fix(ci): add the six orphaned reusable-callers to actions.lock; pin setup-deno - #190
Merged
Conversation
…etup-deno Six workflows have never appeared in .github/workflows/actions.lock, so lockfile enforcement has rejected each at startup with zero jobs: governance, hypatia-scan, mirror, scorecard, secret-scanner and spark-theatre-gate. They are pure reusable-callers, which gh actions-lock scans but never emits entries for, so re-running the tool could never have fixed them. This is what blocks #188: it waits on the required contexts "governance / Validate Hypatia Baseline" and "scan / Hypatia Neurosymbolic Analysis", which come from the orphaned governance.yml and hypatia-scan.yml. A workflow that never starts never reports, so those contexts can never appear and the PR can never merge. Entries hand-authored to the proven chronicles-of-slavia recipe: each caller maps to hyperpolymath/standards@<sha> (subpath-free), plus one dependency block per distinct standards ref carrying that ref's own transitive uses. The six sit at THREE different standards SHAs (d7c22711, d135b05b, fc7abf58), each read from the reusables at that exact ref rather than assumed — fc7abf58 additionally calls a nested hyperpolymath/standards@861b5e91, which is included. They are left at the SHAs the workflows already pin; re-pinning to the estate's current target is the separate sweep's job. The tool then surfaced a genuine second gap it could fix: denoland/setup-deno@v2.0.5 in web-client-tests.yml was used but unpinned. Now pinned. Also hoisted SPDX headers back to line 1 in the 22 files where the tool's banner displaced them (the estate linter greps head -1, so a header on line 2 reads as MISSING), and added MPL-2.0 to pages.yml, which had no identifier anywhere in the file. Verified: gh actions-lock --no-fix scans all 24 workflows clean, and every workflow on disk now has a lockfile entry. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This comment has been minimized.
This comment has been minimized.
…eference
The six caller entries added earlier in this PR were necessary but not
sufficient. Their dependency blocks LIST the reusables' transitive uses
but nothing in the lockfile DEFINED those keys, so the file referenced
21 actions it never declared and the validator rejected it whole.
PROVEN on groove in this same session: adding the one missing transitive
entry there took Secret Scanner from startup_failure to SUCCESS — its
first green run in ten attempts, and the first in its existence.
Two details copied from working lockfiles (chronicles-of-slavia and
standards' own) rather than inferred:
- the KEY is owner/repo@<40-char-sha>, but the 'ref' field inside it
is the SYMBOLIC name: a tag where one points at that commit
('v7.0.1'), otherwise the branch containing it — 'master' for both
dtolnay/rust-toolchain pins and 'main' for the nested
hyperpolymath/standards@861b5e91, none of which any tag matches.
- both forms coexist as separate keys: 'actions/upload-artifact@v7.0.1'
for this repo's own tag-form pin AND
'actions/upload-artifact@043fb46...' for the SHA-form key the
reusable references.
Note spark-theatre-gate's reusable at fc7abf58 itself calls a nested
hyperpolymath/standards@861b5e91, so that reusable-of-a-reusable needed
its own entry too.
Verified: gh actions-lock --no-fix scans all 24 workflows clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Six workflows have never appeared in
.github/workflows/actions.lock, so lockfile enforcement has rejected each at startup with zero jobs:governance,hypatia-scan,mirror,scorecard,secret-scanner,spark-theatre-gate. They are pure reusable-callers, whichgh actions-lockscans but never emits entries for — re-running the tool could never have fixed them.This is what blocks #188. It waits on
governance / Validate Hypatia Baselineandscan / Hypatia Neurosymbolic Analysis, which come from the orphanedgovernance.ymlandhypatia-scan.yml. A workflow that never starts never reports, so those contexts can never appear.d7c22711,d135b05b,fc7abf58), each read from the reusables at that exact ref.fc7abf58additionally calls a nestedhyperpolymath/standards@861b5e91, which is included.denoland/setup-deno@v2.0.5pinned inweb-client-tests.yml— a second gap the tool could fix.pages.yml.Verified:
gh actions-lock --no-fixscans 24/24 clean and every workflow on disk now has an entry.Stacked independently of #189 (the codec fix) — different files, no conflict.
🤖 Generated with Claude Code