From 49718859a449d0f69ecbdf8b5fab62194f5dc23c Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 09:59:58 +0000 Subject: [PATCH] fix(ci): defer actions.lock verification to governance in the workflow linter The copied "Verify immutable action lockfile" step pinned its own gh-actions-lock v0.1.6 binary. v0.1.6 cannot read lockfile v0.0.3, which every current `gh actions-lock` writes, so the step failed whenever a current tool refreshed the lock (proof-burrower#111/#112). It also kept a second version pin that drifts from the estate's. Governance already verifies the lock through standards scripts/update-actions-lock.sh. That is one tested implementation, with one pin, and it accepts reusable-workflow coverage. The step is removed and a comment points at the gate. No `uses:` changes, so actions.lock is untouched. Owner decision 2026-10-14: drop the lock step from copied linters; the estate moves to gh-actions-lock v0.2.0 in hyperpolymath/standards#1250. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- .github/workflows/workflow-linter.yml | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index ce46a7b3..f72ffe8d 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -36,11 +36,8 @@ jobs: - name: Allow-fail units have an owner and an unexpired date run: bash scripts/ci/check-allow-fail-expiry.sh - - name: Verify immutable action lockfile with the authoritative tool - env: - GH_TOKEN: ${{ github.token }} - run: | - curl -fsSL --retry 3 -o "$RUNNER_TEMP/gh-actions-lock" https://github.com/github/gh-actions-lock/releases/download/v0.1.6/linux-amd64 - echo "4181ec1da5408b34b9a542a7ee5c6ce3a4d6ac815c7d0206a00ceca8a817f4e3 $RUNNER_TEMP/gh-actions-lock" | sha256sum --check - chmod u+x "$RUNNER_TEMP/gh-actions-lock" - "$RUNNER_TEMP/gh-actions-lock" --rescan --no-fix + # actions.lock is verified by governance's lockfile check (standards + # scripts/update-actions-lock.sh): one tested implementation, one + # gh-actions-lock pin, and it accepts reusable-workflow coverage. The step + # that stood here pinned its own v0.1.6 binary, which cannot read + # lockfile v0.0.3, so it failed whenever a current tool wrote the lock.