From affa8dcd28f93c4609d1ece5a01761a424e131fb Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" Date: Thu, 15 Oct 2026 15:28:13 +0100 Subject: [PATCH 1/2] ci: close the lock, bump the standards pin The lock disease measured in today's survey (reposystem#319): dangling edges killed locked workflows at startup with jobs=0. Lock regenerated transitively closed (v0.0.3); the standards caller unified to 94572e6 (current main, whose lock-gate helpers know gh-actions-lock v0.2.0). Verified: the standards wrapper --verify-local exits 0. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/actions.lock | 35 ++++++++++++++++++++++------ .github/workflows/codeql.yml | 2 +- .github/workflows/proofs.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 4 files changed, 31 insertions(+), 10 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 011c480..b6e9bc3 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -1,23 +1,29 @@ # This file is machine-generated by `gh actions-lock`. # Do not edit by hand; run `gh actions-lock` to update. # Docs: https://gh.io/actions-lockfile -version: 'v0.0.2' +# +# Regenerated 2026-10-15 to close every dangling edge (the startup_failure cause) +# and onboard all 36 workflows. Verified with scripts/check-lock-sync.sh locally. +version: 'v0.0.3' workflows: '.github/workflows/codeql.yml': - - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'actions/checkout@v7.0.1' - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' '.github/workflows/documentation-integrity.yml': [] '.github/workflows/label-triage.yml': [] '.github/workflows/labels.yml': [] - '.github/workflows/main-estate-audit.yml': [] + '.github/workflows/main-estate-audit.yml': + - 'hyperpolymath/cicd-suite@376898bbe872226866ccbc7648d43123b8bb21b9' '.github/workflows/proofs.yml': - - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'actions/checkout@v7.0.1' '.github/workflows/push-email-notify.yml': - 'hyperpolymath/smtp-notify-action@v0.2.0' - '.github/workflows/scorecard.yml': [] - '.github/workflows/secret-scanner.yml': [] + '.github/workflows/scorecard.yml': + - 'hyperpolymath/standards@main' + '.github/workflows/secret-scanner.yml': + - 'hyperpolymath/standards@94572e612a7bf11f8e6343d19adadf17ef2a3de3' dependencies: - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': + 'actions/checkout@v7.0.1': ref: 'v7.0.1' commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' owner_id: 44036562 @@ -27,8 +33,23 @@ dependencies: commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' owner_id: 9919 repo_id: 259445878 + 'hyperpolymath/cicd-suite@376898bbe872226866ccbc7648d43123b8bb21b9': + ref: '376898bbe872226866ccbc7648d43123b8bb21b9' + commit: 'sha1-376898bbe872226866ccbc7648d43123b8bb21b9' + owner_id: 6759885 + repo_id: 1326697643 'hyperpolymath/smtp-notify-action@v0.2.0': ref: 'v0.2.0' commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7' owner_id: 6759885 repo_id: 1352485172 + 'hyperpolymath/standards@94572e612a7bf11f8e6343d19adadf17ef2a3de3': + ref: '94572e612a7bf11f8e6343d19adadf17ef2a3de3' + commit: 'sha1-94572e612a7bf11f8e6343d19adadf17ef2a3de3' + owner_id: 6759885 + repo_id: 1116521501 + 'hyperpolymath/standards@main': + ref: 'main' + commit: 'sha1-68242e650c0bd83bbf280f3b578fa949c0ab4c16' + owner_id: 6759885 + repo_id: 1116521501 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 046f3f3..95a8198 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -57,7 +57,7 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 # Add any setup steps before running the `github/codeql-action/init` action. # This includes steps like installing compilers or runtimes (`actions/setup-node` diff --git a/.github/workflows/proofs.yml b/.github/workflows/proofs.yml index ffc0d6c..0caf7dd 100644 --- a/.github/workflows/proofs.yml +++ b/.github/workflows/proofs.yml @@ -33,7 +33,7 @@ jobs: apt-get update apt-get install --no-install-recommends -y ca-certificates git agda-bin=2.6.4.3-1+b2 agda-stdlib=2.1-4 - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Verify the checked Agda version diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index abb6ce4..ede150a 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -20,5 +20,5 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@94572e612a7bf11f8e6343d19adadf17ef2a3de3 secrets: inherit From 211f3f11766278fa5f6b284351e1ba96358ab35b Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Thu, 15 Oct 2026 15:47:23 +0000 Subject: [PATCH 2/2] ci: pin checkout to its commit SHA in CodeQL, proofs, and the action lockfile --- .github/workflows/actions.lock | 8 ++++---- .github/workflows/codeql.yml | 2 +- .github/workflows/proofs.yml | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index b6e9bc3..bcff78a 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -7,7 +7,7 @@ version: 'v0.0.3' workflows: '.github/workflows/codeql.yml': - - 'actions/checkout@v7.0.1' + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' '.github/workflows/documentation-integrity.yml': [] '.github/workflows/label-triage.yml': [] @@ -15,7 +15,7 @@ workflows: '.github/workflows/main-estate-audit.yml': - 'hyperpolymath/cicd-suite@376898bbe872226866ccbc7648d43123b8bb21b9' '.github/workflows/proofs.yml': - - 'actions/checkout@v7.0.1' + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/push-email-notify.yml': - 'hyperpolymath/smtp-notify-action@v0.2.0' '.github/workflows/scorecard.yml': @@ -23,8 +23,8 @@ workflows: '.github/workflows/secret-scanner.yml': - 'hyperpolymath/standards@94572e612a7bf11f8e6343d19adadf17ef2a3de3' dependencies: - 'actions/checkout@v7.0.1': - ref: 'v7.0.1' + 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': + ref: '3d3c42e5aac5ba805825da76410c181273ba90b1' commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' owner_id: 44036562 repo_id: 197814629 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 95a8198..046f3f3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -57,7 +57,7 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Add any setup steps before running the `github/codeql-action/init` action. # This includes steps like installing compilers or runtimes (`actions/setup-node` diff --git a/.github/workflows/proofs.yml b/.github/workflows/proofs.yml index 0caf7dd..ffc0d6c 100644 --- a/.github/workflows/proofs.yml +++ b/.github/workflows/proofs.yml @@ -33,7 +33,7 @@ jobs: apt-get update apt-get install --no-install-recommends -y ca-certificates git agda-bin=2.6.4.3-1+b2 agda-stdlib=2.1-4 - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Verify the checked Agda version