fix(ci): reconcile the workflows with actions.lock (gh-actions-lock) by hyperpolymath · Pull Request #159 · hyperpolymath/universal-chat-extractor

hyperpolymath · 2026-09-20T02:14:08Z

fix(ci): reconcile the workflows with actions.lock (gh-actions-lock v0.1.6)

actions.lock is authoritative: the workflows carry readable refs and the lock records the
commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest
make the whole repository unstartable — startup_failure, "Invalid lockfile".

Regenerated with the official extension (github/gh-actions-lock). The hand-pinned SHA refs are
reverted to their readable form here precisely because the lockfile, not the workflow, is what
pins them.

…0.1.6) `actions.lock` is authoritative: the workflows carry readable refs and the lock records the commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest make the whole repository unstartable — `startup_failure`, "Invalid lockfile". Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are reverted to their readable form here precisely because the lockfile, not the workflow, is what pins them.

coderabbitai · 2026-09-20T02:14:20Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 2d2416c9-d00c-4964-a2aa-ed51f065b783

📥 Commits

Reviewing files that changed from the base of the PR and between 6b8294b and 5402272.

⛔ Files ignored due to path filters (1)

.github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (14)

.github/workflows/boj-build.yml
.github/workflows/casket-pages.yml
.github/workflows/codeql.yml
.github/workflows/dogfood-gate.yml
.github/workflows/governance.yml
.github/workflows/hypatia-scan.yml
.github/workflows/instant-sync.yml
.github/workflows/label-triage.yml
.github/workflows/labels.yml
.github/workflows/mirror.yml
.github/workflows/pages.yml
.github/workflows/push-email-notify.yml
.github/workflows/scorecard.yml
.github/workflows/secret-scanner.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (20)

GitHub Check: governance / Trusted-base reduction policy
GitHub Check: governance / Exemption ratchet
GitHub Check: governance / Code quality + docs
GitHub Check: governance / Actions lockfile verify
GitHub Check: governance / Allowlist Preflight
GitHub Check: governance / Workflow security linter
GitHub Check: governance / Language / package anti-pattern policy
GitHub Check: governance / Licence consistency
GitHub Check: governance / Well-Known (RFC 9116 + RSR)
GitHub Check: governance / Security policy checks
GitHub Check: governance / Check Workflow Staleness
GitHub Check: governance / Live Actions policy (credentialed advisory)
GitHub Check: governance / Debt ratchet
GitHub Check: scan / Hypatia Neurosymbolic Analysis
GitHub Check: governance / Guix packaging policy (Nix retired)
GitHub Check: Validate A2ML manifests
GitHub Check: Validate K9 contracts
GitHub Check: Groove manifest check
GitHub Check: Empty-linter (invisible characters)
GitHub Check: Analyze (actions)

🧰 Additional context used

🪛 GitHub Check: SonarCloud Code Analysis

.github/workflows/instant-sync.yml

[failure] 20-20: Use full commit SHA hash for this dependency.

See more on https://sonarcloud.io/project/issues?id=hyperpolymath_universal-chat-extractor&issues=AaC8l97lIyfdyxyWu6pQ&open=AaC8l97lIyfdyxyWu6pQ&pullRequest=159

.github/workflows/secret-scanner.yml

[failure] 28-28: Use full commit SHA hash for this dependency.

See more on https://sonarcloud.io/project/issues?id=hyperpolymath_universal-chat-extractor&issues=AaC8l9_oIyfdyxyWu6pS&open=AaC8l9_oIyfdyxyWu6pS&pullRequest=159

.github/workflows/casket-pages.yml

[failure] 30-30: Use full commit SHA hash for this dependency.

See more on https://sonarcloud.io/project/issues?id=hyperpolymath_universal-chat-extractor&issues=AaC8l9_ZIyfdyxyWu6pR&open=AaC8l9_ZIyfdyxyWu6pR&pullRequest=159

🔇 Additional comments (14)

.github/workflows/boj-build.yml (1)

1-1: LGTM!

Also applies to: 15-15

.github/workflows/casket-pages.yml (1)

1-1: LGTM!

Also applies to: 23-23, 25-25, 30-30, 35-35, 93-93, 95-95, 108-108

.github/workflows/codeql.yml (1)

1-1: LGTM!

Also applies to: 38-38, 40-40, 45-45

.github/workflows/dogfood-gate.yml (1)

1-1: LGTM!

Also applies to: 28-28, 65-65, 107-107, 168-168, 225-225

.github/workflows/governance.yml (1)

1-1: LGTM!

.github/workflows/hypatia-scan.yml (1)

1-1: LGTM!

.github/workflows/instant-sync.yml (1)

1-1: LGTM!

Also applies to: 20-20

.github/workflows/label-triage.yml (1)

1-1: LGTM!

.github/workflows/labels.yml (1)

1-1: LGTM!

.github/workflows/mirror.yml (1)

1-1: LGTM!

.github/workflows/pages.yml (1)

1-1: LGTM!

Also applies to: 25-25, 27-27, 44-44, 57-57

.github/workflows/push-email-notify.yml (1)

1-1: LGTM!

Also applies to: 44-44

.github/workflows/scorecard.yml (1)

1-1: LGTM!

.github/workflows/secret-scanner.yml (1)

1-1: LGTM!

Also applies to: 24-24, 28-28

📝 Summary

Summary by CodeRabbit

Chores
- Updated workflow action references to explicit version tags across CI, security scanning, publishing, and notification workflows.
- Added workflow management headers for automated action-lock maintenance.
- Workflow triggers, jobs, permissions, and behaviour remain unchanged.

Walkthrough

The pull request updates 14 GitHub Actions workflows. It adds gh actions-lock management comments and changes selected action references from commit SHAs to explicit version tags. Workflow steps and inputs remain unchanged.

Changes

GitHub Actions lock updates

Layer / File(s)	Summary
Workflow management headers `.github/workflows/*.yml`	The workflows receive top-level comments stating that `gh actions-lock` manages them.
Action version references `.github/workflows/boj-build.yml`, `.github/workflows/casket-pages.yml`, `.github/workflows/codeql.yml`, `.github/workflows/dogfood-gate.yml`, `.github/workflows/instant-sync.yml`, `.github/workflows/pages.yml`, `.github/workflows/push-email-notify.yml`, `.github/workflows/secret-scanner.yml`	Selected action references change from commit SHAs to explicit version tags. Existing workflow steps, inputs, and scan arguments remain unchanged.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~10 minutes

Change: Bug fix

Possibly related PRs

Possibly related PRs

hyperpolymath/universal-chat-extractor#146: Changes the same workflow files and action references for GitHub Actions locking.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI workflow fix and its reconciliation with actions.lock.
Description check	✅ Passed	The description explains the workflow and lockfile changes, their authority model, and the startup failures they address.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks each workflow line
Tags now show the version sign
Lock notes sit at the door
SHA trails remain no more
The CI burrow hops in time}

_{Comment @coderabbitai help to get the list of available commands.}

sonarqubecloud · 2026-09-20T02:14:27Z

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

coderabbitai Bot approved these changes Sep 20, 2026

View reviewed changes

hyperpolymath merged commit 1824eec into main Sep 20, 2026
22 of 23 checks passed

hyperpolymath deleted the fix/sha-pin-actions branch September 20, 2026 02:31

Navigation Menu

Uh oh!

fix(ci): reconcile the workflows with actions.lock (gh-actions-lock) - #159

fix(ci): reconcile the workflows with actions.lock (gh-actions-lock)#159
hyperpolymath merged 1 commit into
mainfrom
fix/sha-pin-actions

hyperpolymath commented Sep 20, 2026

Uh oh!

coderabbitai Bot commented Sep 20, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

Possibly related PRs

Uh oh!

sonarqubecloud Bot commented Sep 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hyperpolymath commented Sep 20, 2026

Uh oh!

coderabbitai Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Possibly related PRs

Uh oh!

sonarqubecloud Bot commented Sep 20, 2026

Quality Gate failed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Sep 20, 2026 •

edited

Loading