Repository navigation
ci: re-pin standards callers to a85aa8e and relock (fixes "invalid lockfile pin") - #159
Conversation
…ile pin)
Since 2026-10-15/16, every job in a januskey workflow that calls a standards
reusable has died in "Set up job" with no code change on this side:
Unable to resolve action `actions/checkout@3d3c42e5…`: invalid
lockfile pin. Run `gh actions-lock` to update the lockfile
The same commit, 69de917, was green on 2026-10-14 and red on 2026-10-19.
Cause: GitHub resolves a called reusable workflow's actions against the
CALLEE repository's actions.lock at the called SHA. It now rejects an
action record whose `ref:` is the record's own commit SHA. standards at
7d2041a (the old pin) recorded actions/checkout@3d3c42e5… with
`ref: '3d3c42e5…'`. standards #1271 (2026-10-16) and #1285 repaired its own
lock. Evidence:
- standards/scripts/lock-selfcheck.sh reports 7d2041a POISON (73
self-SHA refs, checkout@3d3c42e5 among them) and 75bd599
SELF-CONSISTENT.
- cicd-squabbler hit the same error on the same day. Re-pinned to 75bd599,
its Rust CI, Governance, Hypatia, Secret Scanner and Scorecard callers run
green.
Generated with the estate tooling, not edited by hand:
standards/scripts/propagate-workflow-pins.sh --fix --to 75bd599
which runs relock-standards-pin.sh. That rebuilds the
hyperpolymath/standards@75bd599 record from what the seven reusables use
at 75bd599, and refreshes leaf refs from standards' own lock: cache,
upload-artifact, rust-toolchain, editorconfig-checker, codeql-action and
setup-zig get tag refs. relock-standards-pin.sh had a case-folding bug
that wrote a second swatinem/rust-cache record. GitHub's lockfile parser
rejects that duplicate ("duplicate action key ... after canonicalization").
This lock was generated with that bug fixed (standards PR on the same
branch name).
The reusables' workflow_call interfaces and permissions match between
7d2041a and 75bd599. The only change is an optional HYPATIA_SCAN_PAT
secret on hypatia-scan; this caller passes `secrets: inherit`.
Checks run locally:
- github/actions-lockfile v0.0.6 Parse: OK. Before: OK. After the buggy
relock: duplicate-key error.
- standards check-lock-sync.sh: in sync.
- standards .githooks/validate-actions-lock.sh: one remaining finding, the
self-SHA ref on hyperpolymath/cicd-squabbler@b34cd53. Not fixed here; see
the PR.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013CuBToxr5h9catptGiTsFX
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes. ⛔ Files ignored due to path filters: 1
⚙️ Run configuration
⛔ Files ignored due to path filters: 1
You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Summary
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Docstring Coverage |  |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
| Title check | |
The title clearly identifies the main change: re-pinning standards reusable-workflow callers to commit a85aa8e and correcting the lockfile pin issue. |
| Description check | |
The description directly explains the invalid lockfile pin failure, the updated reusable-workflow pins, the lock regeneration, verification results, and the remaining Squabble issue. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (7 skipped: 7 unsupported.)
✨ Finishing Touches
-
🛠️ Fix failing CI checks
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
On 75bd599, every standards-reusable job on this PR now starts. The
lockfile fix works. One governance job failed in its own body: "JS
runtimes — environment provisions Bun first" (job 118367034408).
error: current package believes it's in a workspace when it's not:
current: .standards-js/tools/js-runtimes/Cargo.toml
workspace: Cargo.toml
That job checks standards out into .standards-js/ inside this Cargo
workspace. It is new to januskey with the move off 7d2041a. standards
fixed it in #1296/#1299 by giving tools/js-runtimes its own [workspace]
table. a85aa8e is the first commit carrying that fix.
Regenerated as before with standards/scripts/propagate-workflow-pins.sh
--fix --to a85aa8e. That runs the relock-standards-pin.sh with the
standards#1314 fix.
- lock-selfcheck.sh: a85aa8e is SELF-CONSISTENT.
- The reusables' workflow_call interfaces and permissions match 75bd599,
except one new hypatia-scan output that this caller does not read.
- The lock parses with actions-lockfile v0.0.6.
- check-lock-sync.sh: in sync.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013CuBToxr5h9catptGiTsFX
|
CI status on f8ca8a9, the first push:
Squabble is not a required check. Generated by Claude Code |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
✅ Coding Agent task started: View task and status The task will inspect the CI failures, validate its fix, and commit the fix to this branch automatically.
⏭️ Checks skipped: 1 · already failing on `main` (not caused by this PR)
|
|
Add Carrot credits or activate Agent usage billing to use Autofix |
hyperpolymath
changed the title
2 participants
Summary
Fixes the
invalid lockfile pinfailure that kills every standards-reusable caller in "Set up job". It has failed onmainsince 2026-10-15/16, with no code change in this repository: commit 69de917 was green on 10-14 and red on 10-19.Root cause (evidence-backed)
GitHub resolves a called reusable workflow's actions against the callee's
actions.lockat the called SHA. It now rejects an action record whoseref:is the record's own commit SHA.7d2041a, this repository's old pin, the lock recordsactions/checkout@3d3c42e…withref: '3d3c42e…'.standards/scripts/lock-selfcheck.shreports7d2041aPOISON (73 self-SHA refs). It reports75bd599anda85aa8eSELF-CONSISTENT.75bd599, its callers run green.The obvious alternative fix, a plain
gh actions-lockv0.2.0 relock, would not work here:uses:of reusable workflows and reports thehyperpolymath/standards@…records as "unused". Since gh-actions-lock ci: re-pin standards callers to a85aa8e and relock (fixes "invalid lockfile pin") #159 that is an error, and a fix run prunes them. Callers without those records fail at startup.What changes
7d2041atoa85aa8e.75bd599. Every reusable job started, butgovernance / JS runtimes — environment provisions Bun firsthit a cargo workspace clash: the standards checkout sits inside this repository's Cargo workspace.a85aa8eis the first commit with the fix.standards/scripts/propagate-workflow-pins.sh --fix, which runsrelock-standards-pin.sh. The lock was not edited by hand.relock-standards-pin.shhad a case-folding bug that produced a lock GitHub's parser rejects. I fixed it at the source in fix(lock): relock-standards-pin matches records case-insensitively on owner/repo standards#1314, and this lock was generated with the fixed script.workflow_callinterfaces and permissions match. The only difference is one new optional hypatia-scan output, which this caller does not read.Verification
github/actions-lockfilev0.0.6Parseis OK, and standardscheck-lock-sync.shreports the lock in sync.Not fixed here
CI dependency chains(Squabble) is still red. The lock recordhyperpolymath/cicd-squabbler@b34cd53has a self-SHAref:, and that commit has no release tag. The plan:release.yml.squabble.ymlto it.Squabble is not a required check.
🤖 Generated with Claude Code
https://claude.ai/code/session_013CuBToxr5h9catptGiTsFX