From 71788e9ffc651bc25950df80da09b7d0970750a2 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 27 Aug 2026 04:53:11 +0100 Subject: [PATCH] fix(ci): unbreak workflow YAML and add a complete actions.lock Remediates GitHub Workflow Dependency Locking (public preview), which rejects runs at startup_failure with zero jobs and no logs. See hyperpolymath/standards#657. Five steps, in order, because each blocks the next: 1. Unbroke any workflow whose `permissions:` carried a scalar with an indented mapping under it - blind-permissions-insertion damage. This matters beyond the one file: gh actions-lock refuses to run when ANY workflow in the repo fails to parse, so the repo could never acquire a lockfile and could never self-heal. 2. Repinned hyperpolymath/standards reusables off commits that have no actions.lock. The rejection requires the CALLEE to be covered at the pinned SHA, which is unsatisfiable at a pre-lockfile commit. 3. Generated the lockfile with gh actions-lock. 4. Hand-added the reusable-workflow caller entries the tool omits, as '': []. Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without, because every workflow a lockfile OMITS is rejected. A PARTIAL lock is worse than none - running gh actions-lock and stopping there is how this outage spread. 5. Restored SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps with head -1. Verified before push: 0 unparseable workflows, lockfile covers every workflow with no omissions, SPDX on line 1 in every file. Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead -> 0 startup_failure, 13 running. Co-Authored-By: Claude Opus 5 --- .github/workflows/actions.lock | 22 +++++++++++----------- .github/workflows/cflite_batch.yml | 3 ++- .github/workflows/cflite_pr.yml | 3 ++- .github/workflows/checker-scaling.yml | 1 + .github/workflows/codeql.yml | 5 +++-- .github/workflows/coverage.yml | 1 + .github/workflows/governance.yml | 3 ++- .github/workflows/hypatia-scan.yml | 3 ++- .github/workflows/mirror.yml | 3 ++- .github/workflows/pages.yml | 1 + .github/workflows/proofs.yml | 1 + .github/workflows/push-email-notify.yml | 3 ++- .github/workflows/scorecard.yml | 3 ++- .github/workflows/secret-scanner.yml | 4 +++- .github/workflows/spark-theatre-gate.yml | 3 ++- .github/workflows/stack-depth.yml | 1 + 16 files changed, 38 insertions(+), 22 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index b7d75a2..56e1ddf 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -5,11 +5,11 @@ version: 'v0.0.2' workflows: '.github/workflows/cflite_batch.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'github/codeql-action@5595ccaf912efad79be6eef63a5619ff05969be3' + - 'github/codeql-action@v4.37.8' - 'google/clusterfuzzlite@884713a6c30a92e5e8544c39945cd7cb630abcd1' '.github/workflows/cflite_pr.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'github/codeql-action@5595ccaf912efad79be6eef63a5619ff05969be3' + - 'github/codeql-action@v4.37.8' - 'google/clusterfuzzlite@884713a6c30a92e5e8544c39945cd7cb630abcd1' '.github/workflows/checker-scaling.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' @@ -17,7 +17,7 @@ workflows: - 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' '.github/workflows/codeql.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'github/codeql-action@5595ccaf912efad79be6eef63a5619ff05969be3' + - 'github/codeql-action@v4.37.8' '.github/workflows/coverage.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' @@ -35,7 +35,7 @@ workflows: '.github/workflows/proofs.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/push-email-notify.yml': - - 'dawidd6/action-send-mail@8de3c312702ac7a63fc4035d45a2a51811eb669a' + - 'dawidd6/action-send-mail@v3.12.0' '.github/workflows/scorecard.yml': - 'hyperpolymath/standards@08586a12bb64b98268fe9ebf552998aa2433a3c2' '.github/workflows/secret-scanner.yml': @@ -78,9 +78,9 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' - 'dawidd6/action-send-mail@8de3c312702ac7a63fc4035d45a2a51811eb669a': + 'dawidd6/action-send-mail@v3.12.0': ref: 'v3.12.0' - commit: 'sha1-8de3c312702ac7a63fc4035d45a2a51811eb669a' + commit: 'sha1-0bbdab096651ee93f37ec02383e088183d41ff0b' owner_id: 9713907 repo_id: 222439721 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed': @@ -108,16 +108,16 @@ dependencies: commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' owner_id: 47606891 repo_id: 331103973 - 'github/codeql-action@5595ccaf912efad79be6eef63a5619ff05969be3': - ref: 'v4.37.6' - commit: 'sha1-5595ccaf912efad79be6eef63a5619ff05969be3' - owner_id: 9919 - repo_id: 259445878 'github/codeql-action@f205ea1c3313d32999d8d6a48b4f6530d4437b38': ref: 'v4.37.4' commit: 'sha1-f205ea1c3313d32999d8d6a48b4f6530d4437b38' owner_id: 9919 repo_id: 259445878 + 'github/codeql-action@v4.37.8': + ref: 'v4.37.8' + commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' + owner_id: 9919 + repo_id: 259445878 'google/clusterfuzzlite@884713a6c30a92e5e8544c39945cd7cb630abcd1': ref: '884713a6c30a92e5e8544c39945cd7cb630abcd1' commit: 'sha1-884713a6c30a92e5e8544c39945cd7cb630abcd1' diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml index 23db00e..0fba370 100644 --- a/.github/workflows/cflite_batch.yml +++ b/.github/workflows/cflite_batch.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell name: ClusterFuzzLite Batch @@ -29,7 +30,7 @@ jobs: sanitizer: ${{ matrix.sanitizer }} mode: batch output-sarif: true - - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v3 + - uses: github/codeql-action/upload-sarif@v4.37.8 # Only upload when a SARIF was actually produced: a CLEAN fuzz run # (no crashes) writes no `vulnerabilities.sarif`, and an unconditional # `always()` upload then fails with "Path does not exist". diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml index 6fffa29..ad6f9c1 100644 --- a/.github/workflows/cflite_pr.yml +++ b/.github/workflows/cflite_pr.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell name: ClusterFuzzLite PR @@ -32,7 +33,7 @@ jobs: sanitizer: ${{ matrix.sanitizer }} mode: code-change output-sarif: true - - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v3 + - uses: github/codeql-action/upload-sarif@v4.37.8 # Only upload when a SARIF was actually produced: a CLEAN fuzz run # (no crashes) writes no `vulnerabilities.sarif`, and an unconditional # `always()` upload then fails with "Path does not exist". diff --git a/.github/workflows/checker-scaling.yml b/.github/workflows/checker-scaling.yml index 0ee93b7..70d4e35 100644 --- a/.github/workflows/checker-scaling.yml +++ b/.github/workflows/checker-scaling.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell # Checker allocation-scaling harness for hyperpolymath/my-lang#14. diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index bcab5c8..0d4ace7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell name: CodeQL Security Analysis @@ -35,11 +36,11 @@ jobs: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/init@v4.37.8 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/analyze@v4.37.8 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index e78d675..65ca37d 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell # Line/region coverage for the Rust workspace via cargo-llvm-cov. diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index afe5027..414cca0 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell name: Governance @@ -16,4 +17,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index eaaee4a..251da4a 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell name: Hypatia Security Scan @@ -19,4 +20,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index c26d607..68715e6 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell name: Mirror to Git Forges @@ -11,5 +12,5 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a secrets: inherit diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 9054bfc..84d4f25 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell name: GitHub Pages (Ddraig SSG) diff --git a/.github/workflows/proofs.yml b/.github/workflows/proofs.yml index db09d1e..8e5552b 100644 --- a/.github/workflows/proofs.yml +++ b/.github/workflows/proofs.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell # Proof CI — machine-checks the mechanised Solo-core on BOTH tracks. diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 88744e3..93c9aab 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell # Dormant push-email notification. ARMED by setting the repo variable @@ -18,7 +19,7 @@ jobs: timeout-minutes: 5 steps: - name: Send push notification email - uses: dawidd6/action-send-mail@0bbdab096651ee93f37ec02383e088183d41ff0b # pinned + uses: dawidd6/action-send-mail@v3.12.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 819210e..68703f5 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell name: OSSF Scorecard @@ -16,7 +17,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a permissions: # A job-level permissions: block REPLACES the workflow-level one — it does # not merge. Omitting actions: read here (granted above) made the called diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index a290590..3f74c0b 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell name: Secret Scanner @@ -10,10 +11,11 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read jobs: scan: permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@db12a6ad3ef9076d5f7bdcf98d7d15cf8547555a + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a secrets: inherit diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml index b54e169..2d4ddb8 100644 --- a/.github/workflows/spark-theatre-gate.yml +++ b/.github/workflows/spark-theatre-gate.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell # Estate SPARK Theatre Gate — thin caller of the reusable workflow in @@ -15,7 +16,7 @@ permissions: contents: read jobs: spark-theatre-gate: - uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 + uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@84355587cb2a1f86e6882de83514a32db2646e7a with: paths: "." enforce_zero_contract: false diff --git a/.github/workflows/stack-depth.yml b/.github/workflows/stack-depth.yml index 8bb881d..68753bc 100644 --- a/.github/workflows/stack-depth.yml +++ b/.github/workflows/stack-depth.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell # Stack-depth budget guard for hyperpolymath/my-lang#37.