Repository navigation
ci: repin standards reusables to 75bd5994, lock records at tag refs - #11
Merged
Merged
Conversation
codeql.yml was disabled_manually and CodeQL now runs as GitHub's default setup, so the file, its two lock records (workflow entry and the v4.38.0 dependency, used by nothing else) and the dependabot hold on github/codeql-action are dead weight. No required status check names CodeQL (settings.yml contexts is empty); workflow-linter treats a missing codeql.yml as optional. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV
GitHub's lock enforcement refuses a record for a tagged action whose ref repeats the SHA, in this lock and in the called repository's lock at the pinned commit. The pins at da2c748 and 571cc734 fail that check, so governance, secret-scanner, scorecard, hypatia-scan, mirror and rust-ci startup-fail with no jobs. 75bd5994 records tags in its own lock. Move all six callers to 75bd5994, re-record the actions they reach at their release tags (same pattern as choreographic-types #34), and list them as the standards record's uses. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV
5 of 16 tasks
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
⛔ Files ignored due to path filters: 1
📒 Files selected for processing: 9
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
marked this pull request as ready for review
October 19, 2026 18:43
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
3 tasks done
hyperpolymath
added a commit
that referenced
this pull request
Oct 19, 2026
…n main (#13) ## Summary `main`'s `actions.lock` has a dangling edge: the standards record's `uses:` list names `github/codeql-action@b96794f0…`, but the only top-level record is the old `…@cdf488f5…`. GitHub refuses to start runs whose lock names an unresolvable ref (zero jobs), and `scripts/check-lock-sync.sh` fails clause 3. This is what the "actions.lock is in sync" check and the GitHub Advanced Security comment on #11 flagged. Cause: #11 recorded `b96794f0` and removed `cdf488f5`; #10 (merged first) kept `cdf488f5`. Resolving the two against each other kept the old record and lost the new one. Nothing references `cdf488f5` any more (the codeql workflow was dropped in #10). ## Changes - `.github/workflows/actions.lock`: replace the unreferenced `github/codeql-action@cdf488f5…` record with `@b96794f0…` (`ref: v4.38.0`, same owner/repo ids). One record, no other change. ## RSR Quality Checklist ### Required - [x] No secrets, credentials, or `.env` files included ### As Applicable - [x] `scripts/check-lock-sync.sh` passes (in sync, transitively closed, 0 dangling edges); on `main` it fails with the dangling edge above - [x] `scripts/check-action-pinning.js` passes; keys remain C-sorted ## Testing Both scripts run locally against this branch. The real test is the governance, scan, scorecard and lock-sync jobs creating jobs and passing on this PR. --- _Generated by [Claude Code](https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GitHub's lock enforcement refuses a record for a tagged action whose
refrepeats the SHA, both in this repo'sactions.lockand in the called repository's lock at the pinned commit. The standards pins here (da2c748and571cc734) fail that check, so governance, secret-scanner, scorecard, hypatia-scan, mirror and rust-ci startup-fail with no jobs. Standards75bd5994records tags in its own lock.Same fix as choreographic-types #34.
Changes
governance,hypatia-scan,mirror,rust-ci,scorecard,secret-scanner) to75bd5994470661a099df562d6d5ad2fe744dbd66.uses:list; the two old records are gone.Stacked on #10 (this branch includes its commit; the diff shrinks once #10 merges).
RSR Quality Checklist
Required
just testor equivalent) — n/a, CI config only.envfiles includedAs Applicable
scripts/check-lock-sync.shpasses (in sync, transitively closed, 0 dangling edges)scripts/check-action-pinning.jspasses (all action refs pinned)Testing
Both lock checks above run locally. The real test is the governance, secret-scanner, scorecard, hypatia-scan, mirror and rust-ci jobs creating jobs on this PR; I have not seen that yet.
Screenshots
n/a
Generated by Claude Code