[hyperpolymath]

All CI on this repository has been dead since 2026-08-05. Not a platform outage this time — a malformed lockfile.

Root cause

.github/workflows/actions.lock carried the secret-scanner's caller entry under the wrong key:

dependencies:
    'taiki-e/install-action@v2.85.7':
        ref: 'v2.85.7'
        ...
    '.github/workflows/secret-scanner.yml': []   # <- a workflows: entry, under dependencies:

The parser expects action mappings under dependencies: and got a sequence:

line 34: cannot unmarshal !!seq into lockfile.Action

An unparseable lockfile fails startup for every workflow in the repo, not just the one named. That is why runs have been startup_failure since #16 landed.

The entry is legitimate and stays — secret-scanner.yml only calls a reusable workflow, which gh actions-lock does not scope, so its caller entry is hand-authored. It has been moved into the workflows: block and confirmed to survive regeneration.

Also fixed, both surfaced by running the tool

• Stale pin: dependabot bumped codeql-action to 4.37.5 in chore(deps): bump github/codeql-action from 4.37.4 to 4.37.5 in the actions group #17 but the lockfile still pinned 4.37.4. Regenerated.
• Marker/SPDX collision: the tool re-inserts # This workflow is managed by gh actions-lock. at line 1 on every run — it had duplicated the marker in codeql.yml and pushed the SPDX identifier off line 1 in two files (the estate lint reads line 1 only). Deduplicated; SPDX restored to line 1, marker to line 2.

Verification

$ gh actions-lock --verify-local
All 3 workflows have complete lockfile coverage.
$ python3 -c "import yaml,glob;[yaml.safe_load(open(f)) for f in glob.glob('.github/workflows/*.yml')]"   # parses

Not a draft — this unblocks everything else. Diagnostic note for the estate: gh pr checks shows nothing for a parse-rejected workflow; use gh run list. Worth sweeping other repos that gained a reusable-workflow caller after adopting a lockfile.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[hyperpolymath]

Note: #21 was opened independently ~2 minutes after this one with the same diagnosis, touching the same file. They will conflict. This PR is the superset (also fixes the stale codeql pin from #17 and the marker/SPDX line-1 collision) and is verified green — see the comment on #21.