From a7e3e433e416f8a5d36341979a18d419f7fa254f Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 1 Sep 2026 23:07:52 +0100 Subject: [PATCH 1/3] fix(ci): pin dtolnay/rust-toolchain to v1 tag with explicit toolchain input The inline SHA 4be9e76 is unreachable from any branch or tag (dtolnay force-moves toolchain branches), so lockfile generation refuses it and the pin only works today because that commit's action.yml happens to default to stable. The v1 tag + explicit toolchain: stable is the estate-proven shape (groove#35, cleave#24); actions.lock will carry the resolved SHA. Co-Authored-By: Claude Fable 5 --- .github/workflows/quality-gates.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/quality-gates.yml b/.github/workflows/quality-gates.yml index 79250ca..8ec2f89 100644 --- a/.github/workflows/quality-gates.yml +++ b/.github/workflows/quality-gates.yml @@ -30,7 +30,13 @@ jobs: - name: Checkout uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable + # v1 tag, not a SHA: dtolnay force-moves toolchain branches, so no + # symbolic ref contains the old pin and lockfile generation refuses it. + # The actions.lock records the resolved SHA; the toolchain must be an + # explicit input because the ref no longer selects it. + uses: dtolnay/rust-toolchain@v1 + with: + toolchain: stable - name: Install system dependencies run: | sudo apt-get update From 45bc192d7a0e89f495852a9b408bb5ef9551d7bf Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 1 Sep 2026 23:13:51 +0100 Subject: [PATCH 2/3] refactor(ci): move direct action pins from inline SHAs to release tags MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit actions.lock becomes the pinning layer (D4): gh actions-lock records the resolved SHA per tag and GitHub enforces the match at startup. Inline SHAs made --verify-local emit blocking sha-as-ref warnings and per estate findings can drop actions from lock coverage. 11 of 12 tags have digests byte-identical to the previous inline SHAs (proven by the relock resolver); the exception is dawidd6/action-send-mail, whose old '# pinned' SHA was an unreleased master commit (a deps bump, ahead of the release) — the tag ref deliberately moves it back to the actual v3.12.0 release commit. Several old trailing comments were stale (# v3 on repository-dispatch was actually v4.0.1) — comments beside pins are decoration, not evidence. Co-Authored-By: Claude Fable 5 --- .github/workflows/boj-build.yml | 2 +- .github/workflows/casket-pages.yml | 14 +++++++------- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/instant-sync.yml | 2 +- .github/workflows/pages.yml | 8 ++++---- .github/workflows/push-email-notify.yml | 2 +- .github/workflows/quality-gates.yml | 4 ++-- .github/workflows/workflow-linter.yml | 2 +- 8 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 1393cc3..e080c53 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -10,7 +10,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + uses: actions/checkout@v4.1.7 - name: Trigger BoJ Server (Casket/ssg-mcp) run: | # Send a secure trigger to boj-server to build this repository diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index 77aaa54..b7a5e27 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -18,19 +18,19 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + uses: actions/checkout@v4.1.1 - name: Checkout casket-ssg - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + uses: actions/checkout@v4.1.1 with: repository: hyperpolymath/casket-ssg path: .casket-ssg - name: Setup GHCup - uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2 + uses: haskell-actions/setup@v2.7.5 with: ghc-version: '9.8.2' cabal-version: '3.10' - name: Cache Cabal - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 + uses: actions/cache@v4.3.0 with: path: | ~/.cabal/packages @@ -88,9 +88,9 @@ jobs: cd .casket-ssg && cabal run casket-ssg -- build ../.site-src ../_site touch ../_site/.nojekyll - name: Setup Pages - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 + uses: actions/configure-pages@v5.0.0 - name: Upload artifact - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 + uses: actions/upload-pages-artifact@v3.0.1 with: path: '_site' deploy: @@ -103,4 +103,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 + uses: actions/deploy-pages@v4.0.5 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 34ae58e..ea57c85 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -30,16 +30,16 @@ jobs: build-mode: none steps: - name: Checkout repository - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + uses: actions/checkout@v4.1.1 - name: Initialize CodeQL - uses: github/codeql-action/init@4187e74d05793876e9989daffde9c3e66b4acd07 # v3 + uses: github/codeql-action/init@v3.37.3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Autobuild - uses: github/codeql-action/autobuild@4187e74d05793876e9989daffde9c3e66b4acd07 # v3 + uses: github/codeql-action/autobuild@v3.37.3 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@4187e74d05793876e9989daffde9c3e66b4acd07 # v3 + uses: github/codeql-action/analyze@v3.37.3 diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index ed43907..0218492 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -18,7 +18,7 @@ jobs: timeout-minutes: 15 steps: - name: Trigger Propagation - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3 + uses: peter-evans/repository-dispatch@v4.0.1 with: token: ${{ secrets.FARM_DISPATCH_TOKEN }} repository: hyperpolymath/.git-private-farm diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 0273437..fb7c7bf 100755 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -20,9 +20,9 @@ jobs: image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff steps: - name: Checkout Site - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + uses: actions/checkout@v4.4.0 - name: Checkout Ddraig SSG - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + uses: actions/checkout@v4.4.0 with: repository: hyperpolymath/ddraig-ssg path: .ddraig-ssg @@ -39,7 +39,7 @@ jobs: fi ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/} - name: Upload artifact - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 + uses: actions/upload-pages-artifact@v3.0.1 with: path: '_site' deploy: @@ -52,4 +52,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 + uses: actions/deploy-pages@v4.0.5 diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 112afd1..f6007ba 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Send push notification email - uses: dawidd6/action-send-mail@6e502825a508b867ab2954ad6343b68787624c01 # pinned + uses: dawidd6/action-send-mail@v3.12.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/quality-gates.yml b/.github/workflows/quality-gates.yml index 8ec2f89..0715124 100644 --- a/.github/workflows/quality-gates.yml +++ b/.github/workflows/quality-gates.yml @@ -14,7 +14,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@v4.3.1 - name: Install system dependencies run: | sudo apt-get update @@ -28,7 +28,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@v4.3.1 - name: Install Rust toolchain # v1 tag, not a SHA: dtolnay force-moves toolchain branches, so no # symbolic ref contains the old pin and lockfile generation refuses it. diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 862a590..e007b71 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + - uses: actions/checkout@v4.1.1 - name: Check SPDX headers run: | errors=0 From de49ddc1b0c1073cae4a1f0ad3c2d018ff6eb41a Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 1 Sep 2026 23:16:30 +0100 Subject: [PATCH 3/3] feat(ci): add actions.lock generated by the standards canonical process (D4) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Generated by standards/scripts/update-actions-lock.sh (gh actions-lock v0.1.6, MODE=update, COMPLETE=true), then the four pure reusable-caller workflows (governance, hypatia-scan, mirror, secret-scanner) were given bare '[]' entries by hand — v0.1.6 does not recognise reusable-workflow uses: paths, and the bare-[] shape is the proven-live one in hypatia's and standards' own lockfiles; regeneration preserves such entries. Validated: gh actions-lock --verify-local reports valid with zero findings; check-lockfile-drift.sh clean over all 14 workflows. Closes debt D4 of docs/sitrep-2026-09-01.adoc. Co-Authored-By: Claude Fable 5 --- .github/workflows/actions.lock | 107 +++++++++++++++++++++++++++++++++ 1 file changed, 107 insertions(+) create mode 100644 .github/workflows/actions.lock diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..b781786 --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,107 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/boj-build.yml': + - 'actions/checkout@v4.1.7' + '.github/workflows/casket-pages.yml': + - 'actions/cache@v4.3.0' + - 'actions/checkout@v4.1.1' + - 'actions/configure-pages@v5.0.0' + - 'actions/deploy-pages@v4.0.5' + - 'actions/upload-pages-artifact@v3.0.1' + - 'haskell-actions/setup@v2.7.5' + '.github/workflows/codeql.yml': + - 'actions/checkout@v4.1.1' + - 'github/codeql-action@v3.37.3' + '.github/workflows/governance.yml': [] + '.github/workflows/hypatia-scan.yml': [] + '.github/workflows/instant-sync.yml': + - 'peter-evans/repository-dispatch@v4.0.1' + '.github/workflows/mirror.yml': [] + '.github/workflows/pages.yml': + - 'actions/checkout@v4.4.0' + - 'actions/deploy-pages@v4.0.5' + - 'actions/upload-pages-artifact@v3.0.1' + '.github/workflows/push-email-notify.yml': + - 'dawidd6/action-send-mail@v3.12.0' + '.github/workflows/quality-gates.yml': + - 'actions/checkout@v4.3.1' + - 'dtolnay/rust-toolchain@v1' + '.github/workflows/secret-scanner.yml': [] + '.github/workflows/workflow-linter.yml': + - 'actions/checkout@v4.1.1' +dependencies: + 'actions/cache@v4.3.0': + ref: 'v4.3.0' + commit: 'sha1-0057852bfaa89a56745cba8c7296529d2fc39830' + owner_id: 44036562 + repo_id: 215566462 + 'actions/checkout@v4.1.1': + ref: 'v4.1.1' + commit: 'sha1-b4ffde65f46336ab88eb53be808477a3936bae11' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v4.1.7': + ref: 'v4.1.7' + commit: 'sha1-692973e3d937129bcbf40652eb9f2f61becf3332' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v4.3.1': + ref: 'v4.3.1' + commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v4.4.0': + ref: 'v4.4.0' + commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262' + owner_id: 44036562 + repo_id: 197814629 + 'actions/configure-pages@v5.0.0': + ref: 'v5.0.0' + commit: 'sha1-983d7736d9b0ae728b81ab479565c72886d7745b' + owner_id: 44036562 + repo_id: 513659658 + 'actions/deploy-pages@v4.0.5': + ref: 'v4.0.5' + commit: 'sha1-d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e' + owner_id: 44036562 + repo_id: 438112499 + 'actions/upload-artifact@v4': + ref: 'v4' + commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-pages-artifact@v3.0.1': + ref: 'v3.0.1' + commit: 'sha1-56afc609e74202658d3ffba0e8f6dda462b719fa' + owner_id: 44036562 + repo_id: 496012378 + uses: + - 'actions/upload-artifact@v4' + 'dawidd6/action-send-mail@v3.12.0': + ref: 'v3.12.0' + commit: 'sha1-2cea9617b09d79a095af21254fbcb7ae95903dde' + owner_id: 9713907 + repo_id: 222439721 + 'dtolnay/rust-toolchain@v1': + ref: 'v1' + commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' + owner_id: 1940490 + repo_id: 260749683 + 'github/codeql-action@v3.37.3': + ref: 'v3.37.3' + commit: 'sha1-4187e74d05793876e9989daffde9c3e66b4acd07' + owner_id: 9919 + repo_id: 259445878 + 'haskell-actions/setup@v2.7.5': + ref: 'v2.7.5' + commit: 'sha1-ec49483bfc012387b227434aba94f59a6ecd0900' + owner_id: 75048950 + repo_id: 623796603 + 'peter-evans/repository-dispatch@v4.0.1': + ref: 'v4.0.1' + commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697' + owner_id: 18365890 + repo_id: 220359305