[hyperpolymath]

Summary

actions.lock had drifted from the workflow files. Dependabot bumped actions in the YAML without regenerating the lock, and the SLSA generator call was never locked. GitHub refuses to start a workflow whose uses: set doesn't match its lock entries. No workflow file changes.

Changes

• casket-pages.yml: haskell-actions/setup@v2.12.0 → @v2.12.1
• push-email-notify.yml: hyperpolymath/smtp-notify-action@v0.3.0 → @v0.5.0
• release.yml: add the missing entry for slsa-framework/slsa-github-generator@f7dd8c54…
• New records for those three refs, and the two old records removed now that nothing references them. The SLSA record has ref: 'v2.1.0' and the IDs seven other estate lockfiles record for this action.

Each new record's commit was checked against the upstream tag with git ls-remote. No commit an existing entry pins was changed.

RSR Quality Checklist

Required

• No banned language patterns
• No secrets, credentials, or .env files included

Testing

• standards' scripts/check-lock-sync.sh reports no mismatch except the hyperpolymath/standards reusable refs, which this PR leaves alone (see below).
• Every lock entry has a dependency record.

Not fixed here

The standards reusables (governance, hypatia-scan, secret-scanner) stay red. Re-pinning them to a current standards commit makes them fail at startup with zero jobs; I tested that on hyperpolymath/presswerk#138. That has to be fixed in standards.

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• .github/workflows/actions.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 8963bae8-a013-469e-8320-4dcc11488e07

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hyperpolymath]

CI note: the red checks on this PR don't come from this change. The PR edits only .github/workflows/actions.lock.

• Validate DEED manifests, Validate K9 contracts: both fail the same way on main.
• Hypatia neurosymbolic scan: the scan reports 6 critical findings, each "Descriptile in retired location -- must be in .machine_readable/descriptiles/". The scanner added a new rule; these are repo-content findings and don't involve the lockfile. main's last run (2026-10-23) predates the rule change.
• governance / secret-scanner / rust-ci (0 jobs): the standards reusable workflows have started zero jobs from every caller estate-wide since about 2026-10-25 19:30 UTC. main's last green run here predates that.
• release.yml (0 jobs): fails the same way on main. This PR adds the missing slsa-framework/slsa-github-generator lock record, but that alone hasn't got the workflow starting. The cause looks like the same reusable-workflow startup problem.

No fix exists yet for any of these, so I haven't ported one.

---

Generated by Claude Code