From 6035f55be7ac8cf48bfde597b0b36b951637ce4e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 7 Oct 2026 07:28:48 +0100 Subject: [PATCH 1/2] fix(ci): sync actions.lock with the dependabot-bumped pins (#108) Dependabot moved three uses: lines to new commits, but actions.lock still named the old ones. The lockfile match is literal on the ref string, so GitHub refused to start the affected workflows: Haskell CI has ended in startup_failure on every run since 2026-10-03. - haskell-actions/setup 6037f336 (v2.12.0) -> 0f8e8c99 (v2.12.1) in haskell.yml and casket-pages.yml - github/codeql-action 1c5b6756 (v4.38.1) -> 2892aa5e (v4.38.2) in codeql.yml The lock is edited by hand on purpose. `gh actions-lock` in fix mode rewrites every workflow's SHA pins into tags, and this repo has sha_pinning_required=true, so that output would itself stop the workflows from starting. Checked as a matched pair on the unchanged workflow bytes: old lock fails `gh actions-lock --no-fix` (rc 1), new lock passes (rc 0). Also corrects the stale version comments beside those two pins (`# v2` and `# v3` -> the tags the SHAs actually carry). Closes #108 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_012kgrMQRhSmZMBbF9Ui1zBw --- .github/workflows/actions.lock | 18 +++++++++--------- .github/workflows/casket-pages.yml | 2 +- .github/workflows/codeql.yml | 4 ++-- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 10a061f..fbb78f5 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -11,10 +11,10 @@ workflows: - 'actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d' - 'actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346' - 'actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9' - - 'haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d' + - 'haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d' '.github/workflows/codeql.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'github/codeql-action@1c5b675653bb5c22dbe9b12b556ec555138e09fd' + - 'github/codeql-action@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2' '.github/workflows/dependabot-automerge.yml': - 'dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98' '.github/workflows/dogfood-gate.yml': @@ -24,7 +24,7 @@ workflows: '.github/workflows/haskell.yml': - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d' + - 'haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d' '.github/workflows/instant-sync.yml': - 'peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697' '.github/workflows/pages.yml': @@ -75,14 +75,14 @@ dependencies: commit: 'sha1-25dd0e34f4fe68f24cc83900b1fe3fe149efef98' owner_id: 27347476 repo_id: 371068214 - 'github/codeql-action@1c5b675653bb5c22dbe9b12b556ec555138e09fd': - ref: 'v4.38.1' - commit: 'sha1-1c5b675653bb5c22dbe9b12b556ec555138e09fd' + 'github/codeql-action@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2': + ref: 'v4.38.2' + commit: 'sha1-2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2' owner_id: 9919 repo_id: 259445878 - 'haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d': - ref: 'v2.12.0' - commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' + 'haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d': + ref: 'v2.12.1' + commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d' owner_id: 75048950 repo_id: 623796603 'hyperpolymath/smtp-notify-action@22e7bdb322c430c1d0dac6b3bb307f4bb139d0be': diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index 77116d5..3d23a68 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -31,7 +31,7 @@ jobs: path: .casket-ssg - name: Setup GHCup - uses: haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d # v2 + uses: haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d # v2.12.1 with: ghc-version: '9.8.2' cabal-version: '3.10' diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 153ea84..39174d1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -39,12 +39,12 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v3 + uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v3 + uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: category: "/language:${{ matrix.language }}" From 33dd482f28f3de4f80952615716350d83dcee60c Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 7 Oct 2026 07:44:34 +0100 Subject: [PATCH 2/2] fix(ci): drop Dependabot ecosystems that have no manifest here sanctify-php is a Haskell (cabal) project with no package.json, Python requirements or Cargo.toml, so the npm, pip and cargo update jobs failed on every run ("/package.json not found"). Dependabot has no Haskell ecosystem, so github-actions is the only one it can serve. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_012kgrMQRhSmZMBbF9Ui1zBw --- .github/dependabot.yml | 25 ++++--------------------- 1 file changed, 4 insertions(+), 21 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 85dba19..fcf1606 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,5 +1,9 @@ version: 2 updates: + # sanctify-php is a Haskell (cabal) project. Dependabot has no Haskell + # ecosystem, so GitHub Actions is the only one it can update here. The + # former npm, pip and cargo entries had no manifest to read (no + # package.json, requirements file or Cargo.toml) and failed every run. - package-ecosystem: "github-actions" directory: "/" schedule: @@ -8,24 +12,3 @@ updates: actions: patterns: - "*" - - - package-ecosystem: "cargo" - directory: "/" - schedule: - interval: "weekly" - # `open-pull-requests-limit: 0` suppresses routine version-update PRs - # while leaving Dependabot SECURITY PRs flowing. The previous - # `ignore: "*" patch` rule also silenced security PRs under GitHub\'s - # current Dependabot behaviour. See rsr-template-repo commit 78b050e - # and 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md. - open-pull-requests-limit: 0 - - - package-ecosystem: "npm" - directory: "/" - schedule: - interval: "weekly" - - - package-ecosystem: "pip" - directory: "/" - schedule: - interval: "weekly"