chore(ci): key actions.lock by the SHA the workflows actually name

The previous attempt used `gh actions-lock --relock`. That flag does not mean
"regenerate" — it means "bump moved branch/version refs to their current
upstream SHA", so it re-resolved everything to latest and wrote a lockfile
keyed by TAG (`actions/checkout@v7.0.1`) while every workflow in this repo
names a SHA (`actions/checkout@3d3c42e5... # v7.0.1`).

That shape contradicts the estate's validator, which keys on `owner/repo@<40-
hex>` exactly as written and sub-path-normalised (`github/codeql-action/
init@X` is keyed once as `github/codeql-action@X`). GitHub rejected the lot
at startup:

    The lockfile could not be validated. Regenerate it by running
    `gh actions-lock`.

Measured against hyperpolymath/standards .githooks/validate-actions-lock.sh:
the lockfile on main is missing 10 of the 14 required SHA keys. This one is
missing none — 16 SHA-pinned refs checked, 16 lockfile keys, 0 errors.

The workflow now regenerates with plain fix mode plus
--no-migrate-local-actions --no-narrow, which is the canonical invocation,
and refuses to let a regeneration rewrite the workflow files underneath it.

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

Author: hyperpolymath

.github/workflows/actions-lock.yml

@@ -199,6 +199,18 @@ jobs:
           set -euo pipefail
           gh extension install github/gh-actions-lock --pin "$ACTIONS_LOCK_EXTENSION_VERSION"
 
+      # NOT --relock. --relock means "bump moved branch/version refs to their
+      # current upstream SHA", so it upgrades every ref to latest and writes a
+      # lockfile keyed by TAG — which is the wrong shape for a repo whose
+      # workflows are SHA-pinned. The estate's validator keys on
+      # `owner/repo@<40-hex>` exactly as written in the workflow, so a
+      # tag-keyed lockfile contradicts every workflow in the repo and GitHub
+      # rejects the lot at startup with "The lockfile could not be validated."
+      #
+      # Plain fix mode with --no-migrate-local-actions --no-narrow is the
+      # canonical regeneration: it keys each entry by the ref the workflow
+      # actually names. See hyperpolymath/standards
+      # .githooks/validate-actions-lock.sh.
       - name: Regenerate the lockfile
         id: regenerate
         env:
@@ -207,7 +219,8 @@ jobs:
           set -uo pipefail
           set +e
           code=0
-          gh actions-lock --relock --no-interactive >relock.out 2>relock.err || code=$?
+          gh actions-lock --no-migrate-local-actions --no-narrow --no-interactive \
+            >relock.out 2>relock.err || code=$?
           cat relock.out || true
           cat relock.err || true
           # A non-zero exit here does NOT mean nothing was written. The tool
@@ -216,11 +229,24 @@ jobs:
           # invalidate the file. "The file did not change" is the real
           # failure, and that is checked below.
           if [ "$code" -ne 0 ]; then
-            echo "::warning::gh actions-lock --relock exited ${code}; the regenerated lockfile is still delivered if it changed"
+            echo "::warning::gh actions-lock exited ${code}; the regenerated lockfile is still delivered if it changed"
             while IFS= read -r line; do
               if [ -n "$line" ]; then echo "::warning::[gh actions-lock] ${line}"; fi
             done < <(tail -n 30 relock.err | tr -d '\r' | cut -c1-200)
           fi
+
+          # Regenerating the lockfile must not rewrite the workflows. If it
+          # did, the file it just wrote describes a tree that is not on disk —
+          # name the files, then put them back and keep only the lockfile.
+          touched="$(git status --porcelain -- '.github/workflows/*.yml' '.github/workflows/*.yaml' || true)"
+          if [ -n "$touched" ]; then
+            echo "::warning::gh actions-lock modified workflow files while regenerating the lockfile; they have been reverted and only actions.lock is kept"
+            while IFS= read -r line; do
+              if [ -n "$line" ]; then echo "::warning::[workflow touched] ${line}"; fi
+            done <<< "$touched"
+            git checkout -- .github/workflows || true
+          fi
+
           if git diff --quiet -- .github/workflows/actions.lock; then
             echo "changed=false" >> "$GITHUB_OUTPUT"
             echo "::error::gh actions-lock produced no change to actions.lock — the branch stays unstartable and the file must be regenerated by hand"

.github/workflows/actions.lock

@@ -4,57 +4,57 @@
 version: 'v0.0.2'
 workflows:
     '.github/workflows/abi-contract.yml':
-        - 'actions/checkout@v7.0.1'
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/actions-lock.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'actions/upload-artifact@v7.0.1'
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
     '.github/workflows/boj-build.yml':
-        - 'actions/checkout@v7.0.1'
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/casket-pages.yml':
-        - 'actions/cache@v6.1.0'
-        - 'actions/checkout@v7.0.1'
-        - 'actions/configure-pages@v6.0.0'
-        - 'actions/deploy-pages@v5.0.1'
-        - 'actions/upload-pages-artifact@v5.0.0'
+        - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d'
+        - 'actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346'
+        - 'actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9'
     '.github/workflows/codeql.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'github/codeql-action@v4.38.2'
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'github/codeql-action@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2'
     '.github/workflows/cross-platform.yml':
-        - 'actions/cache@v6.1.0'
-        - 'actions/checkout@v7.0.1'
+        - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/dogfood-gate.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'hyperpolymath/deed-ecosystem@main'
-        - 'hyperpolymath/k9-ecosystem@main'
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'hyperpolymath/deed-ecosystem@3e69929a4b0b5610b477732ee125a156cbc8a040'
+        - 'hyperpolymath/k9-ecosystem@20f6be5b5a14a48680b236955b5c4ad9033d00d4'
     '.github/workflows/governance.yml': []
     '.github/workflows/hypatia-scan.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'actions/github-script@v9.0.0'
-        - 'actions/upload-artifact@v7.0.1'
-        - 'erlef/setup-beam@v1.24.1'
-        - 'github/codeql-action@v4.38.2'
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3'
+        - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
+        - 'github/codeql-action@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2'
     '.github/workflows/instant-sync.yml': []
     '.github/workflows/label-triage.yml': []
     '.github/workflows/labels.yml': []
     '.github/workflows/mirror.yml': []
     '.github/workflows/push-email-notify.yml':
-        - 'hyperpolymath/smtp-notify-action@v0.3.0'
+        - 'hyperpolymath/smtp-notify-action@22e7bdb322c430c1d0dac6b3bb307f4bb139d0be'
     '.github/workflows/release.yml':
-        - 'actions/attest-build-provenance@v4.2.2'
-        - 'actions/checkout@v7.0.1'
-        - 'actions/download-artifact@v8.0.1'
-        - 'actions/upload-artifact@v7.0.1'
+        - 'actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8'
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
+        - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
     '.github/workflows/rhodibot.yml':
-        - 'actions/checkout@v7.0.1'
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/scorecard.yml': []
     '.github/workflows/secret-scanner.yml': []
     '.github/workflows/static-analysis-gate.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'actions/download-artifact@v8.0.1'
-        - 'actions/upload-artifact@v7.0.1'
-        - 'erlef/setup-beam@v1.24.1'
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
+        - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
 dependencies:
-    'actions/attest-build-provenance@v4.2.2':
+    'actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8':
         ref: 'v4.2.2'
         commit: 'sha1-4d101475d8b20a2381f78447822ac1eab6504dd8'
         owner_id: 44036562
@@ -66,74 +66,74 @@ dependencies:
         commit: 'sha1-508db95dd578ae2727ebd6217d5ba78e4fbda05d'
         owner_id: 44036562
         repo_id: 760701061
-    'actions/cache@v6.1.0':
+    'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
         ref: 'v6.1.0'
         commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
         owner_id: 44036562
         repo_id: 215566462
-    'actions/checkout@v7.0.1':
+    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
         ref: 'v7.0.1'
         commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
         owner_id: 44036562
         repo_id: 197814629
-    'actions/configure-pages@v6.0.0':
+    'actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d':
         ref: 'v6.0.0'
         commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d'
         owner_id: 44036562
         repo_id: 513659658
-    'actions/deploy-pages@v5.0.1':
+    'actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346':
         ref: 'v5.0.1'
         commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
         owner_id: 44036562
         repo_id: 438112499
-    'actions/download-artifact@v8.0.1':
+    'actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c':
         ref: 'v8.0.1'
         commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
         owner_id: 44036562
         repo_id: 192626254
-    'actions/github-script@v9.0.0':
+    'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3':
         ref: 'v9.0.0'
         commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3'
         owner_id: 44036562
         repo_id: 205262760
+    'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a':
+        ref: 'v7.0.1'
+        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        owner_id: 44036562
+        repo_id: 192625955
     'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
         ref: 'v7.0.0'
         commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
         owner_id: 44036562
         repo_id: 192625955
-    'actions/upload-artifact@v7.0.1':
-        ref: 'v7.0.1'
-        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
-        owner_id: 44036562
-        repo_id: 192625955
-    'actions/upload-pages-artifact@v5.0.0':
+    'actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9':
         ref: 'v5.0.0'
         commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
         owner_id: 44036562
         repo_id: 496012378
         uses:
             - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
-    'erlef/setup-beam@v1.24.1':
+    'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
         ref: 'v1.24.1'
         commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
         owner_id: 47606891
         repo_id: 331103973
-    'github/codeql-action@v4.38.2':
+    'github/codeql-action@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2':
         ref: 'v4.38.2'
         commit: 'sha1-2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2'
         owner_id: 9919
         repo_id: 259445878
-    'hyperpolymath/deed-ecosystem@main':
+    'hyperpolymath/deed-ecosystem@3e69929a4b0b5610b477732ee125a156cbc8a040':
         ref: 'main'
         commit: 'sha1-3e69929a4b0b5610b477732ee125a156cbc8a040'
         owner_id: 6759885
         repo_id: 1275649586
-    'hyperpolymath/k9-ecosystem@main':
+    'hyperpolymath/k9-ecosystem@20f6be5b5a14a48680b236955b5c4ad9033d00d4':
         ref: 'main'
         commit: 'sha1-20f6be5b5a14a48680b236955b5c4ad9033d00d4'
         owner_id: 6759885
         repo_id: 1275650185
-    'hyperpolymath/smtp-notify-action@v0.3.0':
+    'hyperpolymath/smtp-notify-action@22e7bdb322c430c1d0dac6b3bb307f4bb139d0be':
         ref: 'v0.3.0'
         commit: 'sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be'
         owner_id: 6759885