Skip to content

fix(ci): reconcile actions.lock so the lockfile validates #101

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 1 commit into from
Sep 21, 2026
Merged

fix(ci): reconcile actions.lock so the lockfile validates #101

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions .github/workflows/abi-contract.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
# This workflow is managed by gh actions-lock.

Check warning

Code scanning / Hypatia

Hypatia code_scanning_alerts: CSA001 Warning

Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 0 day(s) old

Check warning

Code scanning / Hypatia

Hypatia code_scanning_alerts: CSA001 Warning

Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 0 day(s) old

Check warning

Code scanning / Hypatia

Hypatia code_scanning_alerts: CSA001 Warning

Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 0 day(s) old

Check warning

Code scanning / Hypatia

Hypatia code_scanning_alerts: CSA001 Warning

Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 0 day(s) old

Check warning

Code scanning / Hypatia

Hypatia code_scanning_alerts: CSA001 Warning

Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 0 day(s) old
# SPDX-License-Identifier: MPL-2.0
# ABI contract gate — keeps the Zig FFI and the Idris2 model in lockstep.
#
Expand Down Expand Up @@ -31,10 +32,10 @@
timeout-minutes: 15
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@v4.2.2

- name: Install Zig 0.15.2
uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
uses: mlugg/setup-zig@v2.2.1

Check failure on line 38 in .github/workflows/abi-contract.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=hyperpolymath_game-server-admin&issues=AaDD7DtS5iY96tbnKojJ&open=AaDD7DtS5iY96tbnKojJ&pullRequest=101
with:
version: 0.15.2

Expand Down Expand Up @@ -75,15 +76,15 @@
image: ghcr.io/stefan-hoeck/idris2-pack@sha256:370e2ab066251cf278ac6928d9201ade0aca70c4e7ee1cc434d25bcea1669b29
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@v4.2.2

- name: Install Zig archive prerequisite in the Idris image
run: |
apt-get update
apt-get install --no-install-recommends -y xz-utils

- name: Install Zig 0.15.2 for the real shared-library boundary
uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
uses: mlugg/setup-zig@v2.2.1

Check failure on line 87 in .github/workflows/abi-contract.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=hyperpolymath_game-server-admin&issues=AaDD7DtS5iY96tbnKojK&open=AaDD7DtS5iY96tbnKojK&pullRequest=101
with:
version: 0.15.2

Expand All @@ -96,7 +97,7 @@
timeout-minutes: 5
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@v4.2.2

# Symbol-level contract only (pure grep/comm — no toolchain): every
# extern in src/ui/tea/gsa_ffi.affine must be a real Zig export, and
Expand Down
268 changes: 268 additions & 0 deletions .github/workflows/actions.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,268 @@
# This file is machine-generated by `gh actions-lock`.
# Do not edit by hand; run `gh actions-lock` to update.
# Docs: https://gh.io/actions-lockfile
version: 'v0.0.2'
workflows:
'.github/workflows/abi-contract.yml':
- 'actions/checkout@v4.2.2'
- 'mlugg/setup-zig@v2.2.1'
'.github/workflows/boj-build.yml':
- 'actions/checkout@v4.1.7'
'.github/workflows/casket-pages.yml':
- 'actions/cache@v4.3.0'
- 'actions/checkout@v4.1.1'
- 'actions/configure-pages@v5.0.0'
- 'actions/deploy-pages@v4.0.5'
- 'actions/upload-pages-artifact@v3.0.1'
- 'haskell-actions/setup@v2.7.5'
'.github/workflows/codeql.yml':
- 'actions/checkout@v6.0.2'
- 'github/codeql-action@v4.34.0'
'.github/workflows/cross-platform.yml':
- 'actions/cache@v4.2.0'
- 'actions/checkout@v4.2.2'
- 'mlugg/setup-zig@v2.2.1'
'.github/workflows/dogfood-gate.yml':
- 'actions/checkout@v4.3.1'
- 'hyperpolymath/deed-ecosystem@main'
- 'hyperpolymath/k9-ecosystem@main'
'.github/workflows/governance.yml': []
'.github/workflows/hypatia-scan.yml':
- 'actions/checkout@v6.0.2'
- 'actions/github-script@v8.0.0'
- 'actions/upload-artifact@v4.6.2'
- 'erlef/setup-beam@v1.24.0'
- 'github/codeql-action@v4.32.6'
'.github/workflows/instant-sync.yml':
- 'peter-evans/repository-dispatch@v4.0.1'
'.github/workflows/label-triage.yml': []
'.github/workflows/labels.yml': []
'.github/workflows/mirror.yml': []
'.github/workflows/push-email-notify.yml':
- 'hyperpolymath/smtp-notify-action@v0.2.0'
'.github/workflows/release.yml':
- 'actions/attest-build-provenance@v2.4.0'
- 'actions/checkout@v6.0.2'
- 'actions/download-artifact@v4.3.0'
- 'actions/upload-artifact@v4.6.2'
- 'softprops/action-gh-release@v2.5.0'
'.github/workflows/rhodibot.yml':
- 'actions/checkout@v7.0.1'
'.github/workflows/scorecard.yml': []
'.github/workflows/secret-scanner.yml': []
'.github/workflows/static-analysis-gate.yml':
- 'actions/checkout@v6.0.2'
- 'actions/download-artifact@v4.1.8'
- 'actions/upload-artifact@v4.6.2'
- 'erlef/setup-beam@v1.20.4'
dependencies:
'actions/attest-build-provenance@1176ef556905f349f669722abf30bce1a6e16e01':
ref: 'predicate@1.1.5'
commit: 'sha1-1176ef556905f349f669722abf30bce1a6e16e01'
owner_id: 44036562
repo_id: 760702757
'actions/attest-build-provenance@v2.4.0':
ref: 'v2.4.0'
commit: 'sha1-e8998f949152b193b063cb0ec769d69d929409be'
owner_id: 44036562
repo_id: 760702757
uses:
- 'actions/attest-build-provenance@1176ef556905f349f669722abf30bce1a6e16e01'
- 'actions/attest@ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc'
'actions/attest@ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc':
ref: 'v2.4.0'
commit: 'sha1-ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc'
owner_id: 44036562
repo_id: 760701061
'actions/cache@v4.2.0':
ref: 'v4.2.0'
commit: 'sha1-1bd1e32a3bdc45362d1e726936510720a7c30a57'
owner_id: 44036562
repo_id: 215566462
'actions/cache@v4.3.0':
ref: 'v4.3.0'
commit: 'sha1-0057852bfaa89a56745cba8c7296529d2fc39830'
owner_id: 44036562
repo_id: 215566462
'actions/checkout@v4.1.1':
ref: 'v4.1.1'
commit: 'sha1-b4ffde65f46336ab88eb53be808477a3936bae11'
owner_id: 44036562
repo_id: 197814629
'actions/checkout@v4.1.7':
ref: 'v4.1.7'
commit: 'sha1-692973e3d937129bcbf40652eb9f2f61becf3332'
owner_id: 44036562
repo_id: 197814629
'actions/checkout@v4.2.2':
ref: 'v4.2.2'
commit: 'sha1-11bd71901bbe5b1630ceea73d27597364c9af683'
owner_id: 44036562
repo_id: 197814629
'actions/checkout@v4.3.1':
ref: 'v4.3.1'
commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5'
owner_id: 44036562
repo_id: 197814629
'actions/checkout@v6.0.2':
ref: 'v6.0.2'
commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
owner_id: 44036562
repo_id: 197814629
'actions/checkout@v7.0.1':
ref: 'v7.0.1'
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
owner_id: 44036562
repo_id: 197814629
'actions/configure-pages@v5.0.0':
ref: 'v5.0.0'
commit: 'sha1-983d7736d9b0ae728b81ab479565c72886d7745b'
owner_id: 44036562
repo_id: 513659658
'actions/deploy-pages@v4.0.5':
ref: 'v4.0.5'
commit: 'sha1-d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e'
owner_id: 44036562
repo_id: 438112499
'actions/download-artifact@v4.1.8':
ref: 'v4.1.8'
commit: 'sha1-fa0a91b85d4f404e444e00e005971372dc801d16'
owner_id: 44036562
repo_id: 192626254
'actions/download-artifact@v4.3.0':
ref: 'v4.3.0'
commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
owner_id: 44036562
repo_id: 192626254
'actions/github-script@v8.0.0':
ref: 'v8.0.0'
commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd'
owner_id: 44036562
repo_id: 205262760
'actions/upload-artifact@v4':
ref: 'v4'
commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
owner_id: 44036562
repo_id: 192625955
'actions/upload-artifact@v4.6.2':
ref: 'v4.6.2'
commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
owner_id: 44036562
repo_id: 192625955
'actions/upload-pages-artifact@v3.0.1':
ref: 'v3.0.1'
commit: 'sha1-56afc609e74202658d3ffba0e8f6dda462b719fa'
owner_id: 44036562
repo_id: 496012378
uses:
- 'actions/upload-artifact@v4'
'erlef/setup-beam@v1.20.4':
ref: 'v1.20.4'
commit: 'sha1-e6d7c94229049569db56a7ad5a540c051a010af9'
owner_id: 47606891
repo_id: 331103973
'erlef/setup-beam@v1.24.0':
ref: 'v1.24.0'
commit: 'sha1-fc68ffb90438ef2936bbb3251622353b3dcb2f93'
owner_id: 47606891
repo_id: 331103973
'github/codeql-action@v4.32.6':
ref: 'v4.32.6'
commit: 'sha1-0d579ffd059c29b07949a3cce3983f0780820c98'
owner_id: 9919
repo_id: 259445878
'github/codeql-action@v4.34.0':
ref: 'v4.34.0'
commit: 'sha1-c6f931105cb2c34c8f901cc885ba1e2e259cf745'
owner_id: 9919
repo_id: 259445878
'haskell-actions/setup@v2.7.5':
ref: 'v2.7.5'
commit: 'sha1-ec49483bfc012387b227434aba94f59a6ecd0900'
owner_id: 75048950
repo_id: 623796603
'hyperpolymath/deed-ecosystem@main':
ref: 'main'
commit: 'sha1-aa4b836bd969df2bc58128cb8e3d20bbc88d5e79'
owner_id: 6759885
repo_id: 1275649586
'hyperpolymath/k9-ecosystem@main':
ref: 'main'
commit: 'sha1-89f3c2702f4f650a92aa7411502f38da06abd562'
owner_id: 6759885
repo_id: 1275650185
'hyperpolymath/smtp-notify-action@v0.2.0':
ref: 'v0.2.0'
commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7'
owner_id: 6759885
repo_id: 1352485172
'mlugg/setup-zig@v2.2.1':
ref: 'v2.2.1'
commit: 'sha1-d1434d08867e3ee9daa34448df10607b98908d29'
owner_id: 7289241
repo_id: 812112570
'peter-evans/repository-dispatch@v4.0.1':
ref: 'v4.0.1'
commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
owner_id: 18365890
repo_id: 220359305
'softprops/action-gh-release@v2.5.0':
ref: 'v2.5.0'
commit: 'sha1-a06a81a03ee405af7f2048a818ed3f03bbf83c7b'
owner_id: 2242
repo_id: 204253808
'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
ref: 'v6.1.0'
commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
owner_id: 44036562
repo_id: 215566462
'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
ref: 'v7.0.1'
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
owner_id: 44036562
repo_id: 197814629
'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a':
ref: 'v7.0.1'
commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
owner_id: 44036562
repo_id: 192625955
'actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08':
ref: 'v4.6.0'
commit: 'sha1-65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08'
owner_id: 44036562
repo_id: 192625955
'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
ref: 'v2.0.5'
commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
owner_id: 42048915
repo_id: 356423100
'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772':
ref: 'stable'
commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
owner_id: 1940490
repo_id: 260749683
'editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c':
ref: 'v2.2.0'
commit: 'sha1-840e866d93b8e032123c23bac69dece044d4d84c'
owner_id: 26415196
repo_id: 297874902
'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
ref: 'v1.24.1'
commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
owner_id: 47606891
repo_id: 331103973
'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc':
ref: 'v2.4.4'
commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
owner_id: 67707773
repo_id: 421101922
'softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda':
ref: 'v2.2.1'
commit: 'sha1-c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda'
owner_id: 2242
repo_id: 204253808
'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555':
ref: 'v0.10.0'
commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555'
owner_id: 135788
repo_id: 208510314
3 changes: 2 additions & 1 deletion .github/workflows/boj-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
# This workflow is managed by gh actions-lock.

Check warning

Code scanning / Hypatia

Hypatia code_scanning_alerts: CSA001 Warning

Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 0 day(s) old
# SPDX-License-Identifier: MPL-2.0
#
# OPTIONAL: BoJ Server Build Trigger
Expand All @@ -17,10 +18,10 @@
timeout-minutes: 10
steps:
- name: Checkout
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
uses: actions/checkout@v4.1.7
- name: Trigger BoJ Server (Casket/ssg-mcp)
env:
BOJ_URL: ${{ secrets.BOJ_SERVER_URL || vars.BOJ_SERVER_URL }}

Check warning on line 24 in .github/workflows/boj-build.yml

View workflow job for this annotation

GitHub Actions / Hypatia neurosymbolic scan 

[hypatia] job in .github/workflows/boj-build.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring
run: |
if [ -z "$BOJ_URL" ]; then
echo "BOJ_SERVER_URL not configured — skipping"
Expand Down
15 changes: 8 additions & 7 deletions .github/workflows/casket-pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
# This workflow is managed by gh actions-lock.

Check warning

Code scanning / Hypatia

Hypatia code_scanning_alerts: CSA001 Warning

Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 0 day(s) old

Check warning

Code scanning / Hypatia

Hypatia code_scanning_alerts: CSA001 Warning

Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 0 day(s) old

Check warning

Code scanning / Hypatia

Hypatia code_scanning_alerts: CSA001 Warning

Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 0 day(s) old

Check warning

Code scanning / Hypatia

Hypatia code_scanning_alerts: CSA001 Warning

Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 0 day(s) old

Check warning

Code scanning / Hypatia

Hypatia code_scanning_alerts: CSA001 Warning

Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 0 day(s) old

Check warning

Code scanning / Hypatia

Hypatia code_scanning_alerts: CSA001 Warning

Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 0 day(s) old

Check warning

Code scanning / Hypatia

Hypatia code_scanning_alerts: CSA001 Warning

Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 0 day(s) old
# SPDX-License-Identifier: MPL-2.0
name: GitHub Pages

Expand All @@ -22,22 +23,22 @@
timeout-minutes: 30
steps:
- name: Checkout
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
uses: actions/checkout@v4.1.1

- name: Checkout casket-ssg
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
uses: actions/checkout@v4.1.1
with:
repository: hyperpolymath/casket-ssg
path: .casket-ssg

- name: Setup GHCup
uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2
uses: haskell-actions/setup@v2.7.5

Check failure on line 35 in .github/workflows/casket-pages.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=hyperpolymath_game-server-admin&issues=AaDD7DuG5iY96tbnKojM&open=AaDD7DuG5iY96tbnKojM&pullRequest=101
with:
ghc-version: '9.8.2'
cabal-version: '3.10'

- name: Cache Cabal
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
uses: actions/cache@v4.3.0
with:
path: |
~/.cabal/packages
Expand Down Expand Up @@ -99,10 +100,10 @@
touch ../_site/.nojekyll

- name: Setup Pages
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
uses: actions/configure-pages@v5.0.0

- name: Upload artifact
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
uses: actions/upload-pages-artifact@v3.0.1
with:
path: '_site'

Expand All @@ -116,4 +117,4 @@
steps:
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
uses: actions/deploy-pages@v4.0.5
Loading
Loading