Skip to content

Commit 54cbf05

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
committed
fix(ci): resync actions.lock and add a lock-sync recurrence gate
GitHub refuses a run at startup, creating zero jobs, when a workflow carries a `uses:` ref that the lockfile does not record under that workflow's own path. It matches by LITERAL STRING; `gh actions-lock` matches by resolved commit, so a lock entry naming a tag that dereferences to the pinned SHA passes the tool and still kills the run. Regenerate the lock, make it transitively closed, and add a lock-sync gate carrying no `uses:` of its own so it cannot be disabled by the desync it detects. No workflow YAML is modified. Refs: metadatastician/standards#968 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm
1 parent c6fa9c0 commit 54cbf05

3 files changed

Lines changed: 454 additions & 46 deletions

File tree

‎.github/workflows/actions.lock‎

Lines changed: 84 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -15,17 +15,19 @@ workflows:
1515
- 'haskell-actions/setup@v2.12.0'
1616
'.github/workflows/codeql.yml':
1717
- 'actions/checkout@v7.0.1'
18-
- 'github/codeql-action@v4.38.0'
18+
- 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63'
1919
'.github/workflows/dogfood-gate.yml':
2020
- 'actions/checkout@v7.0.1'
2121
- 'hyperpolymath/deed-ecosystem@main'
2222
- 'hyperpolymath/k9-ecosystem@main'
2323
'.github/workflows/e2e.yml':
2424
- 'actions/checkout@v7.0.1'
25-
'.github/workflows/governance.yml': []
25+
'.github/workflows/governance.yml':
26+
- 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540'
2627
'.github/workflows/hypatia-dispatch-intake.yml':
2728
- 'actions/checkout@v7.0.1'
28-
'.github/workflows/hypatia-scan.yml': []
29+
'.github/workflows/hypatia-scan.yml':
30+
- 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540'
2931
'.github/workflows/inbox-steward.yml':
3032
- 'actions/checkout@v7.0.1'
3133
'.github/workflows/instant-sync.yml':
@@ -35,7 +37,8 @@ workflows:
3537
'.github/workflows/learning-loop.yml':
3638
- 'actions/checkout@v7.0.1'
3739
- 'actions/upload-artifact@v7.0.1'
38-
'.github/workflows/mirror.yml': []
40+
'.github/workflows/mirror.yml':
41+
- 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd'
3942
'.github/workflows/pages.yml':
4043
- 'actions/checkout@v7.0.1'
4144
- 'actions/deploy-pages@v5.0.1'
@@ -44,27 +47,40 @@ workflows:
4447
- 'actions/checkout@v7.0.1'
4548
- 'actions/upload-artifact@v7.0.1'
4649
- 'dtolnay/rust-toolchain@v1'
47-
- 'swatinem/rust-cache@v2.9.2'
50+
- 'Swatinem/rust-cache@v2.9.2'
4851
'.github/workflows/push-email-notify.yml':
4952
- 'hyperpolymath/smtp-notify-action@v0.3.0'
5053
'.github/workflows/repo-integrity-guard.yml':
5154
- 'actions/checkout@v7.0.1'
5255
'.github/workflows/rust.yml':
5356
- 'actions/checkout@v7.0.1'
5457
'.github/workflows/scorecard.yml':
55-
- 'actions/checkout@v7.0.1'
56-
- 'actions/upload-artifact@v7.0.1'
57-
- 'github/codeql-action@v4.37.8'
58-
- 'ossf/scorecard-action@v2.4.4'
59-
'.github/workflows/secret-scanner.yml': []
58+
- 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540'
59+
'.github/workflows/secret-scanner.yml':
60+
- 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd'
6061
'.github/workflows/supervised-fleet-scan.yml':
6162
- 'actions/checkout@v7.0.1'
6263
dependencies:
64+
'Swatinem/rust-cache@v2.9.2':
65+
ref: 'v2.9.2'
66+
commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
67+
owner_id: 580492
68+
repo_id: 298565987
69+
'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
70+
ref: '55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
71+
commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
72+
owner_id: 44036562
73+
repo_id: 215566462
6374
'actions/cache@v6.1.0':
6475
ref: 'v6.1.0'
6576
commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
6677
owner_id: 44036562
6778
repo_id: 215566462
79+
'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
80+
ref: '3d3c42e5aac5ba805825da76410c181273ba90b1'
81+
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
82+
owner_id: 44036562
83+
repo_id: 197814629
6884
'actions/checkout@v7.0.1':
6985
ref: 'v7.0.1'
7086
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
@@ -85,6 +101,11 @@ dependencies:
85101
commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
86102
owner_id: 44036562
87103
repo_id: 192626254
104+
'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a':
105+
ref: '043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
106+
commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
107+
owner_id: 44036562
108+
repo_id: 192625955
88109
'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
89110
ref: 'v7.0.0'
90111
commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
@@ -102,11 +123,36 @@ dependencies:
102123
repo_id: 496012378
103124
uses:
104125
- 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
126+
'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772':
127+
ref: '6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
128+
commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
129+
owner_id: 1940490
130+
repo_id: 260749683
105131
'dtolnay/rust-toolchain@v1':
106132
ref: 'v1'
107133
commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de'
108134
owner_id: 1940490
109135
repo_id: 260749683
136+
'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393':
137+
ref: '51f63319f592f97930c73d9c46184d20bd206393'
138+
commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393'
139+
owner_id: 26415196
140+
repo_id: 297874902
141+
'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
142+
ref: '54075bcc5e249e4758d363f27d099f55d843f124'
143+
commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
144+
owner_id: 47606891
145+
repo_id: 331103973
146+
'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63':
147+
ref: 'b96794f015dfd88f77b49b1c93e0fa7110f94c63'
148+
commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63'
149+
owner_id: 9919
150+
repo_id: 259445878
151+
'github/codeql-action@cdf488f595d80d6e07e03d4674febd5ab45fa938':
152+
ref: 'cdf488f595d80d6e07e03d4674febd5ab45fa938'
153+
commit: 'sha1-cdf488f595d80d6e07e03d4674febd5ab45fa938'
154+
owner_id: 9919
155+
repo_id: 259445878
110156
'github/codeql-action@v4.37.8':
111157
ref: 'v4.37.8'
112158
commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
@@ -137,6 +183,33 @@ dependencies:
137183
commit: 'sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be'
138184
owner_id: 6759885
139185
repo_id: 1352485172
186+
'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd':
187+
ref: '571cc734cd69fb846032ec77a662aa8ee4fc32cd'
188+
commit: 'sha1-571cc734cd69fb846032ec77a662aa8ee4fc32cd'
189+
owner_id: 6759885
190+
repo_id: 1116521501
191+
uses:
192+
- 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
193+
- 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
194+
- 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555'
195+
'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540':
196+
ref: 'da2c748aad55c1a1dcba00b60fe4a35017bc6540'
197+
commit: 'sha1-da2c748aad55c1a1dcba00b60fe4a35017bc6540'
198+
owner_id: 6759885
199+
repo_id: 1116521501
200+
uses:
201+
- 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
202+
- 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
203+
- 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
204+
- 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393'
205+
- 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
206+
- 'github/codeql-action@cdf488f595d80d6e07e03d4674febd5ab45fa938'
207+
- 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc'
208+
'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc':
209+
ref: '2d1146689b8cda280b9bc96326124645441f03bc'
210+
commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
211+
owner_id: 67707773
212+
repo_id: 421101922
140213
'ossf/scorecard-action@v2.4.4':
141214
ref: 'v2.4.4'
142215
commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
@@ -152,43 +225,8 @@ dependencies:
152225
commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
153226
owner_id: 580492
154227
repo_id: 298565987
155-
'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
156-
ref: 'v6.1.0'
157-
commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
158-
owner_id: 44036562
159-
repo_id: 215566462
160-
'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
161-
ref: 'v7.0.1'
162-
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
163-
owner_id: 44036562
164-
repo_id: 197814629
165-
'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a':
166-
ref: 'v7.0.1'
167-
commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
168-
owner_id: 44036562
169-
repo_id: 192625955
170-
'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772':
171-
ref: 'stable'
172-
commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
173-
owner_id: 1940490
174-
repo_id: 260749683
175-
'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393':
176-
ref: 'v3.0.0'
177-
commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393'
178-
owner_id: 26415196
179-
repo_id: 297874902
180-
'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
181-
ref: 'v1.24.1'
182-
commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
183-
owner_id: 47606891
184-
repo_id: 331103973
185-
'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc':
186-
ref: 'v2.4.4'
187-
commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
188-
owner_id: 67707773
189-
repo_id: 421101922
190228
'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555':
191-
ref: 'v0.10.0'
229+
ref: 'e83874834305fe9a4a2997156cb26c5de65a8555'
192230
commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555'
193231
owner_id: 135788
194232
repo_id: 208510314

‎.github/workflows/lock-sync-gate.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
name: Lock Sync Gate
3+
4+
# Fails any pull request whose .github/workflows/actions.lock has drifted from
5+
# the workflow YAML. That drift is not cosmetic: GitHub refuses such a run at
6+
# startup, creating ZERO jobs, and reports only "This run likely failed because
7+
# of a workflow file issue." A single grouped Dependabot bump can take out most
8+
# of a repository's CI that way, because Dependabot rewrites `uses:` refs in the
9+
# YAML and cannot touch the lockfile. Measured across 200 repositories on
10+
# 2026-09-22: 39 had silently dead CI from exactly this cause.
11+
# See hyperpolymath/standards#968.
12+
#
13+
# This workflow deliberately carries NO `uses:` of its own. It checks out by
14+
# calling git in a `run:` step instead of using actions/checkout, so it has no
15+
# lockfile entry to go stale and is structurally immune to the very failure it
16+
# detects. Do not add a `uses:` to this file.
17+
#
18+
# There is also no `paths:` filter, on purpose: a filtered workflow never
19+
# reports on pull requests that miss the filter, which deadlocks any branch
20+
# ruleset that requires this check.
21+
22+
on:
23+
pull_request:
24+
push:
25+
branches: [main]
26+
27+
permissions:
28+
contents: read
29+
30+
concurrency:
31+
group: lock-sync-gate-${{ github.ref }}
32+
cancel-in-progress: true
33+
34+
jobs:
35+
lock-sync:
36+
name: actions.lock is in sync with the workflow YAML
37+
runs-on: ubuntu-latest
38+
timeout-minutes: 5
39+
steps:
40+
- name: Check out without actions/checkout
41+
env:
42+
REPO: ${{ github.repository }}
43+
SHA: ${{ github.event.pull_request.head.sha || github.sha }}
44+
TOKEN: ${{ github.token }}
45+
run: |
46+
set -euo pipefail
47+
# Authenticate the fetch. An anonymous clone works only for public
48+
# repositories; this gate must also run on private ones. The header
49+
# form is used rather than a token in the remote URL so the
50+
# credential is never written into .git/config.
51+
AUTH="AUTHORIZATION: basic $(printf 'x-access-token:%s' "${TOKEN}" | base64 -w0)"
52+
git init -q .
53+
git remote add origin "https://github.com/${REPO}.git"
54+
git -c http.extraheader="${AUTH}" fetch -q --depth 1 origin "${SHA}"
55+
git checkout -q FETCH_HEAD
56+
echo "checked out ${SHA}"
57+
58+
- name: Verify lockfile synchronisation
59+
run: |
60+
set -euo pipefail
61+
test -x scripts/check-lock-sync.sh \
62+
|| { echo "::error::scripts/check-lock-sync.sh missing or not executable"; exit 1; }
63+
./scripts/check-lock-sync.sh

0 commit comments

Comments
 (0)