Skip to content

Commit 2cde043

Browse files
hyperpolymathhyperpolymath
committed
fix(ci): reconcile the workflows with actions.lock (gh-actions-lock v0.1.6)
`actions.lock` is authoritative: the workflows carry readable refs and the lock records the commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest make the whole repository unstartable — `startup_failure`, "Invalid lockfile". Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are reverted to their readable form here precisely because the lockfile, not the workflow, is what pins them.
1 parent 6e1210d commit 2cde043

24 files changed

Lines changed: 97 additions & 74 deletions

‎.github/workflows/actions.lock‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ dependencies:
154154
- 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
155155
'dtolnay/rust-toolchain@v1':
156156
ref: 'v1'
157-
commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
157+
commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de'
158158
owner_id: 1940490
159159
repo_id: 260749683
160160
'github/codeql-action@v4.34.0':

‎.github/workflows/boj-build.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -14,7 +15,7 @@ jobs:
1415
timeout-minutes: 10
1516
steps:
1617
- name: Checkout
17-
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
18+
uses: actions/checkout@v4.1.7
1819
- name: Trigger BoJ Server (Casket/ssg-mcp)
1920
run: |
2021
# Send a secure trigger to boj-server to build this repository

‎.github/workflows/bridge-gate.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -31,7 +32,7 @@ jobs:
3132
runs-on: ubuntu-latest
3233
timeout-minutes: 25
3334
steps:
34-
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
35+
- uses: actions/checkout@v4.3.1
3536

3637
- name: B3 gate -- nix bumps (no network)
3738
env:

‎.github/workflows/cargo-audit.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -21,10 +22,10 @@ jobs:
2122
timeout-minutes: 20
2223
steps:
2324
- name: Checkout code
24-
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
25+
uses: actions/checkout@v5.0.1
2526

2627
- name: Install Rust toolchain
27-
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
28+
uses: dtolnay/rust-toolchain@v1
2829
with:
2930
toolchain: v1
3031
with:

‎.github/workflows/casket-pages.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -23,22 +24,22 @@ jobs:
2324
timeout-minutes: 20
2425
steps:
2526
- name: Checkout
26-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
27+
uses: actions/checkout@v4.1.1
2728

2829
- name: Checkout casket-ssg
29-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
30+
uses: actions/checkout@v4.1.1
3031
with:
3132
repository: hyperpolymath/casket-ssg
3233
path: .casket-ssg
3334

3435
- name: Setup GHCup
35-
uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2.7.5
36+
uses: haskell-actions/setup@v2.7.5
3637
with:
3738
ghc-version: '9.8.2'
3839
cabal-version: '3.10'
3940

4041
- name: Cache Cabal
41-
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
42+
uses: actions/cache@v4.3.0
4243
with:
4344
path: |
4445
~/.cabal/packages
@@ -100,10 +101,10 @@ jobs:
100101
touch ../_site/.nojekyll
101102
102103
- name: Setup Pages
103-
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
104+
uses: actions/configure-pages@v5.0.0
104105

105106
- name: Upload artifact
106-
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
107+
uses: actions/upload-pages-artifact@v3.0.1
107108
with:
108109
path: '_site'
109110

@@ -117,4 +118,4 @@ jobs:
117118
steps:
118119
- name: Deploy to GitHub Pages
119120
id: deployment
120-
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
121+
uses: actions/deploy-pages@v4.0.5

‎.github/workflows/chapel-ci.yml‎

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -71,7 +72,7 @@ jobs:
7172
outputs:
7273
relevant: ${{ steps.f.outputs.relevant }}
7374
steps:
74-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
75+
- uses: actions/checkout@v6.0.2
7576
with:
7677
fetch-depth: 2
7778
- id: f
@@ -104,7 +105,7 @@ jobs:
104105
runs-on: ubuntu-22.04
105106
timeout-minutes: 45
106107
steps:
107-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
108+
- uses: actions/checkout@v6.0.2
108109
- name: Install Chapel ${{ env.CHAPEL_VERSION }}
109110
run: |
110111
set -euo pipefail
@@ -127,7 +128,7 @@ jobs:
127128
runs-on: ubuntu-22.04
128129
timeout-minutes: 45
129130
steps:
130-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
131+
- uses: actions/checkout@v6.0.2
131132
- name: Install Chapel ${{ env.CHAPEL_VERSION }}
132133
run: |
133134
set -euo pipefail
@@ -143,7 +144,7 @@ jobs:
143144
chpl src/MassPanic.chpl src/Protocol.chpl src/Imaging.chpl src/Temporal.chpl -o mass-panic
144145
chpl smoke/two_repo_smoke.chpl src/Protocol.chpl src/Imaging.chpl -o smoke/two_repo_smoke
145146
- name: Upload Chapel artefacts
146-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
147+
uses: actions/upload-artifact@v4.6.2
147148
with:
148149
name: chapel-binaries
149150
path: |
@@ -158,7 +159,7 @@ jobs:
158159
runs-on: ubuntu-22.04
159160
timeout-minutes: 45
160161
steps:
161-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
162+
- uses: actions/checkout@v6.0.2
162163
- name: Install Chapel ${{ env.CHAPEL_VERSION }}
163164
run: |
164165
set -euo pipefail
@@ -167,7 +168,7 @@ jobs:
167168
curl -fsSL --retry 3 -o /tmp/chapel.deb "${{ env.CHAPEL_DEB_URL }}"
168169
sudo apt-get install -y /tmp/chapel.deb
169170
- name: Download Chapel artefacts
170-
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
171+
uses: actions/download-artifact@v4.1.8
171172
with:
172173
name: chapel-binaries
173174
path: chapel/
@@ -183,7 +184,7 @@ jobs:
183184
runs-on: ubuntu-22.04
184185
timeout-minutes: 45
185186
steps:
186-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
187+
- uses: actions/checkout@v6.0.2
187188
- name: Install Chapel ${{ env.CHAPEL_VERSION }}
188189
run: |
189190
set -euo pipefail
@@ -192,7 +193,7 @@ jobs:
192193
curl -fsSL --retry 3 -o /tmp/chapel.deb "${{ env.CHAPEL_DEB_URL }}"
193194
sudo apt-get install -y /tmp/chapel.deb
194195
- name: Download Chapel artefacts
195-
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
196+
uses: actions/download-artifact@v4.1.8
196197
with:
197198
name: chapel-binaries
198199
path: chapel/
@@ -220,11 +221,11 @@ jobs:
220221
runs-on: ubuntu-22.04
221222
timeout-minutes: 45
222223
steps:
223-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
224-
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
224+
- uses: actions/checkout@v6.0.2
225+
- uses: dtolnay/rust-toolchain@v1
225226
with:
226227
toolchain: v1
227-
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
228+
- uses: actions/cache@v4.3.0
228229
with:
229230
path: |
230231
~/.cargo/registry
@@ -243,9 +244,9 @@ jobs:
243244
runs-on: ubuntu-22.04
244245
timeout-minutes: 45
245246
steps:
246-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
247-
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
248-
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
247+
- uses: actions/checkout@v6.0.2
248+
- uses: dtolnay/rust-toolchain@v1
249+
- uses: actions/cache@v4.3.0
249250
with:
250251
path: |
251252
~/.cargo/registry
@@ -260,7 +261,7 @@ jobs:
260261
curl -fsSL --retry 3 -o /tmp/chapel.deb "${{ env.CHAPEL_DEB_URL }}"
261262
sudo apt-get install -y /tmp/chapel.deb
262263
- name: Download Chapel artefacts
263-
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
264+
uses: actions/download-artifact@v4.1.8
264265
with:
265266
name: chapel-binaries
266267
path: chapel/
@@ -280,15 +281,15 @@ jobs:
280281
env:
281282
CHPL_HOME: /opt/chapel-multilocale
282283
steps:
283-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
284+
- uses: actions/checkout@v6.0.2
284285

285286
# Cache the entire built-from-source Chapel tree. Key is stable across
286287
# PRs as long as the version, conduit, launcher and cache-gen marker
287288
# don't change. Cold build is ~30-40 min on a 2-core runner; warm
288289
# restore is ~30s.
289290
- name: Cache multilocale Chapel ($CHPL_HOME)
290291
id: chapel-cache
291-
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
292+
uses: actions/cache@v4.3.0
292293
with:
293294
path: ${{ env.CHAPEL_MULTILOCALE_HOME }}
294295
key: ${{ runner.os }}-chapel-multilocale-${{ env.CHAPEL_VERSION }}-gasnet-smp-${{ env.CHAPEL_MULTILOCALE_CACHE_GEN }}

‎.github/workflows/codeql.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -42,15 +43,15 @@ jobs:
4243

4344
steps:
4445
- name: Checkout
45-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
46+
uses: actions/checkout@v6.0.2
4647

4748
- name: Initialize CodeQL
48-
uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0
49+
uses: github/codeql-action/init@v4.34.0
4950
with:
5051
languages: ${{ matrix.language }}
5152
build-mode: ${{ matrix.build-mode }}
5253

5354
- name: Perform CodeQL Analysis
54-
uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0
55+
uses: github/codeql-action/analyze@v4.34.0
5556
with:
5657
category: "/language:${{ matrix.language }}"

‎.github/workflows/coverage.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -19,10 +20,10 @@ jobs:
1920
timeout-minutes: 20
2021
steps:
2122
- name: Checkout code
22-
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
23+
uses: actions/checkout@v5.0.1
2324

2425
- name: Install Rust toolchain
25-
uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
26+
uses: dtolnay/rust-toolchain@v1
2627
with:
2728
toolchain: v1
2829
with:
@@ -36,7 +37,7 @@ jobs:
3637
run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info
3738

3839
- name: Upload to codecov
39-
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
40+
uses: codecov/codecov-action@v5.5.2
4041
with:
4142
files: lcov.info
4243
fail_ci_if_error: false

‎.github/workflows/dependency-review.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -18,9 +19,9 @@ jobs:
1819
timeout-minutes: 10
1920
steps:
2021
- name: Checkout code
21-
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
22+
uses: actions/checkout@v5.0.1
2223

2324
- name: Dependency Review
24-
uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4
25+
uses: actions/dependency-review-action@v4.3.4
2526
with:
2627
fail-on-severity: moderate

‎.github/workflows/dogfood-gate.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -28,7 +29,7 @@ jobs:
2829

2930
steps:
3031
- name: Checkout repository
31-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
32+
uses: actions/checkout@v4.3.1
3233

3334
- name: Check for A2ML files
3435
id: detect
@@ -69,7 +70,7 @@ jobs:
6970

7071
steps:
7172
- name: Checkout repository
72-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
73+
uses: actions/checkout@v4.3.1
7374

7475
- name: Check for K9 files
7576
id: detect
@@ -115,7 +116,7 @@ jobs:
115116

116117
steps:
117118
- name: Checkout repository
118-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
119+
uses: actions/checkout@v4.3.1
119120

120121
- name: Scan for invisible characters
121122
id: lint
@@ -180,7 +181,7 @@ jobs:
180181

181182
steps:
182183
- name: Checkout repository
183-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
184+
uses: actions/checkout@v4.3.1
184185

185186
- name: Check for Groove manifest
186187
id: groove
@@ -241,7 +242,7 @@ jobs:
241242

242243
steps:
243244
- name: Checkout repository
244-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
245+
uses: actions/checkout@v4.3.1
245246

246247
- name: Generate dogfooding scorecard
247248
run: |

0 commit comments

Comments
 (0)