From e517b040163f00801ce953d5244c74930dd3a1c9 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 7 Aug 2026 14:21:30 +0100 Subject: [PATCH] =?UTF-8?q?fix(ci):=20regenerate=20actions.lock=20?= =?UTF-8?q?=E2=80=94=20workflow=20refs=20had=20drifted=20ahead=20of=20it?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Workflows reference action versions this lockfile does not pin. Actions were bumped in the workflows and `gh actions-lock` was never re-run, so the lockfile still records the older ref — and lockfile enforcement rejects a workflow whose refs it cannot resolve, before any job starts. Regenerated with `gh actions-lock` (v0.1.6) rather than hand-edited. Every entry needs a resolved commit SHA plus owner_id and repo_id, and hand-authoring those is exactly how the sibling defect happened — a caller entry written into the `dependencies:` map instead of `workflows:`, which made the whole file unparseable and killed every workflow in the repo at once. Verified before pushing, three ways: the hand-authored reusable-caller entries survive the regeneration (checked by count, because the tool does not generate them and deleting them would re-break the repo); every key under `dependencies:` still matches owner/repo@ref; and `gh actions-lock --no-fix` passes its own verification afterwards. One of 26 repos of 52 carrying a lockfile — half the estate — found by scanning after metadatastician/688-attack-hub#18. Co-Authored-By: Claude Opus 5 --- .github/workflows/actions.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index a0f03f9..f454482 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -5,7 +5,7 @@ version: 'v0.0.2' workflows: '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - - 'github/codeql-action@v4.37.4' + - 'github/codeql-action@v4.37.5' '.github/workflows/governance.yml': [] '.github/workflows/hypatia-scan.yml': [] '.github/workflows/instant-sync.yml': @@ -47,9 +47,9 @@ dependencies: commit: 'sha1-2e600f3776677e493bf0da7aaec39a586d19a5ed' owner_id: 9713907 repo_id: 222439721 - 'github/codeql-action@v4.37.4': - ref: 'v4.37.4' - commit: 'sha1-f205ea1c3313d32999d8d6a48b4f6530d4437b38' + 'github/codeql-action@v4.37.5': + ref: 'v4.37.5' + commit: 'sha1-d1ba80a13dd99fba24a470575428917156a28b43' owner_id: 9919 repo_id: 259445878 'peter-evans/repository-dispatch@v4.0.1':