which rejects runs at startup_failure with zero jobs and no logs. See hyperpolymath/standards#657. Five steps, in order, because each blocks the next: 1. Unbroke any workflow whose `permissions:` carried a scalar with an indented mapping under it - blind-permissions-insertion damage. This matters beyond the one file: gh actions-lock refuses to run when ANY workflow in the repo fails to parse, so the repo could never acquire a lockfile and could never self-heal. 2. Repinned hyperpolymath/standards reusables off commits that have no actions.lock. The rejection requires the CALLEE to be covered at the pinned SHA, which is unsatisfiable at a pre-lockfile commit. 3. Generated the lockfile with gh actions-lock. 4. Hand-added the reusable-workflow caller entries the tool omits, as '': []. Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without, because every workflow a lockfile OMITS is rejected. A PARTIAL lock is worse than none - running gh actions-lock and stopping there is how this outage spread. 5. Restored SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps with head -1. Verified before push: 0 unparseable workflows, lockfile covers every workflow with no omissions, SPDX on line 1 in every file. Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead -> 0 startup_failure, 13 running. Co-Authored-By: Claude Opus 5 --- .github/workflows/actions.lock | 62 ++++++++++++++++++++++ .github/workflows/ada-ci.yml | 19 ++++--- .github/workflows/dogfood-gate.yml | 13 ++--- .github/workflows/hypatia-scan.yml | 2 + .github/workflows/openssf-compliance.yml | 3 +- .github/workflows/static-analysis-gate.yml | 23 ++++---- .github/workflows/workflow-linter.yml | 3 +- 7 files changed, 98 insertions(+), 27 deletions(-) create mode 100644 .github/workflows/actions.lock diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..82645c4 --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,62 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/hypatia-scan.yml': [] + '.github/workflows/ada-ci.yml': + - 'actions/checkout@v4.4.0' + - 'actions/download-artifact@v3.0.2' + - 'actions/upload-artifact@v3.2.1' + '.github/workflows/dogfood-gate.yml': + - 'actions/checkout@v4.3.1' + '.github/workflows/openssf-compliance.yml': + - 'actions/checkout@v4.3.1' + '.github/workflows/static-analysis-gate.yml': + - 'actions/checkout@v6.0.2' + - 'actions/download-artifact@v4.1.8' + - 'actions/upload-artifact@v4.6.2' + - 'erlef/setup-beam@v1.20.4' + '.github/workflows/workflow-linter.yml': + - 'actions/checkout@v6.0.2' +dependencies: + 'actions/checkout@v4.3.1': + ref: 'v4.3.1' + commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v4.4.0': + ref: 'v4.4.0' + commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v6.0.2': + ref: 'v6.0.2' + commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd' + owner_id: 44036562 + repo_id: 197814629 + 'actions/download-artifact@v3.0.2': + ref: 'v3.0.2' + commit: 'sha1-9bc31d5ccc31df68ecc42ccf4149144866c47d8a' + owner_id: 44036562 + repo_id: 192626254 + 'actions/download-artifact@v4.1.8': + ref: 'v4.1.8' + commit: 'sha1-fa0a91b85d4f404e444e00e005971372dc801d16' + owner_id: 44036562 + repo_id: 192626254 + 'actions/upload-artifact@v3.2.1': + ref: 'v3.2.1' + commit: 'sha1-ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-artifact@v4.6.2': + ref: 'v4.6.2' + commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02' + owner_id: 44036562 + repo_id: 192625955 + 'erlef/setup-beam@v1.20.4': + ref: 'v1.20.4' + commit: 'sha1-e6d7c94229049569db56a7ad5a540c051a010af9' + owner_id: 47606891 + repo_id: 331103973 diff --git a/.github/workflows/ada-ci.yml b/.github/workflows/ada-ci.yml index 09f5e38..1500814 100644 --- a/.github/workflows/ada-ci.yml +++ b/.github/workflows/ada-ci.yml @@ -1,3 +1,6 @@ +# SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. + name: Ada/SPARK CI on: @@ -32,7 +35,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v4.4.0 with: fetch-depth: 0 submodules: recursive @@ -65,7 +68,7 @@ jobs: fi - name: Upload artifact - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v3.2.1 with: name: trigger-binaries path: | @@ -82,10 +85,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v4.4.0 - name: Download artifact - uses: actions/download-artifact@v3 + uses: actions/download-artifact@v3.0.2 with: name: trigger-binaries path: . @@ -110,7 +113,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v4.4.0 - name: Install Zig run: | @@ -128,7 +131,7 @@ jobs: ls -la ffi/zig/ - name: Upload Zig artifact - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v3.2.1 with: name: zig-ffi path: ffi/zig/ @@ -142,7 +145,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v4.4.0 - name: Run self-diagnostics run: | @@ -189,7 +192,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v4.4.0 - name: Check for secrets run: | diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 4e06e2a..b5086e2 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate @@ -29,7 +30,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@v4.3.1 - name: Check for A2ML files id: detect @@ -74,7 +75,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@v4.3.1 - name: Check for K9 files id: detect @@ -124,7 +125,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@v4.3.1 - name: Scan for invisible characters id: lint @@ -189,7 +190,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@v4.3.1 - name: Check for Groove manifest id: groove @@ -254,7 +255,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@v4.3.1 - name: Check and validate eclexiaiser manifest id: eclex @@ -306,7 +307,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@v4.3.1 - name: Generate dogfooding scorecard run: | diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 9a14bec..26b6ce4 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # # Standalone Hypatia security scan (push / PR / weekly). This is NOT a duplicate # of the `hypatia-scan` job in `static-analysis-gate.yml`: that job exists to @@ -20,6 +21,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read security-events: write diff --git a/.github/workflows/openssf-compliance.yml b/.github/workflows/openssf-compliance.yml index 6222d39..1b8bf80 100644 --- a/.github/workflows/openssf-compliance.yml +++ b/.github/workflows/openssf-compliance.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # OpenSSF Best Practices compliance gate — blocks PRs and pushes that lack # required files or still contain unfilled placeholder tokens. name: OpenSSF Compliance @@ -20,7 +21,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@v4.3.1 with: persist-credentials: false - name: Check SECURITY.md exists and has substance diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml index 3b6ecc0..2fcd1c6 100644 --- a/.github/workflows/static-analysis-gate.yml +++ b/.github/workflows/static-analysis-gate.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Static Analysis Gate — Required by branch protection rules. # Runs panic-attack and hypatia, deposits findings for gitbot-fleet learning. name: Static Analysis Gate @@ -22,7 +23,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - name: Install panic-attack (if available) @@ -99,7 +100,7 @@ jobs: echo "" >> "$GITHUB_STEP_SUMMARY" echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload panic-attack findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@v4.6.2 with: name: panic-attack-findings path: panic-attack-findings.json @@ -126,13 +127,13 @@ jobs: timeout-minutes: 15 steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - name: Setup Elixir for Hypatia scanner id: beam continue-on-error: true - uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.18.2 + uses: erlef/setup-beam@v1.20.4 with: elixir-version: '1.19.4' otp-version: '28.3' @@ -211,7 +212,7 @@ jobs: echo "" >> "$GITHUB_STEP_SUMMARY" echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload hypatia findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@v4.6.2 with: name: hypatia-findings path: hypatia-findings.json @@ -230,7 +231,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - name: Install panic-attack (if available) @@ -292,7 +293,7 @@ jobs: echo "" >> "$GITHUB_STEP_SUMMARY" echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload bridge report - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@v4.6.2 with: name: bridge-report path: bridge-report.json @@ -314,17 +315,17 @@ jobs: if: always() steps: - name: Download panic-attack findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 + uses: actions/download-artifact@v4.1.8 with: name: panic-attack-findings path: findings/ - name: Download hypatia findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 + uses: actions/download-artifact@v4.1.8 with: name: hypatia-findings path: findings/ - name: Download bridge report - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 + uses: actions/download-artifact@v4.1.8 with: name: bridge-report path: findings/ @@ -384,7 +385,7 @@ jobs: echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" echo "low=$LOW" >> "$GITHUB_OUTPUT" - name: Upload unified findings (fleet scanner picks these up) - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@v4.6.2 with: name: unified-findings path: findings/unified-findings.json diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index e82b6a3..1505baa 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # workflow-linter.yml - Validates GitHub workflows against RSR security standards # This workflow can be copied to other repos for consistent enforcement name: Workflow Security Linter @@ -27,7 +28,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Check SPDX Headers run: |