chore(ci): generate actions.lock ahead of the 2026-10-01 lock gate

[hyperpolymath]

Summary

• Adds .github/workflows/actions.lock. It was generated by gh actions-lock --no-narrow v0.1.6 from the refs already SHA-pinned here, so no uses: line changes.
• Moves the tool's banner to line 2 in each workflow, keeping SPDX on line 1.

Why

From 2026-10-01 the governance "Actions lockfile verify" gate fails any repo that lacks a lockfile. Changing the date on standards main would not help, because this repo pins the reusable workflow by SHA.

Verification

• The gate script at the pinned standards SHA passes with LOCK_TODAY=2026-10-01.
• This PR's own runs are the runtime test. Every workflow must create jobs, with no startup_failure.

🤖 Generated with Claude Code

https://claude.ai/code/session_019aa9y32JcBuZ85KXe2jb8R

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: dd332fa6-d3c4-4c3e-a306-df8049baded7

📥 Commits

Reviewing files that changed from the base of the PR and between e419b4a and d09eb3b.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (14)

• .github/workflows/boj-build.yml
• .github/workflows/casket-pages.yml
• .github/workflows/ci.yml
• .github/workflows/codeql.yml
• .github/workflows/dogfood-gate.yml
• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/instant-sync.yml
• .github/workflows/label-triage.yml
• .github/workflows/labels.yml
• .github/workflows/mirror.yml
• .github/workflows/push-email-notify.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (29)

• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Actions lockfile verify
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: governance / Debt ratchet
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: scan / rust-secrets
• GitHub Check: scan / gitleaks
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: scan / shell-secrets
• GitHub Check: container
• GitHub Check: build
• GitHub Check: analyze (actions, none)
• GitHub Check: analyze (ruby, none)
• GitHub Check: analyze (rust, none)
• GitHub Check: Validate K9 contracts
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Validate DEED manifests
• GitHub Check: Validate eclexiaiser manifest
• GitHub Check: Groove manifest check
• GitHub Check: semgrep-cloud-platform/scan

🔇 Additional comments (14)

.github/workflows/boj-build.yml (1)

2-2: LGTM!

.github/workflows/casket-pages.yml (1)

2-2: LGTM!

.github/workflows/ci.yml (1)

2-2: LGTM!

.github/workflows/codeql.yml (1)

2-2: LGTM!

.github/workflows/dogfood-gate.yml (1)

2-2: LGTM!

.github/workflows/governance.yml (1)

2-2: LGTM!

.github/workflows/hypatia-scan.yml (1)

2-2: LGTM!

.github/workflows/instant-sync.yml (1)

2-2: LGTM!

.github/workflows/label-triage.yml (1)

2-2: LGTM!

.github/workflows/labels.yml (1)

2-2: LGTM!

.github/workflows/mirror.yml (1)

2-2: LGTM!

.github/workflows/push-email-notify.yml (1)

2-2: LGTM!

.github/workflows/scorecard.yml (1)

2-2: LGTM!

.github/workflows/secret-scanner.yml (1)

2-2: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Documentation
  • Added comments clarifying that automated workflows are managed by an action-locking tool. Workflow behaviour is unchanged.

Walkthrough

Fourteen GitHub Actions workflow files now include comments identifying them as managed by gh actions-lock. Workflow behaviour is unchanged.

Changes

Workflow management annotations

Layer / File(s)	Summary
Add workflow management comments .github/workflows/*.yml	Fourteen workflow files add a comment identifying the workflow as managed by gh actions-lock. No workflow behaviour changes.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: metadatastician

Merge Risk: ⚪ Minimal · up to d09eb

The workflows retain their existing behavior, and the lockfile statically matches the pinned gate checks. No merge-blocking issue is established.

Architecture Summary

Architecture risk: 🔵 Low · up to d09eb

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/boj-build.yml: Added a comment identifying the workflow as managed by gh actions-lock.
• observed — Modified behavior in .github/workflows/casket-pages.yml: Added a comment stating that gh actions-lock manages the workflow.
• observed — Modified behavior in .github/workflows/ci.yml: Added a comment stating that the workflow is managed by gh actions-lock.
• observed — Modified behavior in .github/workflows/codeql.yml: Adds a comment identifying the workflow as managed by gh actions-lock.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: generating actions.lock before the 1 October 2026 lock gate. It is concise and specific.
Description check	✅ Passed	The description explains the lockfile generation, workflow banner changes, reason for the change, and verification steps. It is directly related to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow trail,
Fourteen notes are neat and clear.
The actions-lock name appears,
While every step stays just the same.
I nibble greens and hop away.}

_{Comment @coderabbitai help to get the list of available commands.}

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR