feat(ci): actions.lock via the standards canonical process (D4) - #73
Merged
Conversation
… input The inline SHA 4be9e76 is unreachable from any branch or tag (dtolnay force-moves toolchain branches), so lockfile generation refuses it and the pin only works today because that commit's action.yml happens to default to stable. The v1 tag + explicit toolchain: stable is the estate-proven shape (groove#35, cleave#24); actions.lock will carry the resolved SHA. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
actions.lock becomes the pinning layer (D4): gh actions-lock records the resolved SHA per tag and GitHub enforces the match at startup. Inline SHAs made --verify-local emit blocking sha-as-ref warnings and per estate findings can drop actions from lock coverage. 11 of 12 tags have digests byte-identical to the previous inline SHAs (proven by the relock resolver); the exception is dawidd6/action-send-mail, whose old '# pinned' SHA was an unreleased master commit (a deps bump, ahead of the release) — the tag ref deliberately moves it back to the actual v3.12.0 release commit. Several old trailing comments were stale (# v3 on repository-dispatch was actually v4.0.1) — comments beside pins are decoration, not evidence. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ss (D4) Generated by standards/scripts/update-actions-lock.sh (gh actions-lock v0.1.6, MODE=update, COMPLETE=true), then the four pure reusable-caller workflows (governance, hypatia-scan, mirror, secret-scanner) were given bare '[]' entries by hand — v0.1.6 does not recognise reusable-workflow uses: paths, and the bare-[] shape is the proven-live one in hypatia's and standards' own lockfiles; regeneration preserves such entries. Validated: gh actions-lock --verify-local reports valid with zero findings; check-lockfile-drift.sh clean over all 14 workflows. Closes debt D4 of docs/sitrep-2026-09-01.adoc. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Warning Review limit reachedNext included review available in 17 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Team Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (8)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes debt D4 of
docs/sitrep-2026-09-01.adoc: actions.lock generated and validated by the standards canonical process (not hand-written).What's here (3 commits)
@v1tag + explicittoolchain: stable. The old SHA4be9e76is unreachable from any branch/tag (dtolnay force-moves toolchain branches), sogh actions-lockrefuses it outright, and it only worked because that commit'saction.ymlhappened to default to stable.@v1+ explicit input is the estate-proven shape (groove#35, cleave#24).--verify-localtreats inline SHAs as blockingsha-as-reffindings, and the lockfile is the enforcement layer anyway. 11 of 12 tags have digests byte-identical to the old inline SHAs (proven by the relock resolver). The exception:dawidd6/action-send-mail's old# pinnedSHA was an unreleased master commit (a deps bump ahead of the release); the tag moves it to the actual v3.12.0 release commit. Several old comments were lies —# v3on repository-dispatch was actually v4.0.1.actions.lockfromstandards/scripts/update-actions-lock.sh(gh actions-lock v0.1.6, COMPLETE=true), plus hand-added bare[]entries for the four pure reusable-caller workflows (governance, hypatia-scan, mirror, secret-scanner) — v0.1.6 doesn't recognise reusableuses:paths; bare[]is the proven-live shape in hypatia's and standards' own lockfiles and survives regeneration.Validation
gh actions-lock --verify-local: valid, zero findingsstandards/scripts/check-lockfile-drift.sh: clean, 14 workflowsuses:lines has an empty entry (the blocky-writer trap)sha_pinning_requiredis false on this repo, so tag refs are safe; the lock is the pinKnown follow-on
Future Dependabot bumps must regenerate the lock in the same PR, or the run dies at startup (the lock, not the workflow, wins ref-mismatch conflicts — and splat-tag drift resolution can silently revert bumps).
🤖 Generated with Claude Code