[hyperpolymath]

Summary

Dependabot bumped three action refs in the workflow YAML (#9) but did not update .github/workflows/actions.lock. Lock Sync Gate reports the mismatch and fails.

Changes

• .github/workflows/actions.lock: re-pinned the three bumped refs, following the Fix A method (rename workflows: entries, rename dependencies: keys, set ref and commit to the tag's commit, peeled for annotated tags):
  • actions/upload-artifact v7.0.1 to v7.0.2, commit cf430e030ddbb5b0abf93d22962f4752f3646cd9
  • actions/download-artifact v8.0.1 to v8.0.2, commit 9000827ccba6bdab643e8b6fd33ac0654aef8333
  • haskell-actions/setup v2.12.0 to v2.12.1, commit 0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d (annotated tag, peeled)

No workflow YAML, licence file or other source was changed.

RSR Quality Checklist

Required

• Tests pass: no test suite touched; lock check below is the gate for this change
• Code is formatted: not applicable (lockfile only)
• Linter is clean: not run
• No banned language patterns introduced
• No secrets, credentials, or .env files included

Testing

Commands run and real results:

$ git ls-remote https://github.com/actions/upload-artifact.git refs/tags/v7.0.2 refs/tags/v7.0.2^{}
cf430e030ddbb5b0abf93d22962f4752f3646cd9	refs/tags/v7.0.2
$ git ls-remote https://github.com/actions/download-artifact.git refs/tags/v8.0.2 refs/tags/v8.0.2^{}
9000827ccba6bdab643e8b6fd33ac0654aef8333	refs/tags/v8.0.2
$ git ls-remote https://github.com/haskell-actions/setup.git refs/tags/v2.12.1 refs/tags/v2.12.1^{}
0f7370ccbc65f22514ec3e094f6601b8d61fbbf7	refs/tags/v2.12.1
0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d	refs/tags/v2.12.1^{}
$ ./scripts/check-lock-sync.sh   (before the edit)
FAIL .github/workflows/pages.yml  refs missing from the lockfile: haskell-actions/setup@v2.12.1
FAIL .github/workflows/release.yml  refs missing from the lockfile: actions/upload-artifact@v7.0.2
FAIL .github/workflows/static-analysis-gate.yml  refs missing from the lockfile: actions/upload-artifact@v7.0.2 actions/download-artifact@v8.0.2
(plus the matching "stale lockfile entries" FAIL lines for the old refs; exit 1)
$ ./scripts/check-lock-sync.sh   (after the edit)
actions.lock is in sync and transitively closed:
  * every uses: is locked under its own workflow path (job-level reusable refs included)
  * every lockfile entry is still referenced
  * every ref named in the lockfile resolves to a dependencies: record (0 dangling edges)
  * every workflow file has a lockfile key (zero-uses: workflows included)
exit=0

Not run: tests/workflows/archetype_lock_merge_test.sh does not exist in this repo, so it was not applicable.

Not done

• Other lock entries (for example sonarsource/sonarqube-scan-action@v8.4.1, hyperpolymath/smtp-notify-action@v0.5.1) were not touched; the check did not report them.
• The commit is not signed: git log --show-signature reports gpg.ssh.allowedSignersFile is not configured, and %G? is N. Git config was not changed.

---

Generated by Claude Code

[coderabbitai]

Pre-merge checks: 2

Failed checks: 2 inconclusive

Check name	Status	Explanation	Resolution
Title check		This assessment has not completed. The check will be retried on the next pre-merge check run.
Description check		This assessment has not completed. The check will be retried on the next pre-merge check run.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[hyperpolymath]

4 checks fail on this PR. None comes from this PR, which changes only .github/workflows/actions.lock. The lock check it fixes ("actions.lock is in sync") passes.

• estate-rules: check-root-shape.sh reports CoprocessorRuntime.jl_chora.deed, Project.toml and test/ as not allowed at the root, and rsr-template-repo_chora.deed as missing. .machine_readable/root-allow.txt was never updated for this repo's own names. This also fails on main (1da5808).
• openssf-compliance and Canon lockstep: these also fail on main (1da5808) and are about the repo deed state, not the lock.
• Test (Test + Aqua) (1.9, ubuntu-latest): Julia 1.9.4 fails to start before any test runs: libopenlibm.so: cannot enable executable stack as shared object requires: Invalid argument. This is an incompatibility between the old Julia 1.9 binary and the current runner image. It is not a test failure, and it is not caused by this diff.

No fix is in this PR, so its scope stays the lock. Possible follow-ups for the owner: add the repo's own root entries to root-allow.txt, and move the CI matrix off Julia 1.9 (for example to 1.10 LTS).

---

Generated by Claude Code