fix(governance): honor native actions lock resolution

[hyperpolymath]

Outcome

Removes the contradictory requirement to combine actions.lock with raw direct-action SHAs. Repositories with a lockfile now use the authoritative gh actions-lock verification result; repositories without one still require direct 40-hex pins.

Evidence

In hyperpolymath/oikosbot#78, converting locked version references to raw SHAs caused five workflows to be rejected with startup_failure before any job was created. The same workflows previously executed through GitHub native lock resolution. This matches gh actions-lock semantics: raw commits not contained by a tag or branch are omitted from the generated lock.

Validation

• scripts/tests/actions-lock-update-test.sh: 3/3 pass
• scripts/check-workflow-duplicate-keys.sh .github/workflows: 44 files clean
• governance YAML parse: pass
• bash -n scripts/check-action-pins-resolve.sh: pass
• git diff --check: pass

Signed-off-by: Jonathan D.A. Jewell j.d.a.jewell@open.ac.uk

[coderabbitai]

Warning

Review limit reached

Next included review available in 35 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 743f022a-82d2-4fcb-8194-ae7a2b7765af

📥 Commits

Reviewing files that changed from the base of the PR and between 0a70a72 and 920867b.

📒 Files selected for processing (2)

• .github/workflows/governance-reusable.yml
• scripts/check-action-pins-resolve.sh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[hyperpolymath]

Follow-up probe with the authoritative tool confirms the source fix. In an isolated worktree at Oikos commit 5416df0 (the direct-SHA commit that produced five GitHub startup_failure runs), gh actions-lock reported Pinned 0 actions and rewrote every direct SHA back to its existing locked version tag; it did not convert the lockfile to raw-SHA keys. This is the supported transition for a repository whose native lock was generated from version references. gh actions-lock --no-fix had returned success without exposing that workflow/lock mismatch, so a second direct-SHA grep was not a valid hardening layer—it mandated a state the authoritative fixer immediately reverses. The standards repository has legacy raw-SHA lock keys and is a distinct already-synchronised state; that does not make the conversion safe for consumers with tag-keyed locks.

[codacy-production]

Pull Request Overview

The PR successfully implements the logic to prioritize actions.lock as the authoritative source for action immutability, which should resolve startup failures caused by redundant SHA-pinning requirements. Codacy analysis indicates the changes are up to standards with no new quality issues or complexity regressions.

However, there are no automated test scenarios included in this PR to verify the branch logic for repositories with or without lockfiles. Additionally, the implementation includes a side-effect: actions/github-script has been added to the SHA-pinning exclusion list. This change is not documented in the PR description and should be clarified to ensure it aligns with governance requirements.

About this PR

• There are no new or updated automated tests to verify the logic changes for repositories with vs. without 'actions.lock' files.
• The addition of 'actions/github-script' to the exclusion list is undocumented. Please confirm if this was intended to be part of this PR's scope.

2 comments outside of the diff

.github/workflows/governance-reusable.yml

_{line 1154 ⚪ LOW RISK}
Suggestion: The addition of 'actions/github-script' to the exclusion list is not mentioned in the PR description. If this is intentional, it should be documented as it permits unpinned references to this action even without a lockfile.

_{line 1157-1160 ⚪ LOW RISK}
Nitpick: The indentation of these echo statements is inconsistent with the rest of the block. Aligning them with the surrounding commands improves readability.

              echo "  Prefer \`gh actions-lock\` — it also locks the transitive dependencies"
              echo "  of composite actions, which an inline SHA cannot express."
              echo "  Do NOT do both: gh actions-lock refuses a ref no tag or branch contains,"
              echo "  so inline pinning REMOVES actions from the lockfile."

Test suggestions

• Verify linter success in a repository with 'actions.lock' and tag-based (non-SHA) action references.
• Verify linter failure in a repository without 'actions.lock' when using tag-based action references.
• Verify linter success in a repository without 'actions.lock' when using 40-hex SHA pins.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify linter success in a repository with 'actions.lock' and tag-based (non-SHA) action references.
2. Verify linter failure in a repository without 'actions.lock' when using tag-based action references.
3. Verify linter success in a repository without 'actions.lock' when using 40-hex SHA pins.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}