From b46be6de880be0f5577bdf5c81deabe6f881f22f Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 11:57:15 +0000 Subject: [PATCH 1/4] CI: OSSF Scorecard runs on its schedule again #33 locked scorecard.yml's call into hyperpolymath/standards as `standards@main`, fixed at one commit, with no list of the actions that reusable workflow uses. Push and manual runs still passed, but every scheduled run since (2026-10-16 to 2026-10-19) died at job setup: "lockfile verification did not produce a result for this action ... github/codeql-action/upload-sarif@b96794f0: invalid lockfile pin". Before #33 the scheduled run got through setup. scorecard.yml now calls scorecard-reusable.yml at standards 75bd599, the commit a manual run on main passed with on 2026-10-19 (run 39247942827). Its lock record lists the four actions the reusable workflow uses, as the standards lock does for that file, and the two not yet recorded here (upload-artifact v7.0.2, scorecard-action v2.4.4) get records copied from the standards lock. The `standards@main` record goes. The lock header no longer says 36 workflows or cites a script this repository does not have. The lock is sorted with no dangling or unused entries; actionlint is clean; the documentation guard and 27 tests pass. A scheduled run can only be exercised on main, so the first 04:10 UTC run after merge is the decisive check. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV --- .github/workflows/actions.lock | 32 ++++++++++++++++++++++++-------- .github/workflows/scorecard.yml | 6 +++++- 2 files changed, 29 insertions(+), 9 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index bcff78a..f0b6bd6 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -2,8 +2,9 @@ # Do not edit by hand; run `gh actions-lock` to update. # Docs: https://gh.io/actions-lockfile # -# Regenerated 2026-10-15 to close every dangling edge (the startup_failure cause) -# and onboard all 36 workflows. Verified with scripts/check-lock-sync.sh locally. +# Regenerated 2026-10-15 to close every dangling edge (the startup_failure cause). +# A reusable workflow called on a schedule needs its nested actions listed +# under its record (`uses:`), as for hyperpolymath/standards@75bd5994 below. version: 'v0.0.3' workflows: '.github/workflows/codeql.yml': @@ -19,7 +20,7 @@ workflows: '.github/workflows/push-email-notify.yml': - 'hyperpolymath/smtp-notify-action@v0.2.0' '.github/workflows/scorecard.yml': - - 'hyperpolymath/standards@main' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/secret-scanner.yml': - 'hyperpolymath/standards@94572e612a7bf11f8e6343d19adadf17ef2a3de3' dependencies: @@ -28,6 +29,11 @@ dependencies: commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' owner_id: 44036562 repo_id: 197814629 + 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9': + ref: 'v7.0.2' + commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' + owner_id: 44036562 + repo_id: 192625955 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63': ref: 'b96794f015dfd88f77b49b1c93e0fa7110f94c63' commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' @@ -43,13 +49,23 @@ dependencies: commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7' owner_id: 6759885 repo_id: 1352485172 + 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': + ref: '75bd5994470661a099df562d6d5ad2fe744dbd66' + commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66' + owner_id: 6759885 + repo_id: 1116521501 + uses: + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' + - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' + - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' 'hyperpolymath/standards@94572e612a7bf11f8e6343d19adadf17ef2a3de3': ref: '94572e612a7bf11f8e6343d19adadf17ef2a3de3' commit: 'sha1-94572e612a7bf11f8e6343d19adadf17ef2a3de3' owner_id: 6759885 repo_id: 1116521501 - 'hyperpolymath/standards@main': - ref: 'main' - commit: 'sha1-68242e650c0bd83bbf280f3b578fa949c0ab4c16' - owner_id: 6759885 - repo_id: 1116521501 + 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': + ref: 'v2.4.4' + commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' + owner_id: 67707773 + repo_id: 421101922 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 81aa2e4..013abdc 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -26,7 +26,11 @@ permissions: jobs: scorecard: name: OSSF Scorecard Check - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@main + # Pinned by SHA, and locked in actions.lock with the four actions the + # reusable workflow uses. Locked at @main with no such list, every + # scheduled run died at job setup ("lockfile verification did not + # produce a result" for upload-sarif), 2026-10-16 to 2026-10-19. + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 permissions: actions: read contents: read From 1b199d17e4c03ea9348cee0bc9fa056571c1495f Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 12:23:08 +0000 Subject: [PATCH 2/4] CI: record release tags as refs, so job setup accepts the lock again Every job that resolves actions/checkout from this lock now dies at job setup: "Unable to resolve action actions/checkout@3d3c42e5: invalid lockfile pin". That covers the required Agda proof gate and scan / gitleaks, on this PR and on main (a manual run of proofs.yml on main at f5a4177 failed the same way today, run 39251522875; the same commit passed on 2026-10-15). The scheduled Scorecard failures since 2026-10-16 are the same error on the codeql-action record. Both records repeat the SHA as `ref`: checkout since #33, which changed it from 'v7.0.1', and codeql-action since #31. The standards lock, which gh actions-lock writes, records these SHA-keyed actions with their release tags as `ref` ('v7.0.1', 'v4.38.0'), and this lock did so for checkout until #33. Both records get their tags back; git ls-remote confirms v7.0.1 is 3d3c42e5 and v4.38.0 peels to b96794f0. The untagged workflow pins (cicd-suite, standards) keep the SHA as `ref`, as in the standards lock; the estate audit resolved its record fine on this PR. The lock stays sorted with no dangling or unused entries; the documentation guard passes. This PR's own runs are the check. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV --- .github/workflows/actions.lock | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index f0b6bd6..5e20515 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -5,6 +5,10 @@ # Regenerated 2026-10-15 to close every dangling edge (the startup_failure cause). # A reusable workflow called on a schedule needs its nested actions listed # under its record (`uses:`), as for hyperpolymath/standards@75bd5994 below. +# An action pinned by SHA at a release records the release tag as `ref`, as +# the standards lock does. With the SHA repeated as `ref`, job setup has +# refused the checkout and codeql-action records since 2026-10-16 ("invalid +# lockfile pin"). Untagged workflow pins keep the SHA as `ref`. version: 'v0.0.3' workflows: '.github/workflows/codeql.yml': @@ -25,7 +29,7 @@ workflows: - 'hyperpolymath/standards@94572e612a7bf11f8e6343d19adadf17ef2a3de3' dependencies: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': - ref: '3d3c42e5aac5ba805825da76410c181273ba90b1' + ref: 'v7.0.1' commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' owner_id: 44036562 repo_id: 197814629 @@ -35,7 +39,7 @@ dependencies: owner_id: 44036562 repo_id: 192625955 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63': - ref: 'b96794f015dfd88f77b49b1c93e0fa7110f94c63' + ref: 'v4.38.0' commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' owner_id: 9919 repo_id: 259445878 From 0f9dd8e9201c0902632ae92579d210580c35e76d Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 12:24:16 +0000 Subject: [PATCH 3/4] CI: list the Secret Scanner's nested action under its lock record With the refs fixed, the Agda gate and CodeQL get past job setup, but the three scan / * jobs (scan / gitleaks is required) still die there: "Unable to resolve action actions/checkout@3d3c42e5: invalid lockfile pin". That checkout is nested in secret-scanner-reusable.yml, and the hyperpolymath/standards@94572e6 record lists no nested actions. The Scorecard record, which lists its four, got past setup on this PR. The record now lists actions/checkout@3d3c42e5, the one action that workflow uses at 94572e6, as the standards lock at that commit records for it. The lock header says why such lists are needed. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV --- .github/workflows/actions.lock | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 5e20515..187cdd4 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -3,8 +3,9 @@ # Docs: https://gh.io/actions-lockfile # # Regenerated 2026-10-15 to close every dangling edge (the startup_failure cause). -# A reusable workflow called on a schedule needs its nested actions listed -# under its record (`uses:`), as for hyperpolymath/standards@75bd5994 below. +# A reusable workflow's record lists the actions it uses (`uses:`), as the +# standards lock does; without the list, its nested actions are refused at +# job setup (Scorecard since 2026-10-16, the Secret Scanner since 2026-10-19). # An action pinned by SHA at a release records the release tag as `ref`, as # the standards lock does. With the SHA repeated as `ref`, job setup has # refused the checkout and codeql-action records since 2026-10-16 ("invalid @@ -68,6 +69,8 @@ dependencies: commit: 'sha1-94572e612a7bf11f8e6343d19adadf17ef2a3de3' owner_id: 6759885 repo_id: 1116521501 + uses: + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': ref: 'v2.4.4' commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' From b7ab417e00e980a944c326f024dd353e21654556 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 12:26:01 +0000 Subject: [PATCH 4/4] CI: pin the Secret Scanner at standards 75bd599, as Scorecard The record's nested list did not help: scan / gitleaks (required), rust-secrets and shell-secrets still died at job setup on checkout. The actions a reusable workflow uses are resolved against the called repository's lock at the pinned commit, and the standards lock at 94572e6 records checkout and codeql-action with the SHA repeated as `ref`, the form job setup now refuses. At 75bd599 the standards lock records their tags, and Scorecard, pinned there, passes job setup on this PR. secret-scanner.yml moves to 75bd599. Between the two commits secret-scanner-reusable.yml changed only in its header, which now says callers must not pass `secrets: inherit`: the workflow declares and reads no secrets, and inherit forwards every secret the caller can see (CWE-250, standards#1108 6b). The caller drops it, and its own comment claiming inherit was required. The 94572e6 record goes; the 75bd599 record already lists checkout. The lock header now states the rule as observed, and scorecard.yml points to it. Lock sorted, no dangling or unused entries; actionlint clean; the documentation guard passes. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV --- .github/workflows/actions.lock | 22 ++++++++-------------- .github/workflows/scorecard.yml | 6 ++---- .github/workflows/secret-scanner.yml | 9 +++++---- 3 files changed, 15 insertions(+), 22 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 187cdd4..5376676 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -3,13 +3,14 @@ # Docs: https://gh.io/actions-lockfile # # Regenerated 2026-10-15 to close every dangling edge (the startup_failure cause). -# A reusable workflow's record lists the actions it uses (`uses:`), as the -# standards lock does; without the list, its nested actions are refused at -# job setup (Scorecard since 2026-10-16, the Secret Scanner since 2026-10-19). # An action pinned by SHA at a release records the release tag as `ref`, as -# the standards lock does. With the SHA repeated as `ref`, job setup has -# refused the checkout and codeql-action records since 2026-10-16 ("invalid -# lockfile pin"). Untagged workflow pins keep the SHA as `ref`. +# gh actions-lock writes it; untagged workflow pins keep the SHA. Since +# 2026-10-16 job setup refuses a tagged action whose record repeats the SHA +# as `ref` ("invalid lockfile pin"): in this lock, and, for the actions a +# reusable workflow uses, in the called repository's lock at the pinned +# commit. Both standards workflows are therefore pinned at 75bd5994, whose +# lock records tags; at 94572e6 it did not. Reusable-workflow records list +# the actions the workflow uses (`uses:`). version: 'v0.0.3' workflows: '.github/workflows/codeql.yml': @@ -27,7 +28,7 @@ workflows: '.github/workflows/scorecard.yml': - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/secret-scanner.yml': - - 'hyperpolymath/standards@94572e612a7bf11f8e6343d19adadf17ef2a3de3' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' dependencies: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': ref: 'v7.0.1' @@ -64,13 +65,6 @@ dependencies: - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' - 'hyperpolymath/standards@94572e612a7bf11f8e6343d19adadf17ef2a3de3': - ref: '94572e612a7bf11f8e6343d19adadf17ef2a3de3' - commit: 'sha1-94572e612a7bf11f8e6343d19adadf17ef2a3de3' - owner_id: 6759885 - repo_id: 1116521501 - uses: - - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': ref: 'v2.4.4' commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 013abdc..07f8fa0 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -26,10 +26,8 @@ permissions: jobs: scorecard: name: OSSF Scorecard Check - # Pinned by SHA, and locked in actions.lock with the four actions the - # reusable workflow uses. Locked at @main with no such list, every - # scheduled run died at job setup ("lockfile verification did not - # produce a result" for upload-sarif), 2026-10-16 to 2026-10-19. + # Pinned by SHA at a standards commit whose own lock records release + # tags as refs; see the actions.lock header. uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 permissions: actions: read diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index ede150a..6254c61 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -2,8 +2,9 @@ # Calls the estate's shared secret scanner (gitleaks + rust-secrets + # shell-secrets). # -# `secrets: inherit` is REQUIRED: without it the gitleaks action's inner -# secrets.GITHUB_TOKEN is empty and the scan silently degrades. +# No `secrets:` line: the reusable workflow declares no secrets and reads +# none, and `secrets: inherit` would forward every secret this repository +# can see (CWE-250; standards#1108 ยง6b, in the workflow's own header). name: "Secret Scanner" on: push: @@ -20,5 +21,5 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@94572e612a7bf11f8e6343d19adadf17ef2a3de3 - secrets: inherit + # The same standards commit as scorecard.yml; see the actions.lock header. + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66