Deferred red checks on dependabot PR #110

[hyperpolymath]

Context

Dependabot PR #110 (SHA bumps of haskell-actions/setup and codeql-action) is merged with one non-required check red. This issue carries that red so the PR body can name it. #49 is the broader CI-honesty sweep and does not name this context.

Red checks on the PR head

Context	Evidence
governance / Workflow security linter	red on the latest main run of governance.yml too (run 35358492190 on 2fc67389, 2026-09-18); the job exits 1. The PR changes only action SHAs.

Acceptance criteria

• governance / Workflow security linter is green on main.

---

Filed by an agent session clearing the owner's GitHub inbox (2026-10-02). Cross-cutting governance reds are tracked in hyperpolymath/standards#994. Per the standing ruling (2026-09-15), a red non-required check is an issue with acceptance criteria, not a merge blocker.

https://claude.ai/code/session_01F1dMuLprAVdZyYPLwZ4t8q

[hyperpolymath]

Root cause found (2026-10-02): the startup_failure runs on main are not CI reds at all — the native Actions lockfile .github/workflows/actions.lock disagrees with the workflow refs, so GitHub refuses to start the workflow (annotation Invalid lockfile … Regenerate it by running gh actions-lock, jobs=0, no check-run). Dependabot bumps the workflow tag and never updates the lock, so every tag bump merged here lands into a workflow that cannot start. gh actions-lock --no-fix on origin/main reports the lock invalid. Here: the lock pins github/codeql-action@b96794f0… while the workflows reference another ref (codeql.yml, hypatia-scan.yml startup-failing since fa18207, 2026-08-19) and casket-pages.yml has drifted too (since 64a3062, 2026-09-17).

Fix recipe (worked on bgp-backbone-lab#105): worktree on origin/main, gh actions-lock .github/workflows/<failing>.yml per failing workflow, review the diff (the tool prunes orphan entries; check nothing referenced was removed and the lock stays transitively closed), signed commit, squash PR through the scan / gitleaks gate, then confirm actions/runs?head_sha=<merge> shows no startup_failure.

🤖 Generated with Claude Code

https://claude.ai/code/session_01F1dMuLprAVdZyYPLwZ4t8q