ci: regenerate lockfile after dependabot #163 (restores CodeQL + Governance)

[hyperpolymath]

Third occurrence of DEBT I-1 today. Dependabot #163 bumped four workflows' action SHAs without regenerating actions.lock, so 4 of 15 went stale — CodeQL back to 0-second startup_failure, Governance red on its own gh actions-lock --verify-local step.

Regenerated with the full four-step recipe (regenerate → restore inline SHA pins → relock-sha-keys.sh → restore reusable-caller entries). --verify-local: all 15 covered. --no-fix: valid, zero errors.

This is now demonstrably unsustainable by hand

Three times in one day (#155/#157, then #163). Every dependabot action bump re-breaks the board, and the fix is not a single command — step 4 has no upstream equivalent, because gh actions-lock drops reusable-workflow callers. I-1 needs automating, not repeating.

Incidental finding

actions/checkout@3d3c42e now records a bare SHA as its ref: because the same commit carries conflicting tag comments in the tree — # v5 in cflite_batch.yml/cflite_pr.yml versus # v7.0.1 in codeql.yml — so the generator cannot narrow it. Pre-existing mislabelling; enforcement checks the digest rather than the ref, so this is cosmetic, but one of those comments is wrong and should be corrected.

Separately: Secret Scanner is red for an unrelated upstream reason

Not fixed here — see the standards-side issue. gitleaks fails with:

FTL failed to load extended config, err: open config/gitleaks/estate-baseline.toml: no such file

The secret-scanner reusable sparse-checks-out standards' own .gitleaks.toml and copies it into consumers as the estate baseline — but that file [extend]s config/gitleaks/estate-baseline.toml, a CWD-relative path that exists only inside standards. It should copy the baseline file itself. This breaks every consumer without its own .gitleaks.toml.

🤖 Generated with Claude Code

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved

Regenerates the action lockfile following Dependabot PR #163 to restore CodeQL and Governance checks. No issues found.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

---

Important

Your trial ends in 3 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)