diff --git a/.github/workflows/abi-verify.yml b/.github/workflows/abi-verify.yml index 0382915..86fcc3f 100644 --- a/.github/workflows/abi-verify.yml +++ b/.github/workflows/abi-verify.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # abi-verify.yml — machine-checks the Ephapax Rust↔SPARK ABI seam. @@ -47,7 +48,7 @@ jobs: image: snazzybucket/idris2:latest # estate-standard Idris2 image steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 - name: Build (typecheck) the ABI seam working-directory: src/abi @@ -69,7 +70,7 @@ jobs: image: snazzybucket/idris2:latest # estate-standard Idris2 image steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 - name: Build (typecheck) the formal package working-directory: src/formal @@ -85,7 +86,7 @@ jobs: image: snazzybucket/idris2:latest # estate-standard Idris2 image steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + uses: actions/checkout@v7.0.1 - name: Build the parse front-end + test executable working-directory: idris2 diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..8fac6bc --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,68 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/governance.yml': [] + '.github/workflows/hypatia-scan.yml': [] + '.github/workflows/mirror.yml': [] + '.github/workflows/scorecard.yml': [] + '.github/workflows/secret-scanner.yml': [] + '.github/workflows/abi-verify.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/codeql.yml': + - 'actions/checkout@v7.0.1' + - 'github/codeql-action@v4.37.8' + '.github/workflows/coq-build.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/ffi-seams.yml': + - 'actions/checkout@v7.0.1' + - 'mlugg/setup-zig@v2.2.1' + '.github/workflows/instant-sync.yml': + - 'peter-evans/repository-dispatch@v4.0.1' + '.github/workflows/push-email-notify.yml': + - 'dawidd6/action-send-mail@v3.12.0' + '.github/workflows/rust-ci.yml': + - 'actions/checkout@v7.0.1' + - 'dtolnay/rust-toolchain@v1' + - 'swatinem/rust-cache@v2.9.2' + '.github/workflows/status-gate.yml': + - 'actions/checkout@v7.0.1' + - 'dtolnay/rust-toolchain@v1' + - 'swatinem/rust-cache@v2.9.2' +dependencies: + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'dawidd6/action-send-mail@v3.12.0': + ref: 'v3.12.0' + commit: 'sha1-0bbdab096651ee93f37ec02383e088183d41ff0b' + owner_id: 9713907 + repo_id: 222439721 + 'dtolnay/rust-toolchain@v1': + ref: 'v1' + commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' + owner_id: 1940490 + repo_id: 260749683 + 'github/codeql-action@v4.37.8': + ref: 'v4.37.8' + commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' + owner_id: 9919 + repo_id: 259445878 + 'mlugg/setup-zig@v2.2.1': + ref: 'v2.2.1' + commit: 'sha1-d1434d08867e3ee9daa34448df10607b98908d29' + owner_id: 7289241 + repo_id: 812112570 + 'peter-evans/repository-dispatch@v4.0.1': + ref: 'v4.0.1' + commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697' + owner_id: 18365890 + repo_id: 220359305 + 'swatinem/rust-cache@v2.9.2': + ref: 'v2.9.2' + commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + owner_id: 580492 + repo_id: 298565987 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f30dfc4..4d2a94a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: CodeQL Security Analysis on: @@ -38,15 +39,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v3.28.1 + uses: github/codeql-action/init@v4.37.8 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v3.28.1 + uses: github/codeql-action/analyze@v4.37.8 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/coq-build.yml b/.github/workflows/coq-build.yml index 772c2fa..9dbdd78 100644 --- a/.github/workflows/coq-build.yml +++ b/.github/workflows/coq-build.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # coq-build.yml — type-checks every module in `formal/` (Rocq/Coq). @@ -54,7 +55,7 @@ jobs: outputs: relevant: ${{ steps.f.outputs.relevant }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 2 - id: f @@ -103,7 +104,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install Coq 8.18 (noble apt) run: | diff --git a/.github/workflows/ffi-seams.yml b/.github/workflows/ffi-seams.yml index d157a3d..d30d3dc 100644 --- a/.github/workflows/ffi-seams.yml +++ b/.github/workflows/ffi-seams.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Owner: Jonathan D.A. Jewell # ffi-seams.yml — contract tests for the idris2 <-> zig token-buffer ABI. # @@ -36,7 +37,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - id: detect @@ -67,10 +68,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: Install Zig - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2 + uses: mlugg/setup-zig@v2.2.1 with: version: 0.15.2 diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index d8c88d3..f33964f 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Governance on: @@ -9,8 +10,9 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 3d5cd00..f684ec7 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Hypatia Security Scan on: @@ -11,9 +12,10 @@ on: workflow_dispatch: permissions: + actions: read contents: read security-events: write jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 3c4aa36..c7ba288 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync @@ -22,7 +23,7 @@ jobs: steps: - name: Trigger Propagation if: ${{ secrets.FARM_DISPATCH_TOKEN != '' }} - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3 + uses: peter-evans/repository-dispatch@v4.0.1 with: token: ${{ secrets.FARM_DISPATCH_TOKEN }} repository: hyperpolymath/.git-private-farm diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index a431fd6..d4ac835 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Mirror to Git Forges on: @@ -7,9 +8,10 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a secrets: inherit diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 4d9d284..ebd553b 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by @@ -16,7 +17,7 @@ jobs: timeout-minutes: 5 steps: - name: Send push notification email - uses: dawidd6/action-send-mail@0bbdab096651ee93f37ec02383e088183d41ff0b # pinned + uses: dawidd6/action-send-mail@v3.12.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 5136300..28e60bb 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Rust CI — thin wrapper calling the shared estate reusable in # hyperpolymath/standards. Configure once, propagate everywhere. # See: docs/CI-REUSABLE-WORKFLOWS.adoc in standards. @@ -21,6 +22,7 @@ on: pull_request: permissions: + actions: read contents: read concurrency: @@ -29,7 +31,7 @@ concurrency: jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@412a7031577112b31ee287cc6060179d638d6500 + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a no-default-features: name: Cargo build + test (ephapax-cli, --no-default-features) @@ -43,15 +45,15 @@ jobs: # for the in-tree codec that makes this possible. steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable + uses: dtolnay/rust-toolchain@v1 with: toolchain: stable # required when SHA-pinned (no rust-toolchain.toml in repo) - name: Cache cargo registry and build - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 + uses: Swatinem/rust-cache@v2.9.2 with: key: no-default-features @@ -83,15 +85,15 @@ jobs: # known rustc-incremental ICE on ephapax-parser. steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable + uses: dtolnay/rust-toolchain@v1 with: toolchain: stable # required when SHA-pinned (no rust-toolchain.toml in repo) - name: Cache cargo registry and build - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 + uses: Swatinem/rust-cache@v2.9.2 with: key: wasm-validate diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index d9b7974..b1b1fd8 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: OSSF Scorecard on: @@ -7,6 +8,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: @@ -15,4 +17,4 @@ jobs: contents: read security-events: write id-token: write - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index b6dc8da..f129fbd 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Secret Scanner on: @@ -11,6 +12,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: @@ -19,5 +21,5 @@ jobs: contents: read pull-requests: write actions: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a secrets: inherit diff --git a/.github/workflows/status-gate.yml b/.github/workflows/status-gate.yml index 5928c73..2d17041 100644 --- a/.github/workflows/status-gate.yml +++ b/.github/workflows/status-gate.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Owner: Jonathan D.A. Jewell # Status Gate — fail when the PROOF-NEEDS.md / TEST-NEEDS.md count markers # drift from coqc/cargo ground truth. @@ -41,7 +42,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Proof-count drift (grep only — no build) run: ./scripts/status-gate.sh --proofs @@ -56,13 +57,13 @@ jobs: run: | echo "::notice title=Slow check — safe to cancel::status-gate-tests runs a full cargo build just to verify the TEST-NEEDS.md test count. The core proof-count gate (status-gate-core) is a separate, independent job and is already enforced. If you're in a rush you can cancel THIS job without letting any core gating go." - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable + uses: dtolnay/rust-toolchain@v1 with: toolchain: stable # required input when the action is SHA-pinned (the `stable` ref's default is not inherited by SHA) - name: Cache cargo - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 + uses: Swatinem/rust-cache@v2.9.2 - name: Test-count drift (full build — slow) env: CARGO_INCREMENTAL: "0"