From c9f2afa83465ac09c3eab5427b3938ef167bedbd Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 6 Oct 2026 14:15:28 +0100 Subject: [PATCH] fix(lock): relock actions.lock after the rust-toolchain bump (#1157) #1157 bumped dtolnay/rust-toolchain to 7e38f4b in mirror-reusable.yml and rust-ci-reusable.yml without regenerating .github/workflows/actions.lock and merged with all four lock contexts red (only scan / gitleaks is required on main). GitHub validates a reusable callee's lock at the pinned SHA, so every caller pinned at or after 8556163 dies at startup (conclusion failure, jobs=0, no check-run) - measured on metadatastician/ZenodoDeposits.jl#13. Regenerated with the estate repair order, no hand edits: gh actions-lock -> relock-sha-keys.sh -> complete-job-refs.sh -> close-lock.sh -> prune-stale.sh, every file except the lock restored. Net effect against 5751b97: - mirror-reusable.yml and rust-ci-reusable.yml entries move from 02cb101 to 7e38f4b; the orphaned 02cb101 record is retired, a 7e38f4b record added. - close-lock adds the missing dependencies record for hyperpolymath/standards@571cc734, which mirror.yml and ci-pipeline.yml named without one. On main mirror.yml dies at startup with "Invalid lockfile" and self-ci.yml (which calls ci-pipeline.yml) creates no jobs; the mirror.yml dispatch on this branch is the test of that cure. - The duplicate actions/checkout@v7.0.1 key is merged into the SHA key; setup-zig and harden-runner refs are normalised to their SHA form. - The orphan asana/push-signed-commits@d615ca8 record (named by no workflow entry; its nested actions/setup-python@v2 had no record) is dropped by gh actions-lock. signed-push-smoke.yml's entry is unchanged. Local gates on this lock: update-actions-lock.sh --verify-local rc=0, check-lock-sync.sh rc=0, check-actions-lock-gate.sh rc=0. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_012kgrMQRhSmZMBbF9Ui1zBw --- .github/workflows/actions.lock | 33 +++++++++++++-------------------- 1 file changed, 13 insertions(+), 20 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 382a72ba5..779b73296 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -95,7 +95,7 @@ workflows: - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/mirror-reusable.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de' + - 'dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067' - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' '.github/workflows/mirror.yml': - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd' @@ -124,7 +124,7 @@ workflows: - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/rust-ci-reusable.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de' + - 'dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067' - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406' - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' '.github/workflows/scorecard-enforcer.yml': @@ -169,12 +169,7 @@ dependencies: owner_id: 44036562 repo_id: 215566462 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': - ref: 'v7.0.1' - commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' - owner_id: 44036562 - repo_id: 197814629 - 'actions/checkout@v7.0.1': - ref: 'v7.0.1' + ref: '3d3c42e5aac5ba805825da76410c181273ba90b1' commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' owner_id: 44036562 repo_id: 197814629 @@ -220,16 +215,9 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' - 'asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897': - ref: 'v1.3' - commit: 'sha1-d615ca88d8e1a946734c24970d1e7a6c56f34897' - owner_id: 1472111 - repo_id: 772313726 - uses: - - 'actions/setup-python@v2' - 'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de': - ref: '02cb101ec7c40f2c49e1d9714d64511d8e1b74de' - commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de' + 'dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067': + ref: 'v1' + commit: 'sha1-7e38f4b43b4db5c8dd498af069a4f6196df1d067' owner_id: 1940490 repo_id: 260749683 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393': @@ -248,7 +236,7 @@ dependencies: owner_id: 9919 repo_id: 259445878 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406': - ref: 'v2.2.1' + ref: 'abea47f85e598557f500fa1fd2ab7464fcb39406' commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406' owner_id: 1006268 repo_id: 212984112 @@ -257,6 +245,11 @@ dependencies: commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d' owner_id: 75048950 repo_id: 623796603 + 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd': + ref: '571cc734cd69fb846032ec77a662aa8ee4fc32cd' + commit: 'sha1-571cc734cd69fb846032ec77a662aa8ee4fc32cd' + owner_id: 6759885 + repo_id: 1116521501 'ocaml/setup-ocaml@93303b622b2522e4411e295f9e77411a24912ac7': ref: '93303b622b2522e4411e295f9e77411a24912ac7' commit: 'sha1-93303b622b2522e4411e295f9e77411a24912ac7' @@ -278,7 +271,7 @@ dependencies: owner_id: 18365890 repo_id: 220359305 'step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1': - ref: 'v2.21.1' + ref: 'e14015d583714f6e62063499dc959a02595150a1' commit: 'sha1-e14015d583714f6e62063499dc959a02595150a1' owner_id: 88700172 repo_id: 422287306