fix(ci): unbreak workflow YAML and add a complete actions.lock

[hyperpolymath]

Remediates GitHub Workflow Dependency Locking (public preview, no changelog entry), which rejects runs at startup_failure — zero jobs, no logs, nothing in REST or GraphQL. Full analysis: hyperpolymath/standards#657.

Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead → 0 startup_failure, 13 running.

Five steps, in order — each blocks the next

1. Unbreak the workflow YAML. Any permissions: carrying a scalar with an indented mapping under it:

permissions: read-all
  actions: read        # <- mapping under a scalar. Unparseable.

This reaches past the one file: gh actions-lock refuses to run when any workflow in the repo fails to parse, so the repo can never acquire a lockfile and can never self-heal.

2. Repin standards reusables off commits with no actions.lock. The rejection requires the callee to be covered at the pinned SHA — unsatisfiable at a pre-lockfile commit.

3. Generate the lockfile with gh actions-lock.

4. Hand-add the reusable-caller entries the tool omits, as '<path>': [].

⚠️ Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without — because every workflow a lockfile omits is rejected. A partial lock is worse than none. Running gh actions-lock and stopping there is how this outage spread.

5. Restore SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps via head -1.

Verified before this PR was opened

0 unparseable workflows · lockfile covers every workflow, no omissions · SPDX on line 1 in every file. The script refuses to push if any of the three fails.

🤖 Generated with Claude Code

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[github-advanced-security]

Semgrep OSS found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b256df8e-2447-4291-b323-42047a26a381

📥 Commits

Reviewing files that changed from the base of the PR and between 47c56ba and 6af7711.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (19)

• .github/workflows/boj-build.yml
• .github/workflows/cargo-audit.yml
• .github/workflows/casket-pages.yml
• .github/workflows/codeql.yml
• .github/workflows/dashboard-check.yml
• .github/workflows/dependabot-automerge.yml
• .github/workflows/dogfood-gate.yml
• .github/workflows/e2e.yml
• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/instant-sync.yml
• .github/workflows/mirror.yml
• .github/workflows/pages.yml
• .github/workflows/push-email-notify.yml
• .github/workflows/rust-ci.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml
• .github/workflows/semgrep.yml
• .github/workflows/workflow-linter.yml

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated automated build, audit, security, deployment and validation workflows to use current action versions.
  • Refreshed shared workflow references across CI, governance, scanning and mirroring processes.
  • Standardised workflow management metadata for easier maintenance.
  • Workflow triggers, permissions and job behaviour remain unchanged.

Walkthrough

Changes

The pull request updates GitHub Actions references across 19 workflow files. It adds gh actions-lock management comments, replaces several commit references with version tags, updates validation action branches, and repins reusable workflows.

Workflow reference maintenance

Layer / File(s)	Summary
Standard action tag updates .github/workflows/{boj-build,cargo-audit,codeql,dashboard-check,dependabot-automerge,instant-sync,push-email-notify,semgrep,workflow-linter}.yml	Adds management comments and updates action references to the specified version tags.
Pages action chain updates .github/workflows/{casket-pages,pages}.yml	Updates checkout, setup, cache, Pages upload, and Pages deployment references.
Multi-job validation action updates .github/workflows/{dogfood-gate,e2e}.yml	Updates repeated checkout, toolchain, cache, A2ML, and K9 action references.
Reusable workflow repins .github/workflows/{governance,hypatia-scan,mirror,rust-ci,scorecard,secret-scanner}.yml	Adds management comments and updates reusable workflow commit references.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit checks each workflow line
Tags now mark the action sign
SHA pins hop out of sight
Reusable flows take flight
gh actions-lock keeps the trail right

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Not up to standards ⛔

🔴 Issues 9 high

Alerts:
⚠ 9 issues (≤ 0 issues of at least minor severity)

Results:
9 new issues

Category	Results
Security	9 high

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR attempts to implement a centralized dependency locking mechanism and fix YAML syntax issues, but it is currently not up to project standards. The transition from SHA-pinned actions with inline comments to tag-only pinning is a regression in security posture and will cause the workflow-security-linter to fail across the entire repository. The linter (specifically line 53 of workflow-linter.yml) is hardcoded to reject the exact format introduced here.

Furthermore, several workflows now reference mutable branches (e.g., @main), which introduces significant risk to CI stability and security. Because the actions.lock file itself was not included in the diff, the effectiveness of the locking strategy cannot be validated. These issues should be resolved by either updating the linter logic to support the lockfile or restoring the immutable SHA references.

About this PR

• The project's workflow-security-linter.yml uses a grep pattern that explicitly expects an inline SHA comment (using '#') for pinned actions. Removing these comments in favor of central locking will cause the linter to incorrectly flag all workflows as having unpinned actions. The linter logic must be updated to acknowledge the actions.lock file.
• The actions.lock file is missing from the PR diff. This prevents verification that all external actions and reusable workflows are actually being locked as intended.

Test suggestions

• Verify that SPDX-License-Identifier is present on line 1 of every workflow file.
• Verify that every workflow includes a valid permissions block (either global or job-level).
• Confirm that all external actions and reusables have corresponding entries in the actions.lock file.
• Validate that all modified workflows are parseable and no longer trigger startup_failure.
• Ensure the Workflow Security Linter passes on the new workflow configurations without flagging them as unpinned.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Confirm that all external actions and reusables have corresponding entries in the actions.lock file.
2. Validate that all modified workflows are parseable and no longer trigger startup_failure.
3. Ensure the Workflow Security Linter passes on the new workflow configurations without flagging them as unpinned.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

Pin the Swatinem/rust-cache action to its full commit SHA for version v2.9.2. Moving from a SHA-pinned state to a tag-pinned state is a decrease in security quality.

[codacy-production]

_{🔴 HIGH RISK}

Pin the haskell-actions/setup action to its full commit SHA for version v2.12.0. Using a mutable tag increases the attack surface for supply-chain compromise.

[codacy-production]

_{🔴 HIGH RISK}

Pinning to a major version tag like @v1 is insecure for third-party actions. Please pin dtolnay/rust-toolchain to its full commit SHA and add # v1 as a trailing comment.

[codacy-production]

_{🔴 HIGH RISK}

This action is no longer pinned to a full-length commit SHA (it now uses @v3.12.0). Pinning an action to a full-length commit SHA is currently the only way to ensure an immutable release and comply with the project's internal workflow security policy.

[codacy-production]

_{🔴 HIGH RISK}

An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning to the main branch is dangerous as it is a mutable reference.

[codacy-production]

_{🔴 HIGH RISK}

Avoid pinning to a mutable branch like @main. This introduces security risks and potential for breaking changes in the CI pipeline. Pin the action to a specific, stable commit SHA for stability and security.

[codacy-production]

_{🟡 MEDIUM RISK}

The move to tag-only pinning (e.g., @v7.0.1) without a trailing SHA comment will cause the workflow-security-linter to fail. The linter rule at line 53 of .github/workflows/workflow-linter.yml flags any tag that does not contain a #. You should update the linter logic or restore the SHA comments.