From 011401221c41fdd79c822669da858ab3f09b12f8 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 20 Sep 2026 02:10:39 +0000 Subject: [PATCH] fix(ci): reconcile the workflows with actions.lock (gh-actions-lock v0.1.6) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `actions.lock` is authoritative: the workflows carry readable refs and the lock records the commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest make the whole repository unstartable — `startup_failure`, "Invalid lockfile". Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are reverted to their readable form here precisely because the lockfile, not the workflow, is what pins them. --- .github/workflows/actions.lock | 37 ++++++++++++++++++++++++ .github/workflows/ci-benchmarks.yml | 21 +++++++------- .github/workflows/codeql.yml | 6 ++-- .github/workflows/instant-sync.yml | 2 +- .github/workflows/krl-verification.yml | 12 ++++---- .github/workflows/pages.yml | 8 ++--- .github/workflows/push-email-notify.yml | 2 +- .github/workflows/read-only-api-gate.yml | 2 +- .github/workflows/verification-image.yml | 2 +- 9 files changed, 65 insertions(+), 27 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 6fbaac4..d0c9dda 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -3,6 +3,13 @@ # Docs: https://gh.io/actions-lockfile version: 'v0.0.2' workflows: + '.github/workflows/ci-benchmarks.yml': + - 'actions/checkout@v7.0.1' + - 'actions/upload-artifact@v7.0.1' + - 'erlef/setup-beam@v1.24.1' + - 'gitguardian/ggshield-action@v1.54.0' + - 'julia-actions/setup-julia@v3.0.2' + - 'sonarsource/sonarqube-scan-action@v8.2.2' '.github/workflows/codeql.yml': - 'actions/checkout@v7' - 'github/codeql-action@v4.38.0' @@ -34,6 +41,11 @@ dependencies: commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' owner_id: 44036562 repo_id: 197814629 + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 'actions/deploy-pages@v5.0.1': ref: 'v5.0.1' commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346' @@ -44,6 +56,11 @@ dependencies: commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' owner_id: 44036562 repo_id: 192625955 + 'actions/upload-artifact@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' + owner_id: 44036562 + repo_id: 192625955 'actions/upload-pages-artifact@v5.0.0': ref: 'v5.0.0' commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9' @@ -51,6 +68,16 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + 'erlef/setup-beam@v1.24.1': + ref: 'v1.24.1' + commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' + owner_id: 47606891 + repo_id: 331103973 + 'gitguardian/ggshield-action@v1.54.0': + ref: 'v1.54.0' + commit: 'sha1-7059aef1ffb7d2374ce27201144f5613beecefe0' + owner_id: 27360172 + repo_id: 272400318 'github/codeql-action@v4.38.0': ref: 'v4.38.0' commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' @@ -66,8 +93,18 @@ dependencies: commit: 'sha1-fa02766e078afaaf09b14210362cee14137e6a32' owner_id: 53965732 repo_id: 202020219 + 'julia-actions/setup-julia@v3.0.2': + ref: 'v3.0.2' + commit: 'sha1-fa02766e078afaaf09b14210362cee14137e6a32' + owner_id: 53965732 + repo_id: 202020219 'peter-evans/repository-dispatch@v4.0.1': ref: 'v4.0.1' commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697' owner_id: 18365890 repo_id: 220359305 + 'sonarsource/sonarqube-scan-action@v8.2.2': + ref: 'v8.2.2' + commit: 'sha1-ba9859eae8dd6bd29e412f25ddbbef3d032000f4' + owner_id: 545988 + repo_id: 366408409 diff --git a/.github/workflows/ci-benchmarks.yml b/.github/workflows/ci-benchmarks.yml index 3c3384b..d414619 100644 --- a/.github/workflows/ci-benchmarks.yml +++ b/.github/workflows/ci-benchmarks.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # @@ -51,18 +52,18 @@ jobs: steps: - name: Checkout Quandledb repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - name: Set up Erlang/OTP - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1 + uses: erlef/setup-beam@v1.24.1 with: otp-version: '26' elixir-version: '1.16' - name: Set up Julia - uses: julia-actions/setup-julia@fa02766e078afaaf09b14210362cee14137e6a32 # v3 + uses: julia-actions/setup-julia@v3.0.2 with: version: '1.12' @@ -89,10 +90,10 @@ jobs: steps: - name: Checkout Quandledb repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 - name: Checkout proven benchmarks repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 with: repository: ${{ env.BENCHMARKS_REPO }} path: proven @@ -109,7 +110,7 @@ jobs: ./run.sh --all - name: Upload benchmark results - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@v7.0.1 if: always() with: name: quandledb-benchmark-results @@ -125,12 +126,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - name: GitGuardian scan - uses: GitGuardian/ggshield-action@7059aef1ffb7d2374ce27201144f5613beecefe0 # v1 + uses: GitGuardian/ggshield-action@v1.54.0 with: args: scan repo . env: @@ -145,12 +146,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - name: SonarQube scan - uses: SonarSource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4 # v8 + uses: SonarSource/sonarqube-scan-action@v8.2.2 with: args: >- -Dsonar.projectKey=quandledb diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 06870a6..2ef5a80 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -39,15 +39,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 + uses: github/codeql-action/init@v4.38.0 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 + uses: github/codeql-action/analyze@v4.38.0 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 48c079b..34b3b91 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Trigger Propagation - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 + uses: peter-evans/repository-dispatch@v4.0.1 with: token: ${{ secrets.FARM_DISPATCH_TOKEN }} repository: hyperpolymath/.git-private-farm diff --git a/.github/workflows/krl-verification.yml b/.github/workflows/krl-verification.yml index 4a19ed2..f53d349 100644 --- a/.github/workflows/krl-verification.yml +++ b/.github/workflows/krl-verification.yml @@ -43,7 +43,7 @@ jobs: timeout-minutes: 90 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 # Julia >= 1.11 is required: server/Project.toml uses a [sources] table # (path-resolved sibling deps), which Pkg 1.10 silently ignores — the @@ -78,21 +78,21 @@ jobs: # from ../../../ to ../../ without updating the symlink here, which broke # every instantiate with "expected package KnotTheory to exist at path". - name: Checkout KnotTheory.jl - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/KnotTheory.jl ref: 58a904d28212817053a14f73b415fd30a434857c path: deps/KnotTheory.jl - name: Checkout Skein.jl - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/Skein.jl ref: 84bfe4134d8fca9e22114db1ec8410aa6066ba90 path: deps/Skein.jl - name: Checkout AcceleratorGate.jl - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/AcceleratorGate.jl ref: b24e9f00d89edd5a4a7940252799737024c32d41 @@ -137,7 +137,7 @@ jobs: timeout-minutes: 30 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 - name: Install Agda + standard library run: | @@ -176,7 +176,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 # The ubuntu-latest image ships a Temurin JDK; TLC needs Java 11+. - name: Fetch TLA+ tools (pinned release, checksum-verified) diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 4ca0b0f..2371e9b 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -22,9 +22,9 @@ jobs: image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff steps: - name: Checkout Site - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 - name: Checkout Ddraig SSG - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/ddraig-ssg path: .ddraig-ssg @@ -41,7 +41,7 @@ jobs: fi ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/} - name: Upload artifact - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 + uses: actions/upload-pages-artifact@v5.0.0 with: path: '_site' deploy: @@ -54,4 +54,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 + uses: actions/deploy-pages@v5.0.1 diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 43e0e77..8a96bf9 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -41,7 +41,7 @@ jobs: timeout-minutes: 5 steps: - name: Send push notification email - uses: hyperpolymath/smtp-notify-action@22e7bdb322c430c1d0dac6b3bb307f4bb139d0be # v0.3.0 + uses: hyperpolymath/smtp-notify-action@v0.3.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/read-only-api-gate.yml b/.github/workflows/read-only-api-gate.yml index 7faf3da..6e58392 100644 --- a/.github/workflows/read-only-api-gate.yml +++ b/.github/workflows/read-only-api-gate.yml @@ -47,7 +47,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + uses: actions/checkout@v7.0.1 - name: Scan server/serve.jl for mutating Skein.jl calls run: | diff --git a/.github/workflows/verification-image.yml b/.github/workflows/verification-image.yml index cee5af7..9e82aac 100644 --- a/.github/workflows/verification-image.yml +++ b/.github/workflows/verification-image.yml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 25 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Build image and run embedded tests