fix(ci): reconcile actions.lock so the lockfile validates - #159
Merged
Merged
Conversation
…s here fail at creation with 'The lockfile could not be validated. Regenerate it by running gh actions-lock' (or 'Workflow must use a lockfile'). This runs the official extension, completes the workflows: map so every onboarded file has an entry (the shape healthy repos carry), and adds the SHA-form transitive pins reached through called reusables. Every workflow re-parses before commit; gh actions-lock --verify is rc=0.
hyperpolymath
added a commit
that referenced
this pull request
Sep 22, 2026
…nce to standards@fad242d3 (#163) (#164) Cures the three reds that sit on every push to `main` and every PR, so that a PR can be fully green again. Closes #160. Closes #163. ## What changes | file | change | why | |---|---|---| | `.github/workflows/deno-ci.yml` | deleted | Deno is banned estate-wide (bun is the runtime); the workflow ran on every PR and failed. #160 | | `examples/web-project-deno.json` | deleted | the only Deno artefact; nothing else references it. #160 | | `.github/workflows/governance.yml` | pin `bd0df9ea` → `fad242d35291de1898242d6737ba02b74a59a2f2` (standards main 2026-09-07, post-#742) | the pin tropical-types and nextgen-typing are green on. #163 | | `.github/workflows/actions.lock` | drop the `deno-ci.yml: []` key | the workflow no longer exists | `.github/CONTRIBUTING.md` stays where it is: `check-docs-presence.sh` at the new pin accepts that path and names it the canonical location, so no move was needed. ## How each #163 red is cured (measured, not assumed) - **Allowlist Preflight** — at `fad242d3` the live-policy probe is a separate credentialed advisory job (`actions-policy-live`) that emits `::warning::` and never `exit 1`; `allowlist-preflight` no longer needs `HYPATIA_SCAN_PAT` (declared `required: false`). - **Workflow security linter** — the SPDX predicate now scans the whole leading comment block, so the `# managed by gh actions-lock` line 1 no longer hides the `SPDX-License-Identifier` on line 2. Ran the exact predicate over all 16 workflows on this branch: 0 failures. Also ran the three new steps' scripts locally (`check-workflows-parse.sh`, `check-workflow-duplicate-keys.sh` at `fad242d3`; `check-action-pins-resolve.sh` from main): all 16 parse, 16 clean, 3/3 pins resolve. - **Code quality + docs** — `check-docs-presence.sh` passes with CONTRIBUTING under `.github/` (`✅ Core documentation present`). Other gates at the new pin, run locally against this branch: - `check-actions-lock-gate.sh` with `update-actions-lock.sh --verify-local` (the `actions-lock-verify` job): `valid: true`, transitive coverage verified. One pre-existing advisory `sha-as-ref` note on `push-email-notify.yml`'s bare-SHA ref, not a failure. - exemption ratchet vs `origin/main`: unchanged (`.hypatia-ignore` 9, `root-allow.txt` 1), OK. Debt ratchet: no Debtfile, nothing to ratchet. - `check-ts-allowlist.sh`, `check-language-policy.sh` (the two new language-policy steps): both pass. Tracked `*.v` files are Coq; the V-lang rule keys on `v.mod`/`vpkg.json` only. **Lock-free bump:** every step-level action inside `governance-reusable.yml@fad242d3` (checkout `3d3c42e5`, cache `55cc8345`, editorconfig `840e866d`, setup-beam `54075bcc`) is already in `actions.lock` at that SHA. Standards HEAD would bump editorconfig to `51f63319` and force a lock regeneration; deliberately not taken. ## Note on the `Rust CI` check `rust-ci-reusable.yml@bd0df9ea`'s detect job checks out `refs/pull/N/merge`. When a PR is merged within seconds of opening, the merge ref is gone by the time the queued job starts and the check fails on `Checkout repository` (that is what happened to #158 and #159; #157, held open, passed). Holding this PR open until every check is green avoids the race; a pin bump to a reusable with the `github.sha` cure is a separate follow-up. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01QYY8Gp4v4x2J7iSNn1vZ57 Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Workflows fail at creation with
The lockfile could not be validated. Regenerate it by running gh actions-lock/Workflow must use a lockfile. This regenerates the manifest with the official extension (github/gh-actions-lock), completes theworkflows:map so every workflow file has an entry, and pins the SHA-form transitive deps reached via called reusables. Proof before push: every workflow re-parses,gh actions-lock --verifyrc=0, and everyuses:ref resolves to a pin.