From fa46f262283af10fe981667b97e8ab08d1bc2dbb Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 7 Aug 2026 12:47:32 +0100 Subject: [PATCH 1/6] chore(ci): SPDX headers on line 1 and Actions lockfile minted MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two estate gates, one change. **SPDX.** `governance / Workflow security linter` checks `head -1 | grep`, so a workflow carrying its identifier below a managed-by comment reports as missing one. Each file's OWN identifier is moved to line 1 — nothing is imposed, because repositories here are variously MPL-2.0, PMPL-1.0-or-later and AGPL-3.0-or-later and a default would mis-declare the minority. Licences seen here: MPL-2.0. **Lockfile.** `gh actions-lock` resolves each symbolic ref to a verified commit plus owner_id, repo_id and the transitive dependencies of composite actions — which is what OSSF Scorecard's Pinned-Dependencies check is asking for, and what an inline SHA cannot express. ⚠ Do NOT additionally SHA-pin inline. The mechanisms are mutually exclusive: `gh actions-lock` refuses a ref no tag or branch contains, so inline pinning REMOVES actions from the lockfile. Measured on hypatia 2026-08-07 — 40 inline pins caused 14 startup_failures and dropped 7 lockfile entries. Verified: all workflows parse, no duplicate identifiers, lockfile verify says "All 25 workflows have complete lockfile coverage.". --- .github/workflows/abi-drift.yml | 9 +- .github/workflows/actions.lock | 212 ++++++++++++++++++++++++ .github/workflows/backend-assurance.yml | 9 +- .github/workflows/build.yml | 5 +- .github/workflows/codeql.yml | 7 +- .github/workflows/container-publish.yml | 5 +- .github/workflows/dogfood-gate.yml | 13 +- .github/workflows/e2e.yml | 41 ++--- .github/workflows/fuzz.yml | 7 +- .github/workflows/governance.yml | 1 + .github/workflows/hcg-surface-drift.yml | 5 +- .github/workflows/hypatia-scan.yml | 11 +- .github/workflows/instant-sync.yml | 3 +- .github/workflows/lsp-dap-bsp.yml | 13 +- .github/workflows/mirror.yml | 1 + .github/workflows/pages-deploy.yml | 3 +- .github/workflows/pages.yml | 9 +- .github/workflows/proofs.yml | 9 +- .github/workflows/publish.yml | 9 +- .github/workflows/push-email-notify.yml | 3 +- .github/workflows/readme-derive.yml | 1 + .github/workflows/release.yml | 17 +- .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/truthfulness.yml | 7 +- .github/workflows/zig-test.yml | 7 +- 26 files changed, 323 insertions(+), 86 deletions(-) create mode 100644 .github/workflows/actions.lock diff --git a/.github/workflows/abi-drift.yml b/.github/workflows/abi-drift.yml index f214931a..059f07c3 100644 --- a/.github/workflows/abi-drift.yml +++ b/.github/workflows/abi-drift.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # @@ -44,7 +45,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - id: detect @@ -69,7 +70,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 with: # Need at least two commits so `git diff origin/...HEAD` # can compute the changed-cartridge set on pull_request events. @@ -77,7 +78,7 @@ jobs: fetch-depth: 0 - name: Install Rust toolchain (stable) - uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable + uses: dtolnay/rust-toolchain@master with: toolchain: stable @@ -89,7 +90,7 @@ jobs: # GADT-skip fix (iseriser#20, merged 2026-05-20) never reached CI. # Bumping ISERISER_REV invalidates the cache and forces a rebuild. - name: Cache cargo bin (iseriser install) - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 + uses: actions/cache@v4.2.2 env: ISERISER_REV: 741a3b63e7619b6e9cfe7f91b04d7ccfb130b1ca with: diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 00000000..798074d1 --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,212 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/abi-drift.yml': + - 'actions/cache@v4.2.2' + - 'actions/checkout@v6.0.2' + - 'dtolnay/rust-toolchain@master' + '.github/workflows/backend-assurance.yml': + - 'actions/cache@v4.2.2' + - 'actions/checkout@v6.0.2' + - 'erlef/setup-beam@v1.24.0' + '.github/workflows/build.yml': + - 'actions/checkout@v4.3.1' + - 'sonarsource/sonarqube-scan-action@v8.1.0' + '.github/workflows/codeql.yml': + - 'actions/checkout@v6.0.2' + - 'github/codeql-action@v4.34.0' + '.github/workflows/container-publish.yml': + - 'actions/attest-build-provenance@v2.4.0' + - 'actions/checkout@v6.0.2' + '.github/workflows/dogfood-gate.yml': + - 'actions/checkout@v6.0.2' + '.github/workflows/e2e.yml': + - 'actions/checkout@v6.0.2' + - 'actions/github-script@v8.0.0' + - 'actions/setup-node@v4.4.0' + - 'actions/upload-artifact@v4.6.2' + - 'denoland/setup-deno@v2.0.4' + - 'erlef/setup-beam@v1.24.0' + - 'goto-bus-stop/setup-zig@v2.0.0' + - 'oven-sh/setup-bun@v2.2.0' + '.github/workflows/fuzz.yml': + - 'actions/checkout@v6.0.2' + - 'mlugg/setup-zig@v2.2.1' + '.github/workflows/hcg-surface-drift.yml': + - 'actions/checkout@v6.0.2' + '.github/workflows/hypatia-scan.yml': + - 'actions/checkout@v6.0.2' + - 'actions/github-script@v8.0.0' + - 'actions/upload-artifact@v4.6.2' + - 'erlef/setup-beam@v1.24.0' + - 'github/codeql-action@v4.32.6' + '.github/workflows/instant-sync.yml': + - 'peter-evans/repository-dispatch@v3.0.0' + '.github/workflows/lsp-dap-bsp.yml': + - 'actions/checkout@v6.0.2' + - 'goto-bus-stop/setup-zig@v2.0.0' + '.github/workflows/pages-deploy.yml': + - 'actions/checkout@v4.4.0' + '.github/workflows/pages.yml': + - 'actions/checkout@v4.4.0' + - 'actions/deploy-pages@v4.0.5' + - 'actions/upload-pages-artifact@v3.0.1' + '.github/workflows/proofs.yml': + - 'actions/cache@v4.2.2' + - 'actions/checkout@v6.0.2' + '.github/workflows/publish.yml': + - 'actions/checkout@v6.0.2' + - 'actions/setup-node@v4.4.0' + - 'denoland/setup-deno@v2.0.4' + '.github/workflows/push-email-notify.yml': + - 'dawidd6/action-send-mail@v3.12.0' + '.github/workflows/release.yml': + - 'actions/checkout@v6.0.2' + - 'actions/download-artifact@v4.2.1' + - 'actions/upload-artifact@v4.6.2' + - 'mlugg/setup-zig@v2.2.1' + - 'softprops/action-gh-release@v2.6.2' + '.github/workflows/truthfulness.yml': + - 'actions/checkout@v6.0.2' + - 'goto-bus-stop/setup-zig@v2.0.0' + '.github/workflows/zig-test.yml': + - 'actions/checkout@v6.0.2' + - 'mlugg/setup-zig@v2.2.1' +dependencies: + 'actions/attest-build-provenance@1176ef556905f349f669722abf30bce1a6e16e01': + ref: 'predicate@1.1.5' + commit: 'sha1-1176ef556905f349f669722abf30bce1a6e16e01' + owner_id: 44036562 + repo_id: 760702757 + 'actions/attest-build-provenance@v2.4.0': + ref: 'v2.4.0' + commit: 'sha1-e8998f949152b193b063cb0ec769d69d929409be' + owner_id: 44036562 + repo_id: 760702757 + uses: + - 'actions/attest-build-provenance@1176ef556905f349f669722abf30bce1a6e16e01' + - 'actions/attest@ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc' + 'actions/attest@ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc': + ref: 'v2.4.0' + commit: 'sha1-ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc' + owner_id: 44036562 + repo_id: 760701061 + 'actions/cache@v4.2.2': + ref: 'v4.2.2' + commit: 'sha1-d4323d4df104b026a6aa633fdb11d772146be0bf' + owner_id: 44036562 + repo_id: 215566462 + 'actions/checkout@v4.3.1': + ref: 'v4.3.1' + commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v4.4.0': + ref: 'v4.4.0' + commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v6.0.2': + ref: 'v6.0.2' + commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd' + owner_id: 44036562 + repo_id: 197814629 + 'actions/deploy-pages@v4.0.5': + ref: 'v4.0.5' + commit: 'sha1-d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e' + owner_id: 44036562 + repo_id: 438112499 + 'actions/download-artifact@v4.2.1': + ref: 'v4.2.1' + commit: 'sha1-95815c38cf2ff2164869cbab79da8d1f422bc89e' + owner_id: 44036562 + repo_id: 192626254 + 'actions/github-script@v8.0.0': + ref: 'v8.0.0' + commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd' + owner_id: 44036562 + repo_id: 205262760 + 'actions/setup-node@v4.4.0': + ref: 'v4.4.0' + commit: 'sha1-49933ea5288caeca8642d1e84afbd3f7d6820020' + owner_id: 44036562 + repo_id: 189476904 + 'actions/upload-artifact@v4': + ref: 'v4' + commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-artifact@v4.6.2': + ref: 'v4.6.2' + commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-pages-artifact@v3.0.1': + ref: 'v3.0.1' + commit: 'sha1-56afc609e74202658d3ffba0e8f6dda462b719fa' + owner_id: 44036562 + repo_id: 496012378 + uses: + - 'actions/upload-artifact@v4' + 'dawidd6/action-send-mail@v3.12.0': + ref: 'v3.12.0' + commit: 'sha1-6e502825a508b867ab2954ad6343b68787624c01' + owner_id: 9713907 + repo_id: 222439721 + 'denoland/setup-deno@v2.0.4': + ref: 'v2.0.4' + commit: 'sha1-667a34cdef165d8d2b2e98dde39547c9daac7282' + owner_id: 42048915 + repo_id: 356423100 + 'dtolnay/rust-toolchain@master': + ref: 'master' + commit: 'sha1-b3b07ba8b418998c39fb20f53e8b695cdcc8de1b' + owner_id: 1940490 + repo_id: 260749683 + 'erlef/setup-beam@v1.24.0': + ref: 'v1.24.0' + commit: 'sha1-fc68ffb90438ef2936bbb3251622353b3dcb2f93' + owner_id: 47606891 + repo_id: 331103973 + 'github/codeql-action@v4.32.6': + ref: 'v4.32.6' + commit: 'sha1-0d579ffd059c29b07949a3cce3983f0780820c98' + owner_id: 9919 + repo_id: 259445878 + 'github/codeql-action@v4.34.0': + ref: 'v4.34.0' + commit: 'sha1-c6f931105cb2c34c8f901cc885ba1e2e259cf745' + owner_id: 9919 + repo_id: 259445878 + 'goto-bus-stop/setup-zig@v2.0.0': + ref: 'v2.0.0' + commit: 'sha1-9566bb3e8749893055694249726756f25e099b30' + owner_id: 1006268 + repo_id: 212984112 + 'mlugg/setup-zig@v2.2.1': + ref: 'v2.2.1' + commit: 'sha1-d1434d08867e3ee9daa34448df10607b98908d29' + owner_id: 7289241 + repo_id: 812112570 + 'oven-sh/setup-bun@v2.2.0': + ref: 'v2.2.0' + commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6' + owner_id: 108928776 + repo_id: 512644635 + 'peter-evans/repository-dispatch@v3.0.0': + ref: 'v3.0.0' + commit: 'sha1-ff45666b9427631e3450c54a1bcbee4d9ff4d7c0' + owner_id: 18365890 + repo_id: 220359305 + 'softprops/action-gh-release@v2.6.2': + ref: 'v2.6.2' + commit: 'sha1-3bb12739c298aeb8a4eeaf626c5b8d85266b0e65' + owner_id: 2242 + repo_id: 204253808 + 'sonarsource/sonarqube-scan-action@v8.1.0': + ref: 'v8.1.0' + commit: 'sha1-7006c4492b2e0ee0f816d36501671557c97f5995' + owner_id: 545988 + repo_id: 366408409 diff --git a/.github/workflows/backend-assurance.yml b/.github/workflows/backend-assurance.yml index 0b0c2c7d..c85e9934 100644 --- a/.github/workflows/backend-assurance.yml +++ b/.github/workflows/backend-assurance.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # @@ -45,7 +46,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - id: detect @@ -77,16 +78,16 @@ jobs: run: working-directory: elixir steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Set up BEAM (Elixir + OTP) - uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0 + uses: erlef/setup-beam@v1.24.0 with: elixir-version: '1.18.4' otp-version: '27.0' - name: Cache deps + _build - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 + uses: actions/cache@v4.2.2 with: path: | elixir/deps diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 0117e921..aca4379e 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # @@ -20,10 +21,10 @@ jobs: name: SonarQube runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@v4.3.1 with: fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis - name: SonarQube Scan - uses: SonarSource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995 # v8.1.0 + uses: SonarSource/sonarqube-scan-action@v8.1.0 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 45a32c1f..b249b67d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: CodeQL Security Analysis @@ -41,15 +42,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Initialize CodeQL - uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3 + uses: github/codeql-action/init@v4.34.0 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3 + uses: github/codeql-action/analyze@v4.34.0 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/container-publish.yml b/.github/workflows/container-publish.yml index f5e3077e..9cf9eb0b 100644 --- a/.github/workflows/container-publish.yml +++ b/.github/workflows/container-publish.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # @@ -26,7 +27,7 @@ jobs: id-token: write # mint the OIDC token the attestation is signed with attestations: write # write the build-provenance attestation (the "claim") steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Extract version metadata id: meta @@ -91,7 +92,7 @@ jobs: # gh attest verify oci://ghcr.io/${{ github.repository }}: \ # --repo ${{ github.repository }} - name: Attest container provenance - uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2 + uses: actions/attest-build-provenance@v2.4.0 with: subject-name: ghcr.io/${{ github.repository }} subject-digest: ${{ steps.push.outputs.digest }} diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 5d2b2221..c4a37b99 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # @@ -35,7 +36,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Check for A2ML files id: detect @@ -76,7 +77,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Check for K9 files id: detect @@ -122,7 +123,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Scan for invisible characters id: lint @@ -190,7 +191,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Check for Groove manifest id: groove @@ -249,7 +250,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Check and validate eclexiaiser manifest id: eclex @@ -297,7 +298,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Generate dogfooding scorecard run: | diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index e6ebde77..0ec0984f 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # @@ -32,7 +33,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - id: detect @@ -64,15 +65,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Install Zig - uses: goto-bus-stop/setup-zig@9566bb3e8749893055694249726756f25e099b30 # v2 + uses: goto-bus-stop/setup-zig@v2.0.0 with: version: 0.15.1 - name: Install Deno - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4 + uses: denoland/setup-deno@v2.0.4 with: deno-version: v2.x @@ -80,7 +81,7 @@ jobs: # tests/e2e_full.sh requires `mix` on PATH to start the Elixir # backend (elixir/ — `mix run --no-halt`). Pinned to match the # estate convention (see hypatia-scan.yml across the org). - uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.18.2 + uses: erlef/setup-beam@v1.24.0 with: elixir-version: '1.18' otp-version: '27' @@ -113,7 +114,7 @@ jobs: - name: Upload test logs if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@v4.6.2 with: name: e2e-full-logs path: /tmp/boj-e2e-test.* @@ -129,10 +130,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Install Zig - uses: goto-bus-stop/setup-zig@9566bb3e8749893055694249726756f25e099b30 # v2 + uses: goto-bus-stop/setup-zig@v2.0.0 with: version: 0.15.1 @@ -152,7 +153,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Run aspect tests run: bash tests/aspect_tests.sh @@ -167,10 +168,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Install Zig - uses: goto-bus-stop/setup-zig@9566bb3e8749893055694249726756f25e099b30 # v2 + uses: goto-bus-stop/setup-zig@v2.0.0 with: version: 0.15.1 @@ -182,7 +183,7 @@ jobs: - name: Upload benchmark results if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@v4.6.2 with: name: benchmark-results path: ffi/zig/zig-out/bench* @@ -221,24 +222,24 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Setup Node # Node is needed on every leg: it is the subject on the node # leg and the boot-smoke orchestrator on all three. - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + uses: actions/setup-node@v4.4.0 with: node-version: '22' - name: Install Deno if: matrix.runtime == 'deno' - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4 + uses: denoland/setup-deno@v2.0.4 with: deno-version: v2.x - name: Install Bun if: matrix.runtime == 'bun' - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 + uses: oven-sh/setup-bun@v2.2.0 with: bun-version: '1.x' @@ -267,10 +268,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Setup Node - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + uses: actions/setup-node@v4.4.0 with: node-version: '22' @@ -279,7 +280,7 @@ jobs: - name: Upload bridge bench artifact if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@v4.6.2 with: name: bench-bridge-results path: bench-bridge.txt @@ -290,7 +291,7 @@ jobs: # Advisory — a comment failure must never gate the bench job. # Same reasoning as the hypatia-scan PR-comment step. continue-on-error: true - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v7 + uses: actions/github-script@v8.0.0 with: script: | const fs = require('fs'); diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 4704d7c7..9bf75e8b 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Fuzz testing for BoJ Server FFI layer # Addresses OpenSSF Scorecard "Fuzzing" check @@ -25,10 +26,10 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Install Zig - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2 + uses: mlugg/setup-zig@v2.2.1 with: version: 0.15.2 @@ -53,7 +54,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Fuzz JSON-RPC message parsing run: | diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index cc62f6c8..c3c8e93b 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # governance.yml — single wrapper calling the shared estate governance bundle # in hyperpolymath/standards instead of carrying per-repo copies. diff --git a/.github/workflows/hcg-surface-drift.yml b/.github/workflows/hcg-surface-drift.yml index f4677497..86e1d487 100644 --- a/.github/workflows/hcg-surface-drift.yml +++ b/.github/workflows/hcg-surface-drift.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # @@ -50,7 +51,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - id: detect @@ -85,7 +86,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Confirm script + inputs are present run: | set -euo pipefail diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 44042905..b36c4497 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan @@ -48,12 +49,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 with: fetch-depth: 0 # Full history for better pattern analysis - name: Setup Elixir for Hypatia scanner - uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.18.2 + uses: erlef/setup-beam@v1.24.0 with: elixir-version: '1.18' otp-version: '27' @@ -107,7 +108,7 @@ jobs: echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY - name: Upload findings artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@v4.6.2 with: name: hypatia-findings path: hypatia-findings.json @@ -243,7 +244,7 @@ jobs: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork != true) - uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.28.1 + uses: github/codeql-action/upload-sarif@v4.32.6 with: sarif_file: hypatia.sarif # Distinct category so Hypatia results coexist with CodeQL's @@ -383,7 +384,7 @@ jobs: # the pull-requests: write permission above: a token/API hiccup or # a fork PR (read-only token) skips the comment, not the check. continue-on-error: true - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v7 + uses: actions/github-script@v8.0.0 with: script: | const fs = require('fs'); diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index d52b810d..d0571cfc 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync @@ -26,7 +27,7 @@ jobs: timeout-minutes: 5 steps: - name: Trigger Propagation - uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3 + uses: peter-evans/repository-dispatch@v3.0.0 with: token: ${{ secrets.FARM_DISPATCH_TOKEN }} repository: hyperpolymath/.git-private-farm diff --git a/.github/workflows/lsp-dap-bsp.yml b/.github/workflows/lsp-dap-bsp.yml index dc6a5751..78c10d2e 100644 --- a/.github/workflows/lsp-dap-bsp.yml +++ b/.github/workflows/lsp-dap-bsp.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # lsp-dap-bsp.yml — Dedicated CI for Language Server, Debug Adapter, and Build Server cartridges # Validates ABI specs, FFI builds, adapter compilation, and panel manifests @@ -30,7 +31,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - id: detect @@ -56,7 +57,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Validate ABI modules exist run: | echo "=== Checking LSP/DAP/BSP ABI modules ===" @@ -92,13 +93,13 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 # The old step curled ziglang.org/builds/...0.15.2... — that path is the # nightly dir, not release downloads, so it returned an error page and # `tar` died ("File format not recognized"). Use the pinned action + # .tool-versions' canonical 0.15.1, matching e2e.yml. - name: Install Zig - uses: goto-bus-stop/setup-zig@9566bb3e8749893055694249726756f25e099b30 # v2 + uses: goto-bus-stop/setup-zig@v2.0.0 with: version: 0.15.1 - name: Build LSP/DAP/BSP cartridge FFI @@ -139,7 +140,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 # jq (pre-installed on ubuntu-latest) — the repo's no-Python policy # (dogfood-gate) bans the previous json.tool/json.load approach. # Same checks: valid JSON + required fields + panel count. @@ -173,7 +174,7 @@ jobs: needs: [changes, abi-check, ffi-build, panel-validation] if: needs.changes.outputs.run == 'true' steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Verify triadic structure run: | echo "=== LSP/DAP/BSP Triadic Structure Audit ===" diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 4d61c13b..810717d3 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Mirror to Git Forges diff --git a/.github/workflows/pages-deploy.yml b/.github/workflows/pages-deploy.yml index 78eca2bd..aa95b6bf 100644 --- a/.github/workflows/pages-deploy.yml +++ b/.github/workflows/pages-deploy.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Fallback Cloudflare Workers deploy via Direct Upload (wrangler deploy). # Bypasses the Cloudflare Git Integration build system entirely. @@ -19,7 +20,7 @@ jobs: deploy: runs-on: ubuntu-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@v4.4.0 - name: Deploy site/ to Cloudflare Workers (static assets) run: npx wrangler@latest deploy env: diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 442dcdaa..6f6e8998 100755 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # @@ -24,9 +25,9 @@ jobs: image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff steps: - name: Checkout Site - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + uses: actions/checkout@v4.4.0 - name: Checkout Ddraig SSG - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + uses: actions/checkout@v4.4.0 with: repository: hyperpolymath/ddraig-ssg path: .ddraig-ssg @@ -43,7 +44,7 @@ jobs: fi ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/} - name: Upload artifact - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 + uses: actions/upload-pages-artifact@v3.0.1 with: path: '_site' deploy: @@ -56,4 +57,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 + uses: actions/deploy-pages@v4.0.5 diff --git a/.github/workflows/proofs.yml b/.github/workflows/proofs.yml index 0942bd49..f9f6d4d2 100644 --- a/.github/workflows/proofs.yml +++ b/.github/workflows/proofs.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # @@ -50,7 +51,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - id: detect @@ -80,7 +81,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Enforce trusted base run: bash scripts/check-trusted-base.sh @@ -92,7 +93,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 45 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Read pinned Idris2 version id: ver @@ -102,7 +103,7 @@ jobs: run: sudo apt-get update && sudo apt-get install -y chezscheme libgmp-dev build-essential - name: Cache asdf + Idris2 toolchain - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 + uses: actions/cache@v4.2.2 with: path: ~/.asdf key: idris2-asdf-${{ runner.os }}-${{ steps.ver.outputs.idris2 }} diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 2c9f32af..a18d4855 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # @@ -23,10 +24,10 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Setup Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + uses: actions/setup-node@v4.4.0 with: node-version: '22' registry-url: 'https://registry.npmjs.org' @@ -53,10 +54,10 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Setup Deno - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4 + uses: denoland/setup-deno@v2.0.4 with: deno-version: v2.x diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 112afd18..3269309b 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; @@ -16,7 +17,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Send push notification email - uses: dawidd6/action-send-mail@6e502825a508b867ab2954ad6343b68787624c01 # pinned + uses: dawidd6/action-send-mail@v3.12.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/readme-derive.yml b/.github/workflows/readme-derive.yml index c5a89370..6ec5d955 100644 --- a/.github/workflows/readme-derive.yml +++ b/.github/workflows/readme-derive.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # README single-source derivation (ADR-004): README.adoc is canonical; # README.md is derived for the Glama MCP directory (Markdown-only renderer). diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5577dc96..69b79af0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # @@ -25,10 +26,10 @@ jobs: outputs: hashes: ${{ steps.hash.outputs.hashes }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Install Zig - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2 + uses: mlugg/setup-zig@v2.2.1 with: version: 0.15.2 @@ -74,7 +75,7 @@ jobs: echo "hashes=${HASHES}" >> "$GITHUB_OUTPUT" - name: Upload build artifacts - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@v4.6.2 with: name: release-artifacts path: boj-server-*-linux-x86_64.tar.gz @@ -90,7 +91,7 @@ jobs: changelog: ${{ steps.cliff.outputs.content }} version: ${{ steps.version.outputs.version }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 with: fetch-depth: 0 @@ -120,7 +121,7 @@ jobs: git cliff --output CHANGELOG.md - name: Upload updated CHANGELOG.md - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@v4.6.2 with: name: changelog path: CHANGELOG.md @@ -134,16 +135,16 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Download build artifacts - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1 + uses: actions/download-artifact@v4.2.1 with: name: release-artifacts path: artifacts/ - name: Create GitHub Release - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 + uses: softprops/action-gh-release@v2.6.2 with: body: ${{ needs.changelog.outputs.changelog }} draft: false diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index ddd724aa..6eea97f4 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell # diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 4839d606..5b0bc7d8 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Secret Scanner diff --git a/.github/workflows/truthfulness.yml b/.github/workflows/truthfulness.yml index 8d820f2b..25276c4b 100644 --- a/.github/workflows/truthfulness.yml +++ b/.github/workflows/truthfulness.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # @@ -34,7 +35,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - id: detect @@ -65,10 +66,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@v6.0.2 - name: Install Zig - uses: goto-bus-stop/setup-zig@9566bb3e8749893055694249726756f25e099b30 # v2 + uses: goto-bus-stop/setup-zig@v2.0.0 with: version: 0.15.1 diff --git a/.github/workflows/zig-test.yml b/.github/workflows/zig-test.yml index ef5b0931..58cfe533 100644 --- a/.github/workflows/zig-test.yml +++ b/.github/workflows/zig-test.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # @@ -31,7 +32,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 with: fetch-depth: 0 - id: detect @@ -62,10 +63,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@v6.0.2 - name: Install Zig - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2 + uses: mlugg/setup-zig@v2.2.1 with: version: 0.15.2 From 89a9e73455663c45ddee44f2633560d01e311343 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 7 Aug 2026 13:22:45 +0100 Subject: [PATCH 2/6] fix(ci): SPDX identifier back to line 1, after the lockfile step MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `gh actions-lock` inserts `# This workflow is managed by gh actions-lock.` at line 1, which displaced the SPDX identifier moved there earlier in this branch. The linter greps `head -1` only, so the header read as missing again. Each file's OWN identifier is moved back to line 1 — nothing imposed. Files already correct are untouched, and any file carrying two identifiers aborts the change rather than guessing. --- .github/workflows/abi-drift.yml | 2 +- .github/workflows/backend-assurance.yml | 2 +- .github/workflows/build.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/container-publish.yml | 2 +- .github/workflows/dogfood-gate.yml | 2 +- .github/workflows/e2e.yml | 2 +- .github/workflows/fuzz.yml | 2 +- .github/workflows/governance.yml | 2 +- .github/workflows/hcg-surface-drift.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/instant-sync.yml | 2 +- .github/workflows/lsp-dap-bsp.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/pages-deploy.yml | 2 +- .github/workflows/pages.yml | 2 +- .github/workflows/proofs.yml | 2 +- .github/workflows/publish.yml | 2 +- .github/workflows/push-email-notify.yml | 2 +- .github/workflows/readme-derive.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- .github/workflows/truthfulness.yml | 2 +- .github/workflows/zig-test.yml | 2 +- 25 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/abi-drift.yml b/.github/workflows/abi-drift.yml index 059f07c3..bdccd6d2 100644 --- a/.github/workflows/abi-drift.yml +++ b/.github/workflows/abi-drift.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # ABI Drift Gate (standards#92 Phase 2) diff --git a/.github/workflows/backend-assurance.yml b/.github/workflows/backend-assurance.yml index c85e9934..b9254d3c 100644 --- a/.github/workflows/backend-assurance.yml +++ b/.github/workflows/backend-assurance.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Backend-Assurance Harness (epic #87 Tier C) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index aca4379e..90087ece 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # SonarQube Cloud (SonarCloud) static analysis. Generated from the SonarCloud diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b249b67d..5fa1487b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: CodeQL Security Analysis on: diff --git a/.github/workflows/container-publish.yml b/.github/workflows/container-publish.yml index 9cf9eb0b..18202d6c 100644 --- a/.github/workflows/container-publish.yml +++ b/.github/workflows/container-publish.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Container Publish workflow — builds and pushes the container image to diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index c4a37b99..1e28a34d 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 0ec0984f..b9b02aae 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Full test suite for BoJ Server: E2E, aspect tests, and benchmarks. diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 9bf75e8b..4301f508 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Fuzz testing for BoJ Server FFI layer # Addresses OpenSSF Scorecard "Fuzzing" check name: Fuzz Testing diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index c3c8e93b..9ce3d89d 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # governance.yml — single wrapper calling the shared estate governance bundle # in hyperpolymath/standards instead of carrying per-repo copies. # diff --git a/.github/workflows/hcg-surface-drift.yml b/.github/workflows/hcg-surface-drift.yml index 86e1d487..75e8c468 100644 --- a/.github/workflows/hcg-surface-drift.yml +++ b/.github/workflows/hcg-surface-drift.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # HCG Surface Drift Gate (standards#100 / standards#91 — Phase E §1.5) diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index b36c4497..8d9ceb77 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index d0571cfc..ca63e51d 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync diff --git a/.github/workflows/lsp-dap-bsp.yml b/.github/workflows/lsp-dap-bsp.yml index 78c10d2e..5b2a7590 100644 --- a/.github/workflows/lsp-dap-bsp.yml +++ b/.github/workflows/lsp-dap-bsp.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # lsp-dap-bsp.yml — Dedicated CI for Language Server, Debug Adapter, and Build Server cartridges # Validates ABI specs, FFI builds, adapter compilation, and panel manifests # for the three protocol cartridges (lsp-mcp, dap-mcp, bsp-mcp). diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 810717d3..0a4e1473 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Mirror to Git Forges on: diff --git a/.github/workflows/pages-deploy.yml b/.github/workflows/pages-deploy.yml index aa95b6bf..faccff1e 100644 --- a/.github/workflows/pages-deploy.yml +++ b/.github/workflows/pages-deploy.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Fallback Cloudflare Workers deploy via Direct Upload (wrangler deploy). # Bypasses the Cloudflare Git Integration build system entirely. # Uses wrangler deploy (Workers + Assets) rather than the deprecated diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 6f6e8998..b0b1461f 100755 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # GitHub Pages docs deploy via the Ddraig SSG (#288). diff --git a/.github/workflows/proofs.yml b/.github/workflows/proofs.yml index f9f6d4d2..adbd1952 100644 --- a/.github/workflows/proofs.yml +++ b/.github/workflows/proofs.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Proofs Gate — type-check every Idris2 proof + enforce the trusted base. diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a18d4855..16173bfd 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Publish workflow — publishes to npm and JSR on version tag push (v*). diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 3269309b..360340cf 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by diff --git a/.github/workflows/readme-derive.yml b/.github/workflows/readme-derive.yml index 6ec5d955..9103560a 100644 --- a/.github/workflows/readme-derive.yml +++ b/.github/workflows/readme-derive.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # README single-source derivation (ADR-004): README.adoc is canonical; # README.md is derived for the Glama MCP directory (Markdown-only renderer). # This caller delegates to the standards reusable, which reads the diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 69b79af0..83de20eb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Release workflow — triggered by version tags (v*). diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 6eea97f4..172f16d2 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell # # Aligned with the documented caller pattern in diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 5b0bc7d8..fe54a678 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Secret Scanner on: diff --git a/.github/workflows/truthfulness.yml b/.github/workflows/truthfulness.yml index 25276c4b..156919da 100644 --- a/.github/workflows/truthfulness.yml +++ b/.github/workflows/truthfulness.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Truthfulness invariant: the cartridge catalogue must never advertise as diff --git a/.github/workflows/zig-test.yml b/.github/workflows/zig-test.yml index 58cfe533..2d273b82 100644 --- a/.github/workflows/zig-test.yml +++ b/.github/workflows/zig-test.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # BoJ Server — Zig FFI test & build pipeline From 7c4538e9e5a232cbf98d961e16a1b81ad5be1313 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 7 Aug 2026 14:46:13 +0100 Subject: [PATCH 3/6] fix: Keep SPDX on line 1 --- .github/workflows/abi-drift.yml | 2 +- .github/workflows/backend-assurance.yml | 2 +- .github/workflows/build.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/container-publish.yml | 2 +- .github/workflows/dogfood-gate.yml | 2 +- .github/workflows/e2e.yml | 2 +- .github/workflows/fuzz.yml | 2 +- .github/workflows/governance.yml | 2 +- .github/workflows/hcg-surface-drift.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/instant-sync.yml | 2 +- .github/workflows/lsp-dap-bsp.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/pages-deploy.yml | 2 +- .github/workflows/pages.yml | 2 +- .github/workflows/proofs.yml | 2 +- .github/workflows/publish.yml | 2 +- .github/workflows/push-email-notify.yml | 2 +- .github/workflows/readme-derive.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- .github/workflows/truthfulness.yml | 2 +- .github/workflows/zig-test.yml | 2 +- 25 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/abi-drift.yml b/.github/workflows/abi-drift.yml index bdccd6d2..059f07c3 100644 --- a/.github/workflows/abi-drift.yml +++ b/.github/workflows/abi-drift.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # ABI Drift Gate (standards#92 Phase 2) diff --git a/.github/workflows/backend-assurance.yml b/.github/workflows/backend-assurance.yml index b9254d3c..c85e9934 100644 --- a/.github/workflows/backend-assurance.yml +++ b/.github/workflows/backend-assurance.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Backend-Assurance Harness (epic #87 Tier C) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 90087ece..aca4379e 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # SonarQube Cloud (SonarCloud) static analysis. Generated from the SonarCloud diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 5fa1487b..b249b67d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 name: CodeQL Security Analysis on: diff --git a/.github/workflows/container-publish.yml b/.github/workflows/container-publish.yml index 18202d6c..9cf9eb0b 100644 --- a/.github/workflows/container-publish.yml +++ b/.github/workflows/container-publish.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Container Publish workflow — builds and pushes the container image to diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 1e28a34d..c4a37b99 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index b9b02aae..0ec0984f 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Full test suite for BoJ Server: E2E, aspect tests, and benchmarks. diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 4301f508..9bf75e8b 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Fuzz testing for BoJ Server FFI layer # Addresses OpenSSF Scorecard "Fuzzing" check name: Fuzz Testing diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 9ce3d89d..c3c8e93b 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # governance.yml — single wrapper calling the shared estate governance bundle # in hyperpolymath/standards instead of carrying per-repo copies. # diff --git a/.github/workflows/hcg-surface-drift.yml b/.github/workflows/hcg-surface-drift.yml index 75e8c468..86e1d487 100644 --- a/.github/workflows/hcg-surface-drift.yml +++ b/.github/workflows/hcg-surface-drift.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # HCG Surface Drift Gate (standards#100 / standards#91 — Phase E §1.5) diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 8d9ceb77..b36c4497 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index ca63e51d..d0571cfc 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync diff --git a/.github/workflows/lsp-dap-bsp.yml b/.github/workflows/lsp-dap-bsp.yml index 5b2a7590..78c10d2e 100644 --- a/.github/workflows/lsp-dap-bsp.yml +++ b/.github/workflows/lsp-dap-bsp.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # lsp-dap-bsp.yml — Dedicated CI for Language Server, Debug Adapter, and Build Server cartridges # Validates ABI specs, FFI builds, adapter compilation, and panel manifests # for the three protocol cartridges (lsp-mcp, dap-mcp, bsp-mcp). diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 0a4e1473..810717d3 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 name: Mirror to Git Forges on: diff --git a/.github/workflows/pages-deploy.yml b/.github/workflows/pages-deploy.yml index faccff1e..aa95b6bf 100644 --- a/.github/workflows/pages-deploy.yml +++ b/.github/workflows/pages-deploy.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Fallback Cloudflare Workers deploy via Direct Upload (wrangler deploy). # Bypasses the Cloudflare Git Integration build system entirely. # Uses wrangler deploy (Workers + Assets) rather than the deprecated diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index b0b1461f..6f6e8998 100755 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # GitHub Pages docs deploy via the Ddraig SSG (#288). diff --git a/.github/workflows/proofs.yml b/.github/workflows/proofs.yml index adbd1952..f9f6d4d2 100644 --- a/.github/workflows/proofs.yml +++ b/.github/workflows/proofs.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Proofs Gate — type-check every Idris2 proof + enforce the trusted base. diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 16173bfd..a18d4855 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Publish workflow — publishes to npm and JSR on version tag push (v*). diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 360340cf..3269309b 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by diff --git a/.github/workflows/readme-derive.yml b/.github/workflows/readme-derive.yml index 9103560a..6ec5d955 100644 --- a/.github/workflows/readme-derive.yml +++ b/.github/workflows/readme-derive.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # README single-source derivation (ADR-004): README.adoc is canonical; # README.md is derived for the Glama MCP directory (Markdown-only renderer). # This caller delegates to the standards reusable, which reads the diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 83de20eb..69b79af0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Release workflow — triggered by version tags (v*). diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 172f16d2..6eea97f4 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell # # Aligned with the documented caller pattern in diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index fe54a678..5b0bc7d8 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 name: Secret Scanner on: diff --git a/.github/workflows/truthfulness.yml b/.github/workflows/truthfulness.yml index 156919da..25276c4b 100644 --- a/.github/workflows/truthfulness.yml +++ b/.github/workflows/truthfulness.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Truthfulness invariant: the cartridge catalogue must never advertise as diff --git a/.github/workflows/zig-test.yml b/.github/workflows/zig-test.yml index 2d273b82..58cfe533 100644 --- a/.github/workflows/zig-test.yml +++ b/.github/workflows/zig-test.yml @@ -1,5 +1,5 @@ -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # BoJ Server — Zig FFI test & build pipeline From 229b771f8f98a838e0788325418fc4f9dc83a6ca Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 7 Aug 2026 14:47:52 +0100 Subject: [PATCH 4/6] fix: Re-pin GitHub Actions to immutable SHAs --- .github/workflows/abi-drift.yml | 8 ++--- .github/workflows/backend-assurance.yml | 8 ++--- .github/workflows/build.yml | 4 +-- .github/workflows/codeql.yml | 6 ++-- .github/workflows/container-publish.yml | 4 +-- .github/workflows/dogfood-gate.yml | 12 ++++---- .github/workflows/e2e.yml | 40 ++++++++++++------------- .github/workflows/fuzz.yml | 6 ++-- .github/workflows/hcg-surface-drift.yml | 4 +-- .github/workflows/hypatia-scan.yml | 8 ++--- .github/workflows/instant-sync.yml | 2 +- .github/workflows/lsp-dap-bsp.yml | 12 ++++---- .github/workflows/pages-deploy.yml | 2 +- .github/workflows/pages.yml | 8 ++--- .github/workflows/proofs.yml | 8 ++--- .github/workflows/publish.yml | 8 ++--- .github/workflows/push-email-notify.yml | 2 +- .github/workflows/release.yml | 16 +++++----- .github/workflows/truthfulness.yml | 6 ++-- .github/workflows/zig-test.yml | 6 ++-- 20 files changed, 85 insertions(+), 85 deletions(-) diff --git a/.github/workflows/abi-drift.yml b/.github/workflows/abi-drift.yml index 059f07c3..c47990fa 100644 --- a/.github/workflows/abi-drift.yml +++ b/.github/workflows/abi-drift.yml @@ -45,7 +45,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - id: detect @@ -70,7 +70,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: # Need at least two commits so `git diff origin/...HEAD` # can compute the changed-cartridge set on pull_request events. @@ -78,7 +78,7 @@ jobs: fetch-depth: 0 - name: Install Rust toolchain (stable) - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master with: toolchain: stable @@ -90,7 +90,7 @@ jobs: # GADT-skip fix (iseriser#20, merged 2026-05-20) never reached CI. # Bumping ISERISER_REV invalidates the cache and forces a rebuild. - name: Cache cargo bin (iseriser install) - uses: actions/cache@v4.2.2 + uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 env: ISERISER_REV: 741a3b63e7619b6e9cfe7f91b04d7ccfb130b1ca with: diff --git a/.github/workflows/backend-assurance.yml b/.github/workflows/backend-assurance.yml index c85e9934..5d608d8b 100644 --- a/.github/workflows/backend-assurance.yml +++ b/.github/workflows/backend-assurance.yml @@ -46,7 +46,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - id: detect @@ -78,16 +78,16 @@ jobs: run: working-directory: elixir steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up BEAM (Elixir + OTP) - uses: erlef/setup-beam@v1.24.0 + uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0 with: elixir-version: '1.18.4' otp-version: '27.0' - name: Cache deps + _build - uses: actions/cache@v4.2.2 + uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 with: path: | elixir/deps diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index aca4379e..c054d205 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -21,10 +21,10 @@ jobs: name: SonarQube runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4.3.1 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis - name: SonarQube Scan - uses: SonarSource/sonarqube-scan-action@v8.1.0 + uses: SonarSource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995 # v8.1.0 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b249b67d..e016c20f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -42,15 +42,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Initialize CodeQL - uses: github/codeql-action/init@v4.34.0 + uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.34.0 + uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/container-publish.yml b/.github/workflows/container-publish.yml index 9cf9eb0b..4b38a27e 100644 --- a/.github/workflows/container-publish.yml +++ b/.github/workflows/container-publish.yml @@ -27,7 +27,7 @@ jobs: id-token: write # mint the OIDC token the attestation is signed with attestations: write # write the build-provenance attestation (the "claim") steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Extract version metadata id: meta @@ -92,7 +92,7 @@ jobs: # gh attest verify oci://ghcr.io/${{ github.repository }}: \ # --repo ${{ github.repository }} - name: Attest container provenance - uses: actions/attest-build-provenance@v2.4.0 + uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0 with: subject-name: ghcr.io/${{ github.repository }} subject-digest: ${{ steps.push.outputs.digest }} diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index c4a37b99..6eff48be 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -36,7 +36,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Check for A2ML files id: detect @@ -77,7 +77,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Check for K9 files id: detect @@ -123,7 +123,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Scan for invisible characters id: lint @@ -191,7 +191,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Check for Groove manifest id: groove @@ -250,7 +250,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Check and validate eclexiaiser manifest id: eclex @@ -298,7 +298,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Generate dogfooding scorecard run: | diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 0ec0984f..d6d8b2aa 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -33,7 +33,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - id: detect @@ -65,15 +65,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install Zig - uses: goto-bus-stop/setup-zig@v2.0.0 + uses: goto-bus-stop/setup-zig@9566bb3e8749893055694249726756f25e099b30 # v2.0.0 with: version: 0.15.1 - name: Install Deno - uses: denoland/setup-deno@v2.0.4 + uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4 with: deno-version: v2.x @@ -81,7 +81,7 @@ jobs: # tests/e2e_full.sh requires `mix` on PATH to start the Elixir # backend (elixir/ — `mix run --no-halt`). Pinned to match the # estate convention (see hypatia-scan.yml across the org). - uses: erlef/setup-beam@v1.24.0 + uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0 with: elixir-version: '1.18' otp-version: '27' @@ -114,7 +114,7 @@ jobs: - name: Upload test logs if: always() - uses: actions/upload-artifact@v4.6.2 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: e2e-full-logs path: /tmp/boj-e2e-test.* @@ -130,10 +130,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install Zig - uses: goto-bus-stop/setup-zig@v2.0.0 + uses: goto-bus-stop/setup-zig@9566bb3e8749893055694249726756f25e099b30 # v2.0.0 with: version: 0.15.1 @@ -153,7 +153,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Run aspect tests run: bash tests/aspect_tests.sh @@ -168,10 +168,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install Zig - uses: goto-bus-stop/setup-zig@v2.0.0 + uses: goto-bus-stop/setup-zig@9566bb3e8749893055694249726756f25e099b30 # v2.0.0 with: version: 0.15.1 @@ -183,7 +183,7 @@ jobs: - name: Upload benchmark results if: always() - uses: actions/upload-artifact@v4.6.2 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: benchmark-results path: ffi/zig/zig-out/bench* @@ -222,24 +222,24 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Node # Node is needed on every leg: it is the subject on the node # leg and the boot-smoke orchestrator on all three. - uses: actions/setup-node@v4.4.0 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '22' - name: Install Deno if: matrix.runtime == 'deno' - uses: denoland/setup-deno@v2.0.4 + uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4 with: deno-version: v2.x - name: Install Bun if: matrix.runtime == 'bun' - uses: oven-sh/setup-bun@v2.2.0 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version: '1.x' @@ -268,10 +268,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Node - uses: actions/setup-node@v4.4.0 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '22' @@ -280,7 +280,7 @@ jobs: - name: Upload bridge bench artifact if: always() - uses: actions/upload-artifact@v4.6.2 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: bench-bridge-results path: bench-bridge.txt @@ -291,7 +291,7 @@ jobs: # Advisory — a comment failure must never gate the bench job. # Same reasoning as the hypatia-scan PR-comment step. continue-on-error: true - uses: actions/github-script@v8.0.0 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: script: | const fs = require('fs'); diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 9bf75e8b..daab904a 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -26,10 +26,10 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install Zig - uses: mlugg/setup-zig@v2.2.1 + uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1 with: version: 0.15.2 @@ -54,7 +54,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Fuzz JSON-RPC message parsing run: | diff --git a/.github/workflows/hcg-surface-drift.yml b/.github/workflows/hcg-surface-drift.yml index 86e1d487..83afd004 100644 --- a/.github/workflows/hcg-surface-drift.yml +++ b/.github/workflows/hcg-surface-drift.yml @@ -51,7 +51,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - id: detect @@ -86,7 +86,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Confirm script + inputs are present run: | set -euo pipefail diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index b36c4497..9b27d961 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -49,12 +49,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 # Full history for better pattern analysis - name: Setup Elixir for Hypatia scanner - uses: erlef/setup-beam@v1.24.0 + uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0 with: elixir-version: '1.18' otp-version: '27' @@ -108,7 +108,7 @@ jobs: echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY - name: Upload findings artifact - uses: actions/upload-artifact@v4.6.2 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: hypatia-findings path: hypatia-findings.json @@ -384,7 +384,7 @@ jobs: # the pull-requests: write permission above: a token/API hiccup or # a fork PR (read-only token) skips the comment, not the check. continue-on-error: true - uses: actions/github-script@v8.0.0 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: script: | const fs = require('fs'); diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index d0571cfc..69011bf8 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -27,7 +27,7 @@ jobs: timeout-minutes: 5 steps: - name: Trigger Propagation - uses: peter-evans/repository-dispatch@v3.0.0 + uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0 with: token: ${{ secrets.FARM_DISPATCH_TOKEN }} repository: hyperpolymath/.git-private-farm diff --git a/.github/workflows/lsp-dap-bsp.yml b/.github/workflows/lsp-dap-bsp.yml index 78c10d2e..5faecd73 100644 --- a/.github/workflows/lsp-dap-bsp.yml +++ b/.github/workflows/lsp-dap-bsp.yml @@ -31,7 +31,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - id: detect @@ -57,7 +57,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Validate ABI modules exist run: | echo "=== Checking LSP/DAP/BSP ABI modules ===" @@ -93,13 +93,13 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # The old step curled ziglang.org/builds/...0.15.2... — that path is the # nightly dir, not release downloads, so it returned an error page and # `tar` died ("File format not recognized"). Use the pinned action + # .tool-versions' canonical 0.15.1, matching e2e.yml. - name: Install Zig - uses: goto-bus-stop/setup-zig@v2.0.0 + uses: goto-bus-stop/setup-zig@9566bb3e8749893055694249726756f25e099b30 # v2.0.0 with: version: 0.15.1 - name: Build LSP/DAP/BSP cartridge FFI @@ -140,7 +140,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # jq (pre-installed on ubuntu-latest) — the repo's no-Python policy # (dogfood-gate) bans the previous json.tool/json.load approach. # Same checks: valid JSON + required fields + panel count. @@ -174,7 +174,7 @@ jobs: needs: [changes, abi-check, ffi-build, panel-validation] if: needs.changes.outputs.run == 'true' steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Verify triadic structure run: | echo "=== LSP/DAP/BSP Triadic Structure Audit ===" diff --git a/.github/workflows/pages-deploy.yml b/.github/workflows/pages-deploy.yml index aa95b6bf..ccf9e225 100644 --- a/.github/workflows/pages-deploy.yml +++ b/.github/workflows/pages-deploy.yml @@ -20,7 +20,7 @@ jobs: deploy: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4.4.0 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Deploy site/ to Cloudflare Workers (static assets) run: npx wrangler@latest deploy env: diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 6f6e8998..38868d7c 100755 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -25,9 +25,9 @@ jobs: image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff steps: - name: Checkout Site - uses: actions/checkout@v4.4.0 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Checkout Ddraig SSG - uses: actions/checkout@v4.4.0 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: repository: hyperpolymath/ddraig-ssg path: .ddraig-ssg @@ -44,7 +44,7 @@ jobs: fi ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/} - name: Upload artifact - uses: actions/upload-pages-artifact@v3.0.1 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: path: '_site' deploy: @@ -57,4 +57,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4.0.5 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 diff --git a/.github/workflows/proofs.yml b/.github/workflows/proofs.yml index f9f6d4d2..f975b5cd 100644 --- a/.github/workflows/proofs.yml +++ b/.github/workflows/proofs.yml @@ -51,7 +51,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - id: detect @@ -81,7 +81,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Enforce trusted base run: bash scripts/check-trusted-base.sh @@ -93,7 +93,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 45 steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Read pinned Idris2 version id: ver @@ -103,7 +103,7 @@ jobs: run: sudo apt-get update && sudo apt-get install -y chezscheme libgmp-dev build-essential - name: Cache asdf + Idris2 toolchain - uses: actions/cache@v4.2.2 + uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 with: path: ~/.asdf key: idris2-asdf-${{ runner.os }}-${{ steps.ver.outputs.idris2 }} diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a18d4855..74b7ab51 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -24,10 +24,10 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Node.js - uses: actions/setup-node@v4.4.0 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '22' registry-url: 'https://registry.npmjs.org' @@ -54,10 +54,10 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Deno - uses: denoland/setup-deno@v2.0.4 + uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4 with: deno-version: v2.x diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 3269309b..a930d24a 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Send push notification email - uses: dawidd6/action-send-mail@v3.12.0 + uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 69b79af0..15ada11d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,10 +26,10 @@ jobs: outputs: hashes: ${{ steps.hash.outputs.hashes }} steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install Zig - uses: mlugg/setup-zig@v2.2.1 + uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1 with: version: 0.15.2 @@ -75,7 +75,7 @@ jobs: echo "hashes=${HASHES}" >> "$GITHUB_OUTPUT" - name: Upload build artifacts - uses: actions/upload-artifact@v4.6.2 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: release-artifacts path: boj-server-*-linux-x86_64.tar.gz @@ -91,7 +91,7 @@ jobs: changelog: ${{ steps.cliff.outputs.content }} version: ${{ steps.version.outputs.version }} steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 @@ -121,7 +121,7 @@ jobs: git cliff --output CHANGELOG.md - name: Upload updated CHANGELOG.md - uses: actions/upload-artifact@v4.6.2 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: changelog path: CHANGELOG.md @@ -135,16 +135,16 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Download build artifacts - uses: actions/download-artifact@v4.2.1 + uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1 with: name: release-artifacts path: artifacts/ - name: Create GitHub Release - uses: softprops/action-gh-release@v2.6.2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 with: body: ${{ needs.changelog.outputs.changelog }} draft: false diff --git a/.github/workflows/truthfulness.yml b/.github/workflows/truthfulness.yml index 25276c4b..772ecfd6 100644 --- a/.github/workflows/truthfulness.yml +++ b/.github/workflows/truthfulness.yml @@ -35,7 +35,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - id: detect @@ -66,10 +66,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install Zig - uses: goto-bus-stop/setup-zig@v2.0.0 + uses: goto-bus-stop/setup-zig@9566bb3e8749893055694249726756f25e099b30 # v2.0.0 with: version: 0.15.1 diff --git a/.github/workflows/zig-test.yml b/.github/workflows/zig-test.yml index 58cfe533..94d28322 100644 --- a/.github/workflows/zig-test.yml +++ b/.github/workflows/zig-test.yml @@ -32,7 +32,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - id: detect @@ -63,10 +63,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install Zig - uses: mlugg/setup-zig@v2.2.1 + uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1 with: version: 0.15.2 From 2d3af78c151b6df90ae7983eb07e590d33f6633f Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 7 Aug 2026 15:05:53 +0100 Subject: [PATCH 5/6] fix(ci): ensure SPDX is on line 1 and update lockfile --- .github/workflows/abi-drift.yml | 2 +- .github/workflows/backend-assurance.yml | 2 +- .github/workflows/build.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/container-publish.yml | 2 +- .github/workflows/dogfood-gate.yml | 2 +- .github/workflows/e2e.yml | 2 +- .github/workflows/fuzz.yml | 2 +- .github/workflows/governance.yml | 2 +- .github/workflows/hcg-surface-drift.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/instant-sync.yml | 2 +- .github/workflows/lsp-dap-bsp.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/pages-deploy.yml | 2 +- .github/workflows/pages.yml | 2 +- .github/workflows/proofs.yml | 2 +- .github/workflows/publish.yml | 2 +- .github/workflows/push-email-notify.yml | 2 +- .github/workflows/readme-derive.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- .github/workflows/truthfulness.yml | 2 +- .github/workflows/zig-test.yml | 2 +- 25 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/abi-drift.yml b/.github/workflows/abi-drift.yml index c47990fa..58b04ec7 100644 --- a/.github/workflows/abi-drift.yml +++ b/.github/workflows/abi-drift.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # ABI Drift Gate (standards#92 Phase 2) diff --git a/.github/workflows/backend-assurance.yml b/.github/workflows/backend-assurance.yml index 5d608d8b..c7ee5d28 100644 --- a/.github/workflows/backend-assurance.yml +++ b/.github/workflows/backend-assurance.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Backend-Assurance Harness (epic #87 Tier C) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index c054d205..bfc20070 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # SonarQube Cloud (SonarCloud) static analysis. Generated from the SonarCloud diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e016c20f..2f6b9bfb 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: CodeQL Security Analysis on: diff --git a/.github/workflows/container-publish.yml b/.github/workflows/container-publish.yml index 4b38a27e..033f17d7 100644 --- a/.github/workflows/container-publish.yml +++ b/.github/workflows/container-publish.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Container Publish workflow — builds and pushes the container image to diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 6eff48be..4a64d391 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index d6d8b2aa..9110cb44 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Full test suite for BoJ Server: E2E, aspect tests, and benchmarks. diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index daab904a..28d447f4 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Fuzz testing for BoJ Server FFI layer # Addresses OpenSSF Scorecard "Fuzzing" check name: Fuzz Testing diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index c3c8e93b..9ce3d89d 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # governance.yml — single wrapper calling the shared estate governance bundle # in hyperpolymath/standards instead of carrying per-repo copies. # diff --git a/.github/workflows/hcg-surface-drift.yml b/.github/workflows/hcg-surface-drift.yml index 83afd004..ea976b34 100644 --- a/.github/workflows/hcg-surface-drift.yml +++ b/.github/workflows/hcg-surface-drift.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # HCG Surface Drift Gate (standards#100 / standards#91 — Phase E §1.5) diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 9b27d961..fff3e08d 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Hypatia Neurosymbolic CI/CD Security Scan name: Hypatia Security Scan diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 69011bf8..40388e10 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Instant Forge Sync - Triggers propagation to all forges on push/release name: Instant Sync diff --git a/.github/workflows/lsp-dap-bsp.yml b/.github/workflows/lsp-dap-bsp.yml index 5faecd73..fcc6892d 100644 --- a/.github/workflows/lsp-dap-bsp.yml +++ b/.github/workflows/lsp-dap-bsp.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # lsp-dap-bsp.yml — Dedicated CI for Language Server, Debug Adapter, and Build Server cartridges # Validates ABI specs, FFI builds, adapter compilation, and panel manifests # for the three protocol cartridges (lsp-mcp, dap-mcp, bsp-mcp). diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 810717d3..0a4e1473 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Mirror to Git Forges on: diff --git a/.github/workflows/pages-deploy.yml b/.github/workflows/pages-deploy.yml index ccf9e225..2225b255 100644 --- a/.github/workflows/pages-deploy.yml +++ b/.github/workflows/pages-deploy.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Fallback Cloudflare Workers deploy via Direct Upload (wrangler deploy). # Bypasses the Cloudflare Git Integration build system entirely. # Uses wrangler deploy (Workers + Assets) rather than the deprecated diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 38868d7c..497532df 100755 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # GitHub Pages docs deploy via the Ddraig SSG (#288). diff --git a/.github/workflows/proofs.yml b/.github/workflows/proofs.yml index f975b5cd..826ea5aa 100644 --- a/.github/workflows/proofs.yml +++ b/.github/workflows/proofs.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Proofs Gate — type-check every Idris2 proof + enforce the trusted base. diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 74b7ab51..a61a5aec 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Publish workflow — publishes to npm and JSR on version tag push (v*). diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index a930d24a..c0994aff 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by diff --git a/.github/workflows/readme-derive.yml b/.github/workflows/readme-derive.yml index 6ec5d955..9103560a 100644 --- a/.github/workflows/readme-derive.yml +++ b/.github/workflows/readme-derive.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # README single-source derivation (ADR-004): README.adoc is canonical; # README.md is derived for the Glama MCP directory (Markdown-only renderer). # This caller delegates to the standards reusable, which reads the diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 15ada11d..676461e0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Release workflow — triggered by version tags (v*). diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 6eea97f4..172f16d2 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell # # Aligned with the documented caller pattern in diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 5b0bc7d8..fe54a678 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Secret Scanner on: diff --git a/.github/workflows/truthfulness.yml b/.github/workflows/truthfulness.yml index 772ecfd6..357adc55 100644 --- a/.github/workflows/truthfulness.yml +++ b/.github/workflows/truthfulness.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # Truthfulness invariant: the cartridge catalogue must never advertise as diff --git a/.github/workflows/zig-test.yml b/.github/workflows/zig-test.yml index 94d28322..2e7c7493 100644 --- a/.github/workflows/zig-test.yml +++ b/.github/workflows/zig-test.yml @@ -1,5 +1,5 @@ -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # # BoJ Server — Zig FFI test & build pipeline From d63a49b6610874fae0e6fcd661d4ea3ca11b0c8f Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 7 Aug 2026 15:11:13 +0100 Subject: [PATCH 6/6] fix(ci): restore valid yaml list syntax for uses --- .github/workflows/abi-drift.yml | 4 ++-- .github/workflows/backend-assurance.yml | 4 ++-- .github/workflows/build.yml | 2 +- .github/workflows/container-publish.yml | 2 +- .github/workflows/e2e.yml | 2 +- .github/workflows/fuzz.yml | 4 ++-- .github/workflows/hcg-surface-drift.yml | 4 ++-- .github/workflows/lsp-dap-bsp.yml | 10 +++++----- .github/workflows/pages-deploy.yml | 2 +- .github/workflows/proofs.yml | 6 +++--- .github/workflows/publish.yml | 4 ++-- .github/workflows/release.yml | 6 +++--- .github/workflows/truthfulness.yml | 2 +- .github/workflows/zig-test.yml | 4 ++-- 14 files changed, 28 insertions(+), 28 deletions(-) diff --git a/.github/workflows/abi-drift.yml b/.github/workflows/abi-drift.yml index 58b04ec7..3ef358d9 100644 --- a/.github/workflows/abi-drift.yml +++ b/.github/workflows/abi-drift.yml @@ -45,7 +45,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - id: detect @@ -70,7 +70,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: # Need at least two commits so `git diff origin/...HEAD` # can compute the changed-cartridge set on pull_request events. diff --git a/.github/workflows/backend-assurance.yml b/.github/workflows/backend-assurance.yml index c7ee5d28..4bdb33fb 100644 --- a/.github/workflows/backend-assurance.yml +++ b/.github/workflows/backend-assurance.yml @@ -46,7 +46,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - id: detect @@ -78,7 +78,7 @@ jobs: run: working-directory: elixir steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up BEAM (Elixir + OTP) uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index bfc20070..fc47f77a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -21,7 +21,7 @@ jobs: name: SonarQube runs-on: ubuntu-latest steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis - name: SonarQube Scan diff --git a/.github/workflows/container-publish.yml b/.github/workflows/container-publish.yml index 033f17d7..fada542e 100644 --- a/.github/workflows/container-publish.yml +++ b/.github/workflows/container-publish.yml @@ -27,7 +27,7 @@ jobs: id-token: write # mint the OIDC token the attestation is signed with attestations: write # write the build-provenance attestation (the "claim") steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Extract version metadata id: meta diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 9110cb44..b4e69fa2 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -33,7 +33,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - id: detect diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 28d447f4..72389fe3 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -26,7 +26,7 @@ jobs: permissions: contents: read steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install Zig uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1 @@ -54,7 +54,7 @@ jobs: permissions: contents: read steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Fuzz JSON-RPC message parsing run: | diff --git a/.github/workflows/hcg-surface-drift.yml b/.github/workflows/hcg-surface-drift.yml index ea976b34..0ea0eaa6 100644 --- a/.github/workflows/hcg-surface-drift.yml +++ b/.github/workflows/hcg-surface-drift.yml @@ -51,7 +51,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - id: detect @@ -86,7 +86,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Confirm script + inputs are present run: | set -euo pipefail diff --git a/.github/workflows/lsp-dap-bsp.yml b/.github/workflows/lsp-dap-bsp.yml index fcc6892d..674f65be 100644 --- a/.github/workflows/lsp-dap-bsp.yml +++ b/.github/workflows/lsp-dap-bsp.yml @@ -31,7 +31,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - id: detect @@ -57,7 +57,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Validate ABI modules exist run: | echo "=== Checking LSP/DAP/BSP ABI modules ===" @@ -93,7 +93,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # The old step curled ziglang.org/builds/...0.15.2... — that path is the # nightly dir, not release downloads, so it returned an error page and # `tar` died ("File format not recognized"). Use the pinned action + @@ -140,7 +140,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # jq (pre-installed on ubuntu-latest) — the repo's no-Python policy # (dogfood-gate) bans the previous json.tool/json.load approach. # Same checks: valid JSON + required fields + panel count. @@ -174,7 +174,7 @@ jobs: needs: [changes, abi-check, ffi-build, panel-validation] if: needs.changes.outputs.run == 'true' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Verify triadic structure run: | echo "=== LSP/DAP/BSP Triadic Structure Audit ===" diff --git a/.github/workflows/pages-deploy.yml b/.github/workflows/pages-deploy.yml index 2225b255..230a0d3d 100644 --- a/.github/workflows/pages-deploy.yml +++ b/.github/workflows/pages-deploy.yml @@ -20,7 +20,7 @@ jobs: deploy: runs-on: ubuntu-latest steps: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Deploy site/ to Cloudflare Workers (static assets) run: npx wrangler@latest deploy env: diff --git a/.github/workflows/proofs.yml b/.github/workflows/proofs.yml index 826ea5aa..69f7dfe6 100644 --- a/.github/workflows/proofs.yml +++ b/.github/workflows/proofs.yml @@ -51,7 +51,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - id: detect @@ -81,7 +81,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Enforce trusted base run: bash scripts/check-trusted-base.sh @@ -93,7 +93,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 45 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Read pinned Idris2 version id: ver diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a61a5aec..73460a76 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -24,7 +24,7 @@ jobs: contents: read id-token: write steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Node.js uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 @@ -54,7 +54,7 @@ jobs: contents: read id-token: write steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Deno uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 676461e0..bf810f10 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,7 +26,7 @@ jobs: outputs: hashes: ${{ steps.hash.outputs.hashes }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install Zig uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1 @@ -91,7 +91,7 @@ jobs: changelog: ${{ steps.cliff.outputs.content }} version: ${{ steps.version.outputs.version }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 @@ -135,7 +135,7 @@ jobs: permissions: contents: write steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Download build artifacts uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1 diff --git a/.github/workflows/truthfulness.yml b/.github/workflows/truthfulness.yml index 357adc55..8f12cb06 100644 --- a/.github/workflows/truthfulness.yml +++ b/.github/workflows/truthfulness.yml @@ -35,7 +35,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - id: detect diff --git a/.github/workflows/zig-test.yml b/.github/workflows/zig-test.yml index 2e7c7493..8d482177 100644 --- a/.github/workflows/zig-test.yml +++ b/.github/workflows/zig-test.yml @@ -32,7 +32,7 @@ jobs: outputs: run: ${{ steps.detect.outputs.run }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - id: detect @@ -63,7 +63,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install Zig uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1