From b83f1f3f8e340683ddeb0acfd5cabaa5bac1f063 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 7 Aug 2026 14:21:59 +0100 Subject: [PATCH] =?UTF-8?q?fix(ci):=20regenerate=20actions.lock=20?= =?UTF-8?q?=E2=80=94=20workflow=20refs=20had=20drifted=20ahead=20of=20it?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Workflows reference action versions this lockfile does not pin. Actions were bumped in the workflows and `gh actions-lock` was never re-run, so the lockfile still records the older ref — and lockfile enforcement rejects a workflow whose refs it cannot resolve, before any job starts. Regenerated with `gh actions-lock` (v0.1.6) rather than hand-edited. Every entry needs a resolved commit SHA plus owner_id and repo_id, and hand-authoring those is exactly how the sibling defect happened — a caller entry written into the `dependencies:` map instead of `workflows:`, which made the whole file unparseable and killed every workflow in the repo at once. Verified before pushing, three ways: the hand-authored reusable-caller entries survive the regeneration (checked by count, because the tool does not generate them and deleting them would re-break the repo); every key under `dependencies:` still matches owner/repo@ref; and `gh actions-lock --no-fix` passes its own verification afterwards. One of 26 repos of 52 carrying a lockfile — half the estate — found by scanning after metadatastician/688-attack-hub#18. Co-Authored-By: Claude Opus 5 --- .github/workflows/actions.lock | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index fb40d90..da7d58c 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -7,7 +7,7 @@ workflows: - 'actions/checkout@v7.0.1' '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - - 'github/codeql-action@v4.37.3' + - 'github/codeql-action@v4.37.6' '.github/workflows/container-build.yml': - 'actions/checkout@v7.0.1' '.github/workflows/dependabot-automerge.yml': @@ -33,7 +33,7 @@ workflows: - 'actions/configure-pages@v6.0.0' - 'actions/deploy-pages@v5.0.0' - 'actions/upload-pages-artifact@v5.0.0' - - 'haskell-actions/setup@v2.11.0' + - 'haskell-actions/setup@v2.12.0' '.github/workflows/proofs.yml': - 'actions/cache@v6.1.0' - 'actions/checkout@v7.0.1' @@ -143,14 +143,14 @@ dependencies: commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' owner_id: 47606891 repo_id: 331103973 - 'github/codeql-action@v4.37.3': - ref: 'v4.37.3' - commit: 'sha1-e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81' + 'github/codeql-action@v4.37.6': + ref: 'v4.37.6' + commit: 'sha1-5595ccaf912efad79be6eef63a5619ff05969be3' owner_id: 9919 repo_id: 259445878 - 'haskell-actions/setup@v2.11.0': - ref: 'v2.11.0' - commit: 'sha1-cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553' + 'haskell-actions/setup@v2.12.0': + ref: 'v2.12.0' + commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' owner_id: 75048950 repo_id: 623796603 'peter-evans/repository-dispatch@v4.0.1':