fix(actions_lock): accept gh-actions-lock v0.0.3 lockfiles by hyperpolymath · Pull Request #932 · hyperpolymath/hypatia

hyperpolymath · 2026-10-19T16:25:59Z

Problem

gh-actions-lock 0.2.0 writes version: 'v0.0.3'. The only change from v0.0.2 is an optional per-dependency hostname (github.com or a lowercase *.ghe.com). Hypatia.Rules.ActionsLock accepted only v0.0.2. Every relocked repo therefore failed with invalid_actions_lock {:unsupported_version, "v0.0.3"}, and that broke Validate Hypatia Baseline and the Hypatia scan across the estate. Seen on standards#1294 and #1296 and on the echidna, echidnabot and proof-burrower pilot PRs. Hypatia's own actions.lock is v0.0.3, so its test "parses the repository's authoritative generated lockfile" fails on main.

Change

@supported_versions ["v0.0.2", "v0.0.3"] replaces the single version.
Under v0.0.3, hostname: '<host>' is accepted when the host is github.com or a well-formed lowercase *.ghe.com. A malformed or duplicate hostname is rejected.
A hostname line in a v0.0.2 lock is still :malformed_dependency_hostname, so parsing stays fail-closed.
docs/rules/catalogue.adoc is updated to match.

Verification

mix format --check-formatted is clean on both files.
test/rules/actions_lock_test.exs passes 13/13 with the patch. On the unpatched module, 2 of those 13 fail: the new v0.0.3 test and the authoritative-lockfile test.
The run left out the one test that needs the wider Rules module, because hex.pm is unreachable from this session. That test is unchanged by this PR, and CI runs the full suite.

Generated by Claude Code

gh-actions-lock 0.2.0 writes version 'v0.0.3', whose only change is an optional per-dependency hostname (github.com or a lowercase *.ghe.com). ActionsLock accepted only v0.0.2, so every relocked repo, hypatia's own included, failed with {:unsupported_version, "v0.0.3"} and broke 'Validate Hypatia Baseline' and the scan across the estate. Accept both versions. Under v0.0.3, validate the hostname and reject a duplicate one; a hostname line in a v0.0.2 lock is still malformed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3

coderabbitai · 2026-10-19T16:27:28Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 42 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 8d3c6c65-bd8a-4dfc-8dfa-c772efa4e36d

📥 Commits

Reviewing files that changed from the base of the PR and between fd7db07 and 8586d7d.

📒 Files selected for processing: 3

docs/rules/catalogue.adoc
lib/rules/actions_lock.ex
test/rules/actions_lock_test.exs

✨ Finishing Touches

📝 Generate docstrings

🤖 Coding Agent task started for docstring generation.
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector · 2026-10-19T16:28:47Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T16:38:05.154772Z	`8586d7d`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e314c0b3e9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…r host The schema allows github.com or one 1-63 character tenant label before .ghe.com, so multi-label and overlong hosts are now rejected. owner_id and repo_id are defined on the recorded hostname, so identity checks now compare only dependencies on the same host (nil = home host): a mixed data-residency lock with acme/foo at home and acme/bar on github.com is valid. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3

hyperpolymath · 2026-10-19T16:36:21Z

The red checks on this PR come from main or the repo's workflow setup, not from this change. The PR touches only lib/rules/actions_lock.ex, its test and the rule catalogue.

Also red on main at fd7db07, the base: every failing check here that also runs on main fails there too. So far that is Rust License & Ban Check, hypatia / Hypatia Neurosymbolic Analysis, scan / gitleaks, and the governance jobs Well-Known, Workflow Staleness, Licence consistency, Language / package anti-pattern policy, Allowlist Preflight and Security policy checks.
The PR-only governance jobs (Exemption ratchet, Debt ratchet), which show as skipped on main: the Exemption ratchet dies at job setup with Unable to resolve action actions/checkout@3d3c42e5…: invalid lockfile pin. The Debt ratchet comes from the same governance run and most likely fails the same way. Hypatia's own actions.lock has no record of the actions that the pinned standards reusables use internally. It is the same stale-lock problem the pilot repos had, and it would fail on any hypatia PR. The fix is the estate repair chain (relock-standards-pin.sh and then close-lock.sh) run on hypatia's lock in a separate PR, as was done in fix(ci): re-pin standards reusables to 75bd5994 and lock their transitive actions proof-burrower#116 and fix(ci): re-pin standards reusables and repair actions.lock echidna#439.

I'm leaving these alone here so this PR stays narrow.

Generated by Claude Code

coderabbitai · 2026-10-19T17:28:19Z

✅ Coding task complete — no changes needed

coderabbitai · 2026-10-19T17:29:36Z

Add Carrot credits or activate Agent usage billing to use Autofix

…ck (#934) ## Problem `.github/workflows/actions.lock` has no `hyperpolymath/standards` record. GitHub enforces the lockfile for callers of reusable workflows, so every job that calls a standards workflow (governance, hypatia-scan, mirror, scorecard, secret-scanner) dies at setup with `invalid lockfile pin` for actions those workflows use internally. The first one hit is `actions/checkout@3d3c42e5`. These failures appear on `main` and on every PR, including #932, which can't go green until this lands. The five callers were also pinned to three different standards commits: `571cc734`, `2479cf76` and `da2c748a`. ## Change 1. **d3a8b98:** all five callers are re-pinned to standards `333b06a0` (current `main`, which includes standards#1294, #1297 and #1299). 2. **451d53e:** `actions.lock` is regenerated with the estate repair chain: `relock-sha-keys`, `complete-job-refs`, `close-lock`, then `prune-stale`, all at standards `333b06a0`. The lock was not edited by hand. - The chain ran in CI with a real token, because this session can't reach `dtolnay/rust-toolchain` or `ossf/scorecard-action` through the API. - The run closed the lock (0 dangling refs), `check-lock-sync` passed, and the governance gate at `333b06a0` returned 0 ("Immutable direct and transitive lockfile coverage verified"). - The committed file was applied from the run's diff and matches its `LOCK-SHA256` of `24676ce4c10c2fb16c3bff84dee256901cf7f43857fa2d2dfcaca477362c0707`. This is the same repair as hyperpolymath/proof-burrower#116, hyperpolymath/echidna#439 and hyperpolymath/echidnabot#185. ## Notes - `hypatia-scan.yml` and `mirror.yml` already grant `actions: read`, which the reusables at `333b06a0` request. - The run came from a scratch branch, `claude/new-session-th4e9w-lockregen`, which is never merged and will be deleted after this PR. --- _Generated by [Claude Code](https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3)_ --------- Co-authored-by: Claude <noreply@anthropic.com>

hyperpolymath marked this pull request as ready for review October 19, 2026 16:28

chatgpt-codex-connector Bot reviewed Oct 19, 2026

View reviewed changes

Comment thread lib/rules/actions_lock.ex

Comment thread lib/rules/actions_lock.ex Outdated

This was referenced Oct 19, 2026

fix(rest): serve API docs with ReDoc so zip leaves the tree hyperpolymath/echidna#440

Merged

fix(ci): re-pin standards reusables to 333b06a0 and repair actions.lock #934

Merged

hyperpolymath enabled auto-merge (squash) October 19, 2026 17:12

hyperpolymath mentioned this pull request Oct 19, 2026

fix(k9): ratchet pushes, escape Markdown in the grid, reject bad findings, end options hyperpolymath/standards#1310

Merged

Navigation Menu

Repository navigation

fix(actions_lock): accept gh-actions-lock v0.0.3 lockfiles - #932

fix(actions_lock): accept gh-actions-lock v0.0.3 lockfiles#932
hyperpolymath wants to merge 2 commits into
mainfrom
claude/new-session-th4e9w-lock-v003

hyperpolymath commented Oct 19, 2026

Uh oh!

coderabbitai Bot commented Oct 19, 2026 •

edited by hyperpolymath

Loading

Review limit reached

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

hyperpolymath commented Oct 19, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

hyperpolymath commented Oct 19, 2026

Problem

Change

Verification

Uh oh!

coderabbitai Bot commented Oct 19, 2026 • edited by hyperpolymath Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

hyperpolymath commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Oct 19, 2026 •

edited by hyperpolymath

Loading

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading

hyperpolymath commented Oct 19, 2026 •

edited

Loading

coderabbitai Bot commented Oct 19, 2026 •

edited

Loading