Skip to content

Commit f44d750

Browse files
hyperpolymathhyperpolymath
authored
chore(ci): SPDX headers on line 1 and Actions lockfile minted (#49)
Two estate gates, one change. **SPDX** — the linter checks `head -1` only, so workflows carrying their identifier below a managed-by comment report as missing one. Each file's **own** identifier is moved to line 1; nothing is imposed (repos here are variously MPL-2.0, PMPL-1.0-or-later, AGPL-3.0-or-later). Licences in this repo: `MPL-2.0`. **Lockfile (minted)** — `gh actions-lock` resolves each symbolic ref to a verified commit plus owner_id, repo_id and the transitive dependencies of composite actions. That is what Scorecard's Pinned-Dependencies check wants, and what an inline SHA cannot express. ⚠ Do **not** additionally SHA-pin inline — the mechanisms are mutually exclusive, and inline pinning *removes* actions from the lockfile (measured on hypatia: 14 `startup_failure`s). **Verified**: all workflows parse · no duplicate SPDX identifiers · `gh actions-lock --verify-local`: All 11 workflows have complete lockfile coverage. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
2 parents 25d9942 + edeacce commit f44d750

12 files changed

Lines changed: 179 additions & 30 deletions

‎.github/workflows/actions.lock‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
# This file is machine-generated by `gh actions-lock`.
2+
# Do not edit by hand; run `gh actions-lock` to update.
3+
# Docs: https://gh.io/actions-lockfile
4+
version: 'v0.0.2'
5+
workflows:
6+
'.github/workflows/casket-pages.yml':
7+
- 'actions/cache@v4.3.0'
8+
- 'actions/checkout@v4.1.1'
9+
- 'actions/configure-pages@v5.0.0'
10+
- 'actions/deploy-pages@v4.0.5'
11+
- 'actions/upload-pages-artifact@v3.0.1'
12+
- 'haskell-actions/setup@v2.7.5'
13+
'.github/workflows/codeql.yml':
14+
- 'actions/checkout@v6.0.2'
15+
- 'github/codeql-action@v4.34.0'
16+
'.github/workflows/dogfood-gate.yml':
17+
- 'actions/checkout@v4.3.1'
18+
- 'hyperpolymath/a2ml-ecosystem@main'
19+
- 'hyperpolymath/k9-ecosystem@main'
20+
'.github/workflows/hypatia-scan.yml':
21+
- 'actions/checkout@v6.0.2'
22+
- 'actions/github-script@v8.0.0'
23+
- 'actions/upload-artifact@v4.6.2'
24+
- 'erlef/setup-beam@v1.24.0'
25+
- 'github/codeql-action@v4.32.6'
26+
'.github/workflows/instant-sync.yml':
27+
- 'peter-evans/repository-dispatch@v4.0.1'
28+
'.github/workflows/push-email-notify.yml':
29+
- 'dawidd6/action-send-mail@v3.12.0'
30+
'.github/workflows/secret-scanner.yml':
31+
- 'actions/checkout@v6.0.2'
32+
- 'gitleaks/gitleaks-action@v2.3.9'
33+
- 'trufflesecurity/trufflehog@v3.93.8'
34+
'.github/workflows/workflow-linter.yml':
35+
- 'actions/checkout@v4.1.1'
36+
dependencies:
37+
'actions/cache@v4.3.0':
38+
ref: 'v4.3.0'
39+
commit: 'sha1-0057852bfaa89a56745cba8c7296529d2fc39830'
40+
owner_id: 44036562
41+
repo_id: 215566462
42+
'actions/checkout@v4.1.1':
43+
ref: 'v4.1.1'
44+
commit: 'sha1-b4ffde65f46336ab88eb53be808477a3936bae11'
45+
owner_id: 44036562
46+
repo_id: 197814629
47+
'actions/checkout@v4.3.1':
48+
ref: 'v4.3.1'
49+
commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5'
50+
owner_id: 44036562
51+
repo_id: 197814629
52+
'actions/checkout@v6.0.2':
53+
ref: 'v6.0.2'
54+
commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
55+
owner_id: 44036562
56+
repo_id: 197814629
57+
'actions/configure-pages@v5.0.0':
58+
ref: 'v5.0.0'
59+
commit: 'sha1-983d7736d9b0ae728b81ab479565c72886d7745b'
60+
owner_id: 44036562
61+
repo_id: 513659658
62+
'actions/deploy-pages@v4.0.5':
63+
ref: 'v4.0.5'
64+
commit: 'sha1-d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e'
65+
owner_id: 44036562
66+
repo_id: 438112499
67+
'actions/github-script@v8.0.0':
68+
ref: 'v8.0.0'
69+
commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd'
70+
owner_id: 44036562
71+
repo_id: 205262760
72+
'actions/upload-artifact@v4':
73+
ref: 'v4'
74+
commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
75+
owner_id: 44036562
76+
repo_id: 192625955
77+
'actions/upload-artifact@v4.6.2':
78+
ref: 'v4.6.2'
79+
commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
80+
owner_id: 44036562
81+
repo_id: 192625955
82+
'actions/upload-pages-artifact@v3.0.1':
83+
ref: 'v3.0.1'
84+
commit: 'sha1-56afc609e74202658d3ffba0e8f6dda462b719fa'
85+
owner_id: 44036562
86+
repo_id: 496012378
87+
uses:
88+
- 'actions/upload-artifact@v4'
89+
'dawidd6/action-send-mail@v3.12.0':
90+
ref: 'v3.12.0'
91+
commit: 'sha1-6e502825a508b867ab2954ad6343b68787624c01'
92+
owner_id: 9713907
93+
repo_id: 222439721
94+
'erlef/setup-beam@v1.24.0':
95+
ref: 'v1.24.0'
96+
commit: 'sha1-fc68ffb90438ef2936bbb3251622353b3dcb2f93'
97+
owner_id: 47606891
98+
repo_id: 331103973
99+
'github/codeql-action@v4.32.6':
100+
ref: 'v4.32.6'
101+
commit: 'sha1-0d579ffd059c29b07949a3cce3983f0780820c98'
102+
owner_id: 9919
103+
repo_id: 259445878
104+
'github/codeql-action@v4.34.0':
105+
ref: 'v4.34.0'
106+
commit: 'sha1-c6f931105cb2c34c8f901cc885ba1e2e259cf745'
107+
owner_id: 9919
108+
repo_id: 259445878
109+
'gitleaks/gitleaks-action@v2.3.9':
110+
ref: 'v2.3.9'
111+
commit: 'sha1-ff98106e4c7b2bc287b24eaf42907196329070c7'
112+
owner_id: 90395851
113+
repo_id: 242854909
114+
'haskell-actions/setup@v2.7.5':
115+
ref: 'v2.7.5'
116+
commit: 'sha1-ec49483bfc012387b227434aba94f59a6ecd0900'
117+
owner_id: 75048950
118+
repo_id: 623796603
119+
'hyperpolymath/a2ml-ecosystem@main':
120+
ref: 'main'
121+
commit: 'sha1-aa4b836bd969df2bc58128cb8e3d20bbc88d5e79'
122+
owner_id: 6759885
123+
repo_id: 1275649586
124+
'hyperpolymath/k9-ecosystem@main':
125+
ref: 'main'
126+
commit: 'sha1-89f3c2702f4f650a92aa7411502f38da06abd562'
127+
owner_id: 6759885
128+
repo_id: 1275650185
129+
'peter-evans/repository-dispatch@v4.0.1':
130+
ref: 'v4.0.1'
131+
commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
132+
owner_id: 18365890
133+
repo_id: 220359305
134+
'trufflesecurity/trufflehog@v3.93.8':
135+
ref: 'v3.93.8'
136+
commit: 'sha1-6c05c4a00b91aa542267d8e32a8254774799d68d'
137+
owner_id: 79229934
138+
repo_id: 77726177

‎.github/workflows/casket-pages.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
name: GitHub Pages
34

45
on:
@@ -20,22 +21,22 @@ jobs:
2021
runs-on: ubuntu-latest
2122
steps:
2223
- name: Checkout
23-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
24+
uses: actions/checkout@v4.1.1
2425

2526
- name: Checkout casket-ssg
26-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
27+
uses: actions/checkout@v4.1.1
2728
with:
2829
repository: hyperpolymath/casket-ssg
2930
path: .casket-ssg
3031

3132
- name: Setup GHCup
32-
uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2
33+
uses: haskell-actions/setup@v2.7.5
3334
with:
3435
ghc-version: '9.8.2'
3536
cabal-version: '3.10'
3637

3738
- name: Cache Cabal
38-
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
39+
uses: actions/cache@v4.3.0
3940
with:
4041
path: |
4142
~/.cabal/packages
@@ -97,10 +98,10 @@ jobs:
9798
touch ../_site/.nojekyll
9899
99100
- name: Setup Pages
100-
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
101+
uses: actions/configure-pages@v5.0.0
101102

102103
- name: Upload artifact
103-
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
104+
uses: actions/upload-pages-artifact@v3.0.1
104105
with:
105106
path: '_site'
106107

@@ -113,4 +114,4 @@ jobs:
113114
steps:
114115
- name: Deploy to GitHub Pages
115116
id: deployment
116-
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
117+
uses: actions/deploy-pages@v4.0.5

‎.github/workflows/codeql.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
name: CodeQL Security Analysis
34

45
on:
@@ -35,15 +36,15 @@ jobs:
3536

3637
steps:
3738
- name: Checkout
38-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
39+
uses: actions/checkout@v6.0.2
3940

4041
- name: Initialize CodeQL
41-
uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
42+
uses: github/codeql-action/init@v4.34.0
4243
with:
4344
languages: ${{ matrix.language }}
4445
build-mode: ${{ matrix.build-mode }}
4546

4647
- name: Perform CodeQL Analysis
47-
uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
48+
uses: github/codeql-action/analyze@v4.34.0
4849
with:
4950
category: "/language:${{ matrix.language }}"

‎.github/workflows/dogfood-gate.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
34
#
45
# dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate
@@ -25,7 +26,7 @@ jobs:
2526

2627
steps:
2728
- name: Checkout repository
28-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
29+
uses: actions/checkout@v4.3.1
2930

3031
- name: Check for A2ML files
3132
id: detect
@@ -38,7 +39,7 @@ jobs:
3839
3940
- name: Validate A2ML manifests
4041
if: steps.detect.outputs.count > 0
41-
uses: hyperpolymath/a2ml-ecosystem/validate-action@aa4b836bd969df2bc58128cb8e3d20bbc88d5e79 # main
42+
uses: hyperpolymath/a2ml-ecosystem/validate-action@main
4243
with:
4344
path: '.'
4445
strict: 'false'
@@ -69,7 +70,7 @@ jobs:
6970

7071
steps:
7172
- name: Checkout repository
72-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
73+
uses: actions/checkout@v4.3.1
7374

7475
- name: Check for K9 files
7576
id: detect
@@ -86,7 +87,7 @@ jobs:
8687
8788
- name: Validate K9 contracts
8889
if: steps.detect.outputs.k9_count > 0
89-
uses: hyperpolymath/k9-ecosystem/validate-action@89f3c2702f4f650a92aa7411502f38da06abd562 # main
90+
uses: hyperpolymath/k9-ecosystem/validate-action@main
9091
with:
9192
path: '.'
9293
strict: 'false'
@@ -118,7 +119,7 @@ jobs:
118119

119120
steps:
120121
- name: Checkout repository
121-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
122+
uses: actions/checkout@v4.3.1
122123

123124
- name: Scan for invisible characters
124125
id: lint
@@ -182,7 +183,7 @@ jobs:
182183

183184
steps:
184185
- name: Checkout repository
185-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
186+
uses: actions/checkout@v4.3.1
186187

187188
- name: Check for Groove manifest
188189
id: groove
@@ -242,7 +243,7 @@ jobs:
242243

243244
steps:
244245
- name: Checkout repository
245-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
246+
uses: actions/checkout@v4.3.1
246247

247248
- name: Generate dogfooding scorecard
248249
run: |

‎.github/workflows/governance.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
# governance.yml — single wrapper calling the shared estate governance bundle
34
# in hyperpolymath/standards instead of carrying per-repo copies.
45
#

‎.github/workflows/hypatia-scan.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
# Hypatia Neurosymbolic CI/CD Security Scan
34
name: Hypatia Security Scan
45

@@ -46,12 +47,12 @@ jobs:
4647

4748
steps:
4849
- name: Checkout repository
49-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
50+
uses: actions/checkout@v6.0.2
5051
with:
5152
fetch-depth: 0 # Full history for better pattern analysis
5253

5354
- name: Setup Elixir for Hypatia scanner
54-
uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.18.2
55+
uses: erlef/setup-beam@v1.24.0
5556
with:
5657
elixir-version: '1.18'
5758
otp-version: '27'
@@ -105,7 +106,7 @@ jobs:
105106
echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
106107
107108
- name: Upload findings artifact
108-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
109+
uses: actions/upload-artifact@v4.6.2
109110
with:
110111
name: hypatia-findings
111112
path: hypatia-findings.json
@@ -241,7 +242,7 @@ jobs:
241242
always() &&
242243
(github.event_name != 'pull_request' ||
243244
github.event.pull_request.head.repo.fork != true)
244-
uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.28.1
245+
uses: github/codeql-action/upload-sarif@v4.32.6
245246
with:
246247
sarif_file: hypatia.sarif
247248
# Distinct category so Hypatia results coexist with CodeQL's
@@ -381,7 +382,7 @@ jobs:
381382
# the pull-requests: write permission above: a token/API hiccup or
382383
# a fork PR (read-only token) skips the comment, not the check.
383384
continue-on-error: true
384-
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v7
385+
uses: actions/github-script@v8.0.0
385386
with:
386387
script: |
387388
const fs = require('fs');

‎.github/workflows/instant-sync.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
# Instant Forge Sync - Triggers propagation to all forges on push/release
34
name: Instant Sync
45

@@ -16,7 +17,7 @@ jobs:
1617
runs-on: ubuntu-latest
1718
steps:
1819
- name: Trigger Propagation
19-
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
20+
uses: peter-evans/repository-dispatch@v4.0.1
2021
with:
2122
token: ${{ secrets.FARM_DISPATCH_TOKEN }}
2223
repository: hyperpolymath/.git-private-farm

‎.github/workflows/mirror.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
name: Mirror to Git Forges
34

45
on:

‎.github/workflows/push-email-notify.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
# Dormant push-email notification. ARMED by setting the repo variable
34
# PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
45
# sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by
@@ -15,7 +16,7 @@ jobs:
1516
runs-on: ubuntu-latest
1617
steps:
1718
- name: Send push notification email
18-
uses: dawidd6/action-send-mail@6e502825a508b867ab2954ad6343b68787624c01 # pinned
19+
uses: dawidd6/action-send-mail@v3.12.0
1920
with:
2021
server_address: ${{ secrets.SMTP_HOST }}
2122
server_port: ${{ secrets.SMTP_PORT }}

‎.github/workflows/scorecard.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# SPDX-License-Identifier: MPL-2.0
2+
# This workflow is managed by gh actions-lock.
23
name: Scorecards supply-chain security
34

45
on:

0 commit comments

Comments
 (0)