From 2ce59d16ace6cb2dc83bb6e857bafbfc60d80bb3 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 27 Aug 2026 04:44:02 +0100 Subject: [PATCH] fix(ci): unbreak workflow YAML and add a complete actions.lock Remediates GitHub Workflow Dependency Locking (public preview), which rejects runs at startup_failure with zero jobs and no logs. See hyperpolymath/standards#657. Five steps, in order, because each blocks the next: 1. Unbroke any workflow whose `permissions:` carried a scalar with an indented mapping under it - blind-permissions-insertion damage. This matters beyond the one file: gh actions-lock refuses to run when ANY workflow in the repo fails to parse, so the repo could never acquire a lockfile and could never self-heal. 2. Repinned hyperpolymath/standards reusables off commits that have no actions.lock. The rejection requires the CALLEE to be covered at the pinned SHA, which is unsatisfiable at a pre-lockfile commit. 3. Generated the lockfile with gh actions-lock. 4. Hand-added the reusable-workflow caller entries the tool omits, as '': []. Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without, because every workflow a lockfile OMITS is rejected. A PARTIAL lock is worse than none - running gh actions-lock and stopping there is how this outage spread. 5. Restored SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps with head -1. Verified before push: 0 unparseable workflows, lockfile covers every workflow with no omissions, SPDX on line 1 in every file. Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead -> 0 startup_failure, 13 running. Co-Authored-By: Claude Opus 5 --- .github/workflows/actions.lock | 26 +++++++++---------- .github/workflows/boj-build.yml | 1 + .github/workflows/casket-pages.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/dogfood-gate.yml | 1 + .github/workflows/e2e.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-dispatch-intake.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/inbox-steward.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/learning-loop.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/pages.yml | 1 + .github/workflows/panicbot-sweep.yml | 1 + .github/workflows/push-email-notify.yml | 3 ++- .github/workflows/repo-integrity-guard.yml | 1 + .github/workflows/rust.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/supervised-fleet-scan.yml | 1 + 21 files changed, 34 insertions(+), 14 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index fdc6aacd..219bd59e 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -11,10 +11,10 @@ workflows: - 'actions/configure-pages@v6.0.0' - 'actions/deploy-pages@v5.0.0' - 'actions/upload-pages-artifact@v5.0.0' - - 'haskell-actions/setup@v2.11.0' + - 'haskell-actions/setup@v2.12.0' '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - - 'github/codeql-action@v4.37.3' + - 'github/codeql-action@v4.37.8' '.github/workflows/dogfood-gate.yml': - 'actions/checkout@v7.0.1' - 'hyperpolymath/a2ml-ecosystem@main' @@ -41,7 +41,7 @@ workflows: - 'actions/checkout@v7.0.1' - 'actions/upload-artifact@v7.0.1' - 'dtolnay/rust-toolchain@master' - - 'swatinem/rust-cache@v2.9.1' + - 'swatinem/rust-cache@v2.9.2' '.github/workflows/push-email-notify.yml': - 'dawidd6/action-send-mail@v3.12.0' '.github/workflows/repo-integrity-guard.yml': @@ -92,7 +92,7 @@ dependencies: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' 'dawidd6/action-send-mail@v3.12.0': ref: 'v3.12.0' - commit: 'sha1-12335b969ae3fb71bee5f2c6b829744261aec34c' + commit: 'sha1-94de994a9f6fffee200243214e17002e2920bb59' owner_id: 9713907 repo_id: 222439721 'dtolnay/rust-toolchain@master': @@ -100,14 +100,14 @@ dependencies: commit: 'sha1-2c7215f132e9ebf062739d9130488b56d53c060c' owner_id: 1940490 repo_id: 260749683 - 'github/codeql-action@v4.37.3': - ref: 'v4.37.3' - commit: 'sha1-e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81' + 'github/codeql-action@v4.37.8': + ref: 'v4.37.8' + commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' owner_id: 9919 repo_id: 259445878 - 'haskell-actions/setup@v2.11.0': - ref: 'v2.11.0' - commit: 'sha1-cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553' + 'haskell-actions/setup@v2.12.0': + ref: 'v2.12.0' + commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' owner_id: 75048950 repo_id: 623796603 'hyperpolymath/a2ml-ecosystem@main': @@ -125,8 +125,8 @@ dependencies: commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697' owner_id: 18365890 repo_id: 220359305 - 'swatinem/rust-cache@v2.9.1': - ref: 'v2.9.1' - commit: 'sha1-c19371144df3bb44fab255c43d04cbc2ab54d1c4' + 'swatinem/rust-cache@v2.9.2': + ref: 'v2.9.2' + commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' owner_id: 580492 repo_id: 298565987 diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index e26d67bf..42ba1cc8 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: BoJ Server Build Trigger on: push: diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index 6643c664..9f5efb27 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: GitHub Pages on: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index bb845712..c9703681 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: CodeQL Security Analysis on: diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 4f69d714..f69883d1 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 61508936..e831600d 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: E2E Tests on: push: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index f786b538..a22913b5 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # governance.yml — single wrapper calling the shared estate governance bundle # in hyperpolymath/standards instead of carrying per-repo copies. # diff --git a/.github/workflows/hypatia-dispatch-intake.yml b/.github/workflows/hypatia-dispatch-intake.yml index 5d815ee4..c8810504 100644 --- a/.github/workflows/hypatia-dispatch-intake.yml +++ b/.github/workflows/hypatia-dispatch-intake.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Intake pipeline for cross-repo Hypatia/Gitbot dispatch events. name: Hypatia Dispatch Intake diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 9f6c10c2..ee70dfa7 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml. # See standards#191 for the reusable's purpose and design. diff --git a/.github/workflows/inbox-steward.yml b/.github/workflows/inbox-steward.yml index 66f33baa..7169dff8 100644 --- a/.github/workflows/inbox-steward.yml +++ b/.github/workflows/inbox-steward.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Inbox Steward — Automated PR processing through CICD gate # # This workflow: diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index bb1370c6..7b972aa0 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync diff --git a/.github/workflows/learning-loop.yml b/.github/workflows/learning-loop.yml index 01e9528e..49f3cb1c 100644 --- a/.github/workflows/learning-loop.yml +++ b/.github/workflows/learning-loop.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Hypatia Learning Loop - Auto-generate rules from observed patterns name: Learning Loop diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 5a1be217..a4020d7d 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Mirror to Git Forges on: diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index c458477a..31ade91c 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: GitHub Pages (Ddraig SSG) on: push: diff --git a/.github/workflows/panicbot-sweep.yml b/.github/workflows/panicbot-sweep.yml index 19c80a65..4a937972 100644 --- a/.github/workflows/panicbot-sweep.yml +++ b/.github/workflows/panicbot-sweep.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Panicbot Sweep — weekly batch scan of all repos via panic-attack. # # Catches drift in dormant repos that don't get per-PR scans. diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 42372b0e..b3c75699 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by @@ -18,7 +19,7 @@ jobs: timeout-minutes: 10 steps: - name: Send push notification email - uses: dawidd6/action-send-mail@v18 + uses: dawidd6/action-send-mail@v3.12.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/repo-integrity-guard.yml b/.github/workflows/repo-integrity-guard.yml index a3ef87b6..cb0048b4 100644 --- a/.github/workflows/repo-integrity-guard.yml +++ b/.github/workflows/repo-integrity-guard.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Repo Integrity Guard — prevents a stale-base squash-merge (or any push/PR) # from silently mass-deleting gitbot-fleet again. # diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index b396c45c..f2de8025 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Rust # Build + test + clippy gate for the three standalone Rust crates. # Added after a non-compiling crate (robot-repo-automaton) reached `main` diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index aa03a606..d7790fc0 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Scorecards supply-chain security on: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 43c86b36..99f85707 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Secret Scanner on: diff --git a/.github/workflows/supervised-fleet-scan.yml b/.github/workflows/supervised-fleet-scan.yml index 2f539938..65044b50 100644 --- a/.github/workflows/supervised-fleet-scan.yml +++ b/.github/workflows/supervised-fleet-scan.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Scheduled/dispatch pipeline for supervised-repo scanning via Hypatia + gitbot-fleet. name: Supervised Fleet Scan