From 67c5b281ee3aa3481bf5334255cbc5b9135e38bd Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" Date: Fri, 16 Oct 2026 05:08:10 +0100 Subject: [PATCH] ci(actions-lock): leaf entries need a tag ref, not the pin's own SHA GitHub's runtime now enforces the actions lockfile, and every cross-repo caller of the shared reusable workflows has failed job setup since with "invalid lockfile pin" for this repository's leaf actions: the lock consulted for a reusable workflow's dependencies is the defining repository's, and the entries for SHA-pinned actions carried ref: while the entries that resolve carry ref: (e.g. actions/checkout@de0fac2e -> ref v6.0.2, MEASURED resolving on palimpsest's own warrant runs). The new validation rejects a SHA as a ref. Nine leaf entries corrected to tags that verifiably peel to the pinned SHAs (MEASURED via git ls-remote, including the annotated ossf/scorecard-action v2.4.4 whose tag object hid the match from the API search): cache -> v6.1.0, checkout -> v7.0.1, configure-pages -> v6.0.0, create-github-app-token -> v3.2.0, deploy-pages -> v5.0.1, upload-pages-artifact -> v5.0.0, setup-beam -> v1.24.1, setup-ocaml -> v3.9.0, scorecard-action -> v2.4.4. No commit value changes: the pins do not move. Workflows stay SHA-pinned (canon rule 10), so the official tool's v0.0.3 tag-rewrite model cannot be used here; the four stale unreferenced entries are left untouched. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/actions.lock | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index bef2c1db0..08a84367b 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -171,27 +171,27 @@ workflows: - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' dependencies: 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9': - ref: '55cc8345863c7cc4c66a329aec7e433d2d1c52a9' + ref: 'v6.1.0' commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' owner_id: 44036562 repo_id: 215566462 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': - ref: '3d3c42e5aac5ba805825da76410c181273ba90b1' + ref: 'v7.0.1' commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' owner_id: 44036562 repo_id: 197814629 'actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d': - ref: '45bfe0192ca1faeb007ade9deae92b16b8254a0d' + ref: 'v6.0.0' commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d' owner_id: 44036562 repo_id: 513659658 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1': - ref: 'bcd2ba49218906704ab6c1aa796996da409d3eb1' + ref: 'v3.2.0' commit: 'sha1-bcd2ba49218906704ab6c1aa796996da409d3eb1' owner_id: 44036562 repo_id: 642580244 'actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346': - ref: '368f82528645a54fb793d4d04e342629a3f51346' + ref: 'v5.0.1' commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346' owner_id: 44036562 repo_id: 438112499 @@ -216,7 +216,7 @@ dependencies: owner_id: 44036562 repo_id: 192625955 'actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9': - ref: 'fc324d3547104276b827a68afc52ff2a11cc49c9' + ref: 'v5.0.0' commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9' owner_id: 44036562 repo_id: 496012378 @@ -243,7 +243,7 @@ dependencies: owner_id: 26415196 repo_id: 297874902 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124': - ref: '54075bcc5e249e4758d363f27d099f55d843f124' + ref: 'v1.24.1' commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' owner_id: 47606891 repo_id: 331103973 @@ -277,12 +277,12 @@ dependencies: - 'dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067' - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' 'ocaml/setup-ocaml@93303b622b2522e4411e295f9e77411a24912ac7': - ref: '93303b622b2522e4411e295f9e77411a24912ac7' + ref: 'v3.9.0' commit: 'sha1-93303b622b2522e4411e295f9e77411a24912ac7' owner_id: 1841483 repo_id: 220799100 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': - ref: '2d1146689b8cda280b9bc96326124645441f03bc' + ref: 'v2.4.4' commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' owner_id: 67707773 repo_id: 421101922