From 2afb665b8f823aad9b7ef4bbc3bcf512f6b9497d Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 6 Oct 2026 19:35:31 +0100 Subject: [PATCH] fix(ci): lock haskell-actions/setup@v2.12.1 to its commit, not the tag object The actions.lock entry for haskell-actions/setup@v2.12.1 recorded 0f7370cc, the annotated TAG object, instead of the commit it points to (0f8e8c99). gh actions-lock --verify rejects it as an unreachable pin, which fails the Scorecard reconciliation step: Scorecard reconciliation failed: Native action-lock verification failed for .github/workflows/casket-pages.yml Dereferenced via repos/haskell-actions/setup/git/tags/0f7370cc -> object.type=commit sha=0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d (git/commits/ returns 200). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm --- .github/workflows/actions.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 45c79b17..106dc900 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -153,7 +153,7 @@ dependencies: repo_id: 259445878 'haskell-actions/setup@v2.12.1': ref: 'v2.12.1' - commit: 'sha1-0f7370ccbc65f22514ec3e094f6601b8d61fbbf7' + commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d' owner_id: 75048950 repo_id: 623796603 'hyperpolymath/deed-ecosystem@main':