Skip to content

Actions lockfile verify red on main: 3 stale actions.lock entries #108

Closed
#111
Closed
Actions lockfile verify red on main: 3 stale actions.lock entries#108
#111
Labels
cicdCI/CD: workflows, actions, lockfiles, pins, runners, release gatestech-debtKnown shortcut, drift, or hygiene owed - includes cleanup

Description

@hyperpolymath
hyperpolymath
opened on Oct 6, 2026

governance / Actions lockfile verify is red on main (fa9bd38) and on every PR, e.g. #107.

The verifier reports "valid": false with 3 stale entries and 23 sha-as-ref warnings (lockfile_version v0.0.2). The timing fits #106 (dependabot bumping the actions group) landing without a matching actions.lock regeneration.

Acceptance criteria

  • actions.lock regenerated with the authoritative tool (gh actions-lock / scripts/update-actions-lock.sh), never edited by hand.
  • governance / Actions lockfile verify is green on main.
  • Optional: the dependabot config regenerates the lock in the same PR, so the next bump does not reopen this.

Found while deferring the red check on #107 (§5c).

🤖 Generated with Claude Code

Activity

  1. github-actions
    added
    cicdCI/CD: workflows, actions, lockfiles, pins, runners, release gates
    tech-debtKnown shortcut, drift, or hygiene owed - includes cleanup
    on Oct 6, 2026
  2. hyperpolymath
    added a commit that references this issue on Oct 6, 2026

    fix(parser): replace a Rust doc comment in the Parser module header (#…

    b0eba0f

  3. hyperpolymath commented on Oct 6, 2026

    @hyperpolymath
    hyperpolymath
    on Oct 6, 2026
    OwnerAuthor

    Related, but not yet confirmed to share a root cause: Haskell CI (.github/workflows/haskell.yml) has ended in startup_failure on every run since 2026-10-03: push fa9bd386, PR 4317025d (#107), push b0eba0f1. The last run that started was 2026-10-01 (564bcde3, failure). A workflow that never starts often means its uses: pins are missing from actions.lock, which would make this the same stale-lock drift. Check it when regenerating the lock: package compilation has not run in CI since the fix in #107.

  4. hyperpolymath
    added 2 commits that reference this issue on Oct 6, 2026

    fix(licence): declare MPL-2.0 for code and CC-BY-SA-4.0 for prose (#110)

    8b08492

    fix(ci): sync actions.lock with bumped pins; drop manifest-less Depen…

    e9b06a2
  5. hyperpolymath
    closed this as completedin #111on Oct 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    cicdCI/CD: workflows, actions, lockfiles, pins, runners, release gatestech-debtKnown shortcut, drift, or hygiene owed - includes cleanup

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions