fix(ci): generate actions.lock — repair repo-wide startup_failure

[hyperpolymath]

Controlled test of the lockfile hypothesis, mirroring the fix that restored .git-private-farm (#128 there).

Symptom: every workflow dies at startup_failure with zero jobs — including ci.yml, codeql.yml and boj-build.yml, which have no dependency on hyperpolymath/standards. That rules out the phantom reusable pin as the cause for those three.

Change: generate .github/workflows/actions.lock, complete coverage to 11/11 (the tool emits no entry for reusable-callers, so governance/mirror/secret-scanner were hand-added as []), and restore SPDX to line 1 in all 11 workflows.

Deliberately NOT changed: this repo pins the standards reusables at 5b1d0022…, which does not exist in hyperpolymath/standards (gh api → 422). Left in place so this tests one variable.

Prediction, recorded before merge:

• ci, codeql, boj-build (no standards dep) → should RUN
• governance, mirror, secret-scanner (phantom pin) → should STILL fail

If that is what happens, both causes are confirmed independently and the estate-wide sweep needs both steps, not either alone.

Known tool limitation, not introduced here: dtolnay/rust-toolchain is pinned to a commit reachable from no tag or branch, so the lockfile cannot record it.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 57 issues detected

Severity	Count
🔴 Critical	6
🟠 High	27
🟡 Medium	24

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_workflow",
    "file": "scorecard.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action denoland/setup-deno@v2.0.5 needs attention",
    "type": "unpinned_action",
    "file": "ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action denoland/setup-deno@v2.0.5 needs attention",
    "type": "unpinned_action",
    "file": "ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action jetli/wasm-pack-action@v0.4.0 needs attention",
    "type": "unpinned_action",
    "file": "ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
    "type": "codeql_language_matrix_mismatch",
    "file": "codeql.yml",
    "action": "switch_codeql_matrix_to_actions",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar