From 0cfe28312ba8af77c5d29c2530e4f578b201b4be Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 7 Aug 2026 12:53:16 +0100 Subject: [PATCH 1/2] chore(ci): SPDX headers on line 1 and Actions lockfile minted MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two estate gates, one change. **SPDX.** `governance / Workflow security linter` checks `head -1 | grep`, so a workflow carrying its identifier below a managed-by comment reports as missing one. Each file's OWN identifier is moved to line 1 — nothing is imposed, because repositories here are variously MPL-2.0, PMPL-1.0-or-later and AGPL-3.0-or-later and a default would mis-declare the minority. Licences seen here: MPL-2.0. **Lockfile.** `gh actions-lock` resolves each symbolic ref to a verified commit plus owner_id, repo_id and the transitive dependencies of composite actions — which is what OSSF Scorecard's Pinned-Dependencies check is asking for, and what an inline SHA cannot express. ⚠ Do NOT additionally SHA-pin inline. The mechanisms are mutually exclusive: `gh actions-lock` refuses a ref no tag or branch contains, so inline pinning REMOVES actions from the lockfile. Measured on hypatia 2026-08-07 — 40 inline pins caused 14 startup_failures and dropped 7 lockfile entries. Verified: all workflows parse, no duplicate identifiers, lockfile verify says "All 8 workflows have complete lockfile coverage.". --- .github/workflows/actions.lock | 125 ++++++++++++++++++++++++ .github/workflows/casket-pages.yml | 15 +-- .github/workflows/codeql.yml | 7 +- .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 9 +- .github/workflows/lean-build.yml | 19 ++-- .github/workflows/push-email-notify.yml | 3 +- .github/workflows/scorecard.yml | 7 +- .github/workflows/secret-scanner.yml | 1 + 9 files changed, 160 insertions(+), 27 deletions(-) create mode 100644 .github/workflows/actions.lock diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..d1565ea --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,125 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/casket-pages.yml': + - 'actions/cache@v4.3.0' + - 'actions/checkout@v4.1.1' + - 'actions/configure-pages@v5.0.0' + - 'actions/deploy-pages@v4.0.5' + - 'actions/upload-pages-artifact@v3.0.1' + - 'haskell-actions/setup@v2.7.5' + '.github/workflows/codeql.yml': + - 'actions/checkout@v6.0.1' + - 'github/codeql-action@v4.31.10' + '.github/workflows/hypatia-scan.yml': + - 'actions/checkout@v4.1.1' + - 'actions/github-script@v7.0.1' + - 'actions/upload-artifact@v4.6.2' + - 'erlef/setup-beam@v1.17.5' + '.github/workflows/lean-build.yml': + - 'actions/cache@v4.2.3' + - 'actions/checkout@v4.1.1' + - 'actions/upload-artifact@v4.3.0' + - 'gaurav-nelson/github-action-markdown-link-check@1.0.15' + - 'mlugg/setup-zig@v2.2.1' + '.github/workflows/push-email-notify.yml': + - 'dawidd6/action-send-mail@v3.12.0' + '.github/workflows/scorecard.yml': + - 'actions/checkout@v6.0.1' + - 'actions/upload-artifact@v4.3.0' + - 'ossf/scorecard-action@v2.4.3' +dependencies: + 'actions/cache@v4.2.3': + ref: 'v4.2.3' + commit: 'sha1-5a3ec84eff668545956fd18022155c47e93e2684' + owner_id: 44036562 + repo_id: 215566462 + 'actions/cache@v4.3.0': + ref: 'v4.3.0' + commit: 'sha1-0057852bfaa89a56745cba8c7296529d2fc39830' + owner_id: 44036562 + repo_id: 215566462 + 'actions/checkout@v4.1.1': + ref: 'v4.1.1' + commit: 'sha1-b4ffde65f46336ab88eb53be808477a3936bae11' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v6.0.1': + ref: 'v6.0.1' + commit: 'sha1-8e8c483db84b4bee98b60c0593521ed34d9990e8' + owner_id: 44036562 + repo_id: 197814629 + 'actions/configure-pages@v5.0.0': + ref: 'v5.0.0' + commit: 'sha1-983d7736d9b0ae728b81ab479565c72886d7745b' + owner_id: 44036562 + repo_id: 513659658 + 'actions/deploy-pages@v4.0.5': + ref: 'v4.0.5' + commit: 'sha1-d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e' + owner_id: 44036562 + repo_id: 438112499 + 'actions/github-script@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-60a0d83039c74a4aee543508d2ffcb1c3799cdea' + owner_id: 44036562 + repo_id: 205262760 + 'actions/upload-artifact@v4': + ref: 'v4' + commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-artifact@v4.3.0': + ref: 'v4.3.0' + commit: 'sha1-26f96dfa697d77e81fd5907df203aa23a56210a8' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-artifact@v4.6.2': + ref: 'v4.6.2' + commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-pages-artifact@v3.0.1': + ref: 'v3.0.1' + commit: 'sha1-56afc609e74202658d3ffba0e8f6dda462b719fa' + owner_id: 44036562 + repo_id: 496012378 + uses: + - 'actions/upload-artifact@v4' + 'dawidd6/action-send-mail@v3.12.0': + ref: 'v3.12.0' + commit: 'sha1-6e502825a508b867ab2954ad6343b68787624c01' + owner_id: 9713907 + repo_id: 222439721 + 'erlef/setup-beam@v1.17.5': + ref: 'v1.17.5' + commit: 'sha1-2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c' + owner_id: 47606891 + repo_id: 331103973 + 'gaurav-nelson/github-action-markdown-link-check@1.0.15': + ref: '1.0.15' + commit: 'sha1-d53a906aa6b22b8979d33bc86170567e619495ec' + owner_id: 23069445 + repo_id: 178552370 + 'github/codeql-action@v4.31.10': + ref: 'v4.31.10' + commit: 'sha1-cdefb33c0f6224e58673d9004f47f7cb3e328b89' + owner_id: 9919 + repo_id: 259445878 + 'haskell-actions/setup@v2.7.5': + ref: 'v2.7.5' + commit: 'sha1-ec49483bfc012387b227434aba94f59a6ecd0900' + owner_id: 75048950 + repo_id: 623796603 + 'mlugg/setup-zig@v2.2.1': + ref: 'v2.2.1' + commit: 'sha1-d1434d08867e3ee9daa34448df10607b98908d29' + owner_id: 7289241 + repo_id: 812112570 + 'ossf/scorecard-action@v2.4.3': + ref: 'v2.4.3' + commit: 'sha1-4eaacf0543bb3f2c246792bd56e8cdeffafb205a' + owner_id: 67707773 + repo_id: 421101922 diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index f6d4979..d28c85a 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: GitHub Pages @@ -20,22 +21,22 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + uses: actions/checkout@v4.1.1 - name: Checkout casket-ssg - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + uses: actions/checkout@v4.1.1 with: repository: hyperpolymath/casket-ssg path: .casket-ssg - name: Setup GHCup - uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2 + uses: haskell-actions/setup@v2.7.5 with: ghc-version: '9.8.2' cabal-version: '3.10' - name: Cache Cabal - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 + uses: actions/cache@v4.3.0 with: path: | ~/.cabal/packages @@ -79,10 +80,10 @@ jobs: cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site - name: Setup Pages - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 + uses: actions/configure-pages@v5.0.0 - name: Upload artifact - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 + uses: actions/upload-pages-artifact@v3.0.1 with: path: '_site' @@ -95,4 +96,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 + uses: actions/deploy-pages@v4.0.5 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b317db1..b309e25 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: CodeQL Security Analysis @@ -26,15 +27,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@v6.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1 + uses: github/codeql-action/init@v4.31.10 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1 + uses: github/codeql-action/analyze@v4.31.10 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index d54748b..d426dc8 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # governance.yml — single wrapper calling the shared estate governance bundle # in hyperpolymath/standards instead of carrying per-repo copies. diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 74c09dd..642835d 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan @@ -20,12 +21,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + uses: actions/checkout@v4.1.1 with: fetch-depth: 0 # Full history for better pattern analysis - name: Setup Elixir for Hypatia scanner - uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.18.2 + uses: erlef/setup-beam@v1.17.5 with: elixir-version: '1.19.4' otp-version: '28.3' @@ -74,7 +75,7 @@ jobs: echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY - name: Upload findings artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@v4.6.2 with: name: hypatia-findings path: hypatia-findings.json @@ -145,7 +146,7 @@ jobs: - name: Comment on PR with findings if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0 - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7 + uses: actions/github-script@v7.0.1 with: script: | const fs = require('fs'); diff --git a/.github/workflows/lean-build.yml b/.github/workflows/lean-build.yml index 73de2af..bb9dbf5 100644 --- a/.github/workflows/lean-build.yml +++ b/.github/workflows/lean-build.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Lean 4 Build and Test Workflow name: Lean 4 Build @@ -18,7 +19,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + uses: actions/checkout@v4.1.1 - name: Install elan (Lean version manager) run: | @@ -35,7 +36,7 @@ jobs: # That failure aborted this job BEFORE `lake build` ever ran, which is why # CI never once reported whether this project compiles. - name: Cache Lean dependencies - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 + uses: actions/cache@v4.2.3 with: path: | .lake @@ -77,7 +78,7 @@ jobs: - name: Upload build log if: always() - uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4 + uses: actions/upload-artifact@v4.3.0 with: name: lake-build-log path: lake-build.log @@ -89,13 +90,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + uses: actions/checkout@v4.1.1 # Was goto-bus-stop/setup-zig@2a9625d… — that SHA does not exist and the # action is unmaintained (it has no v2 tag at all), so this job could # never start. mlugg/setup-zig is the maintained successor. - name: Setup Zig - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2 + uses: mlugg/setup-zig@v2.2.1 with: version: 0.16.0 @@ -125,7 +126,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + uses: actions/checkout@v4.1.1 - name: Check EBNF grammar syntax run: | @@ -167,10 +168,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 + uses: actions/checkout@v4.1.1 - name: Check markdown links - uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec # v1 + uses: gaurav-nelson/github-action-markdown-link-check@1.0.15 with: use-quiet-mode: 'yes' config-file: '.github/markdown-link-check-config.json' @@ -183,7 +184,7 @@ jobs: cat spec-index.txt - name: Upload spec index - uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4 + uses: actions/upload-artifact@v4.3.0 with: name: spec-index path: spec-index.txt diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 4b4e754..0160dc2 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; @@ -15,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Send push notification email - uses: dawidd6/action-send-mail@6e502825a508b867ab2954ad6343b68787624c01 # pinned + uses: dawidd6/action-send-mail@v3.12.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index ac31d48..06d9468 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: OSSF Scorecard on: @@ -24,19 +25,19 @@ jobs: permissions: id-token: write steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - uses: actions/checkout@v6.0.1 with: persist-credentials: false - name: Run Scorecard - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1 + uses: ossf/scorecard-action@v2.4.3 with: results_file: results.sarif results_format: sarif # NOT github/codeql-action/upload-sarif — see the policy note above. - name: Upload results as artifact - uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4 + uses: actions/upload-artifact@v4.3.0 with: name: scorecard-results path: results.sarif diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index d325a5c..5bf0622 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Calls the estate's shared secret scanner (gitleaks + rust-secrets + # shell-secrets). Added because this repository had NO leak scanning at all. From d34af6d96b99d2eb74d576fb504ab75e68f68978 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 7 Aug 2026 13:23:20 +0100 Subject: [PATCH 2/2] fix(ci): SPDX identifier back to line 1, after the lockfile step MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `gh actions-lock` inserts `# This workflow is managed by gh actions-lock.` at line 1, which displaced the SPDX identifier moved there earlier in this branch. The linter greps `head -1` only, so the header read as missing again. Each file's OWN identifier is moved back to line 1 — nothing imposed. Files already correct are untouched, and any file carrying two identifiers aborts the change rather than guessing. --- .github/workflows/casket-pages.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/lean-build.yml | 2 +- .github/workflows/push-email-notify.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index d28c85a..6054ec9 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: GitHub Pages on: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b309e25..72b7740 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: CodeQL Security Analysis on: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index d426dc8..16a86a8 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # governance.yml — single wrapper calling the shared estate governance bundle # in hyperpolymath/standards instead of carrying per-repo copies. # diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 642835d..aa18632 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan diff --git a/.github/workflows/lean-build.yml b/.github/workflows/lean-build.yml index bb9dbf5..20c2637 100644 --- a/.github/workflows/lean-build.yml +++ b/.github/workflows/lean-build.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Lean 4 Build and Test Workflow name: Lean 4 Build diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 0160dc2..b69c87f 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 06d9468..a3694e8 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: OSSF Scorecard on: push: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 5bf0622..1ba0bdb 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Calls the estate's shared secret scanner (gitleaks + rust-secrets + # shell-secrets). Added because this repository had NO leak scanning at all. #