Repository navigation
ci(lock): record codeql-action at b96794f0; close the dangling edge on main - #13
Conversation
…n main The standards record's uses list names github/codeql-action@b96794f0, but the only top-level record was the old cdf488f5, which nothing references any more (the codeql workflow was dropped in #10). Merging #11 on top of #10 lost the b96794f0 record, leaving a dangling edge: GitHub refuses to start runs whose lock names an unresolvable ref, and check-lock-sync.sh fails clause 3. Replace the unreferenced cdf488f5 record with b96794f0 at its release tag v4.38.0. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters: 1
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
Add Carrot credits or activate Agent usage billing to use Autofix |
Summary
main'sactions.lockhas a dangling edge: the standards record'suses:list namesgithub/codeql-action@b96794f0…, but the only top-level record is the old…@cdf488f5…. GitHub refuses to start runs whose lock names an unresolvable ref (zero jobs), andscripts/check-lock-sync.shfails clause 3. This is what the "actions.lock is in sync" check and the GitHub Advanced Security comment on #11 flagged.Cause: #11 recorded
b96794f0and removedcdf488f5; #10 (merged first) keptcdf488f5. Resolving the two against each other kept the old record and lost the new one. Nothing referencescdf488f5any more (the codeql workflow was dropped in #10).Changes
.github/workflows/actions.lock: replace the unreferencedgithub/codeql-action@cdf488f5…record with@b96794f0…(ref: v4.38.0, same owner/repo ids). One record, no other change.RSR Quality Checklist
Required
.envfiles includedAs Applicable
scripts/check-lock-sync.shpasses (in sync, transitively closed, 0 dangling edges); onmainit fails with the dangling edge abovescripts/check-action-pinning.jspasses; keys remain C-sortedTesting
Both scripts run locally against this branch. The real test is the governance, scan, scorecard and lock-sync jobs creating jobs and passing on this PR.
Generated by Claude Code