Skip to content

Commit 1225296

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
authored
fix(ci): adopt Actions dependency lockfile (estate startup_failure remediation) (#102)
Estate sweep: this repo's every workflow has been `startup_failure` under GitHub's workflow-lockfile enforcement. Applies the template proven on haec (#46/#48) and echidna (#341): `actions.lock`, SPDX-first header order, hand-added entries for tool-skipped workflows, standards reusables re-pinned past the standards lockfile boundary (`5a597720`), illegal `timeout-minutes` stripped from reusable jobs, lockfile-aware SHA-pin lint. The PR's own check runs are the test: executing checks (even failures) = enforcement satisfied. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
1 parent f0f5f5b commit 1225296

10 files changed

Lines changed: 82 additions & 14 deletions

File tree

‎.github/workflows/actions.lock‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# This file is machine-generated by `gh actions-lock`.
2+
# Do not edit by hand; run `gh actions-lock` to update.
3+
# Docs: https://gh.io/actions-lockfile
4+
version: 'v0.0.2'
5+
workflows:
6+
'.github/workflows/codeql.yml':
7+
- 'actions/checkout@v7.0.1'
8+
- 'github/codeql-action@v4.37.4'
9+
'.github/workflows/governance.yml': []
10+
'.github/workflows/hypatia-scan.yml': []
11+
'.github/workflows/instant-sync.yml':
12+
- 'peter-evans/repository-dispatch@v4.0.1'
13+
'.github/workflows/mirror.yml': []
14+
'.github/workflows/pages.yml':
15+
- 'actions/checkout@v7.0.1'
16+
- 'actions/deploy-pages@v5.0.0'
17+
- 'actions/upload-pages-artifact@v5.0.0'
18+
'.github/workflows/push-email-notify.yml':
19+
- 'dawidd6/action-send-mail@v3.12.0'
20+
'.github/workflows/scorecard.yml': []
21+
'.github/workflows/secret-scanner.yml': []
22+
dependencies:
23+
'actions/checkout@v7.0.1':
24+
ref: 'v7.0.1'
25+
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
26+
owner_id: 44036562
27+
repo_id: 197814629
28+
'actions/deploy-pages@v5.0.0':
29+
ref: 'v5.0.0'
30+
commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128'
31+
owner_id: 44036562
32+
repo_id: 438112499
33+
'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
34+
ref: 'v7.0.0'
35+
commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
36+
owner_id: 44036562
37+
repo_id: 192625955
38+
'actions/upload-pages-artifact@v5.0.0':
39+
ref: 'v5.0.0'
40+
commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
41+
owner_id: 44036562
42+
repo_id: 496012378
43+
uses:
44+
- 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
45+
'dawidd6/action-send-mail@v3.12.0':
46+
ref: 'v3.12.0'
47+
commit: 'sha1-2e600f3776677e493bf0da7aaec39a586d19a5ed'
48+
owner_id: 9713907
49+
repo_id: 222439721
50+
'github/codeql-action@v4.37.4':
51+
ref: 'v4.37.4'
52+
commit: 'sha1-f205ea1c3313d32999d8d6a48b4f6530d4437b38'
53+
owner_id: 9919
54+
repo_id: 259445878
55+
'peter-evans/repository-dispatch@v4.0.1':
56+
ref: 'v4.0.1'
57+
commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
58+
owner_id: 18365890
59+
repo_id: 220359305

‎.github/workflows/codeql.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
name: CodeQL Security Analysis
34

45
on:
@@ -37,15 +38,15 @@ jobs:
3738

3839
steps:
3940
- name: Checkout
40-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
41+
uses: actions/checkout@v7.0.1
4142

4243
- name: Initialize CodeQL
43-
uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
44+
uses: github/codeql-action/init@v4.37.4
4445
with:
4546
languages: ${{ matrix.language }}
4647
build-mode: ${{ matrix.build-mode }}
4748

4849
- name: Perform CodeQL Analysis
49-
uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
50+
uses: github/codeql-action/analyze@v4.37.4
5051
with:
5152
category: "/language:${{ matrix.language }}"

‎.github/workflows/governance.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
name: Governance
34

45
on:
@@ -14,4 +15,4 @@ permissions:
1415

1516
jobs:
1617
governance:
17-
uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
18+
uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4

‎.github/workflows/hypatia-scan.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
name: Hypatia Security Scan
34

45
on:
@@ -17,4 +18,4 @@ permissions:
1718

1819
jobs:
1920
scan:
20-
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
21+
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4

‎.github/workflows/instant-sync.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
# Instant Forge Sync - Triggers propagation to all forges on push/release
34
name: Instant Sync
45

@@ -18,7 +19,7 @@ jobs:
1819
timeout-minutes: 15
1920
steps:
2021
- name: Trigger Propagation
21-
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
22+
uses: peter-evans/repository-dispatch@v4.0.1
2223
with:
2324
token: ${{ secrets.FARM_DISPATCH_TOKEN }}
2425
repository: hyperpolymath/.git-private-farm

‎.github/workflows/mirror.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
name: Mirror to Git Forges
34

45
on:
@@ -12,5 +13,5 @@ permissions:
1213

1314
jobs:
1415
mirror:
15-
uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
16+
uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4
1617
secrets: inherit

‎.github/workflows/pages.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
name: GitHub Pages (Ddraig SSG)
34
on:
45
push:
@@ -20,9 +21,9 @@ jobs:
2021
image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
2122
steps:
2223
- name: Checkout Site
23-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
24+
uses: actions/checkout@v7.0.1
2425
- name: Checkout Ddraig SSG
25-
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
26+
uses: actions/checkout@v7.0.1
2627
with:
2728
repository: hyperpolymath/ddraig-ssg
2829
path: .ddraig-ssg
@@ -39,7 +40,7 @@ jobs:
3940
fi
4041
./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/}
4142
- name: Upload artifact
42-
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
43+
uses: actions/upload-pages-artifact@v5.0.0
4344
with:
4445
path: '_site'
4546
deploy:
@@ -52,4 +53,4 @@ jobs:
5253
steps:
5354
- name: Deploy to GitHub Pages
5455
id: deployment
55-
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
56+
uses: actions/deploy-pages@v5.0.0

‎.github/workflows/push-email-notify.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
# Dormant push-email notification. ARMED by setting the repo variable
34
# PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
45
# sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by
@@ -16,7 +17,7 @@ jobs:
1617
runs-on: ubuntu-latest
1718
steps:
1819
- name: Send push notification email
19-
uses: dawidd6/action-send-mail@2e600f3776677e493bf0da7aaec39a586d19a5ed # pinned
20+
uses: dawidd6/action-send-mail@v3.12.0
2021
with:
2122
server_address: ${{ secrets.SMTP_HOST }}
2223
server_port: ${{ secrets.SMTP_PORT }}

‎.github/workflows/scorecard.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
name: OSSF Scorecard
34

45
on:
@@ -14,7 +15,7 @@ permissions:
1415

1516
jobs:
1617
scorecard:
17-
uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
18+
uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4
1819
permissions:
1920
contents: read
2021
security-events: write

‎.github/workflows/secret-scanner.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
name: Secret Scanner
34

45
on:
@@ -20,5 +21,5 @@ jobs:
2021
contents: read
2122
pull-requests: write
2223
actions: read
23-
uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
24+
uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4
2425
secrets: inherit

0 commit comments

Comments
 (0)