fix(ci): adopt Actions dependency lockfile (estate startup_failure remediation) by hyperpolymath · Pull Request #295 · hyperpolymath/academic-workflow-suite

hyperpolymath · 2026-08-04T04:13:20Z

Estate sweep: this repo's every workflow has been startup_failure under GitHub's workflow-lockfile enforcement. Applies the template proven on haec (#46/#48) and echidna (#341): actions.lock, SPDX-first header order, hand-added entries for tool-skipped workflows, standards reusables re-pinned past the standards lockfile boundary (5a597720), illegal timeout-minutes stripped from reusable jobs, lockfile-aware SHA-pin lint.

The PR's own check runs are the test: executing checks (even failures) = enforcement satisfied.

🤖 Generated with Claude Code

…mediation) Estate-wide sweep applying the haec-proven template (haec#46/#48, echidna#341): actions.lock via gh actions-lock; SPDX kept on line 1 above the locker marker; hand-added lockfile entries for workflows the tool skips (reusable-only / zero-dep); standards reusables re-pinned to fcb8669169b4 (first standards ref carrying its own lockfile); illegal timeout-minutes stripped from reusable-caller jobs; SHA-pin lint made lockfile-aware. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

github-actions · 2026-08-04T04:14:32Z

🔍 Hypatia Security Scan

Findings: 207 issues detected

Severity	Count
🔴 Critical	1
🟠 High	59
🟡 Medium	147

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action actions/checkout@v4.1.7 needs attention",
    "type": "unpinned_action",
    "file": "boj-build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.3.1 needs attention",
    "type": "unpinned_action",
    "file": "build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action SonarSource/sonarqube-scan-action@v8.1.0 needs attention",
    "type": "unpinned_action",
    "file": "build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.1.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.1.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action haskell-actions/setup@v2.7.5 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/cache@v4.3.0 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/configure-pages@v5.0.0 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/upload-pages-artifact@v3.0.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/deploy-pages@v4.0.5 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

gitar-bot · 2026-08-04T04:16:27Z

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved

Adopts the GitHub Actions dependency lockfile and updates workflow configurations to satisfy strict workflow enforcement. No issues found.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

`Compact`
`gitar display:verbose`

Important

Your trial ends in 6 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}

gitar-bot

Gitar has auto-approved this PR and enabled auto-merge (configure)

…lint) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

github-actions · 2026-08-04T04:18:42Z

🔍 Hypatia Security Scan

Findings: 207 issues detected

Severity	Count
🔴 Critical	1
🟠 High	59
🟡 Medium	147

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action actions/checkout@v4.1.7 needs attention",
    "type": "unpinned_action",
    "file": "boj-build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.3.1 needs attention",
    "type": "unpinned_action",
    "file": "build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action SonarSource/sonarqube-scan-action@v8.1.0 needs attention",
    "type": "unpinned_action",
    "file": "build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.1.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.1.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action haskell-actions/setup@v2.7.5 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/cache@v4.3.0 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/configure-pages@v5.0.0 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/upload-pages-artifact@v3.0.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/deploy-pages@v4.0.5 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

At standards >= fcb8669 the governance/hypatia/mirror/scorecard reusables declare actions: read (hypatia adds security-events: write; scorecard adds id-token/security-events write). A reusable requesting more than its caller grants is a startup_failure — the third enforcement layer after the lockfile and the caller entries. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

github-actions · 2026-08-04T04:32:32Z

🔍 Hypatia Security Scan

Findings: 207 issues detected

Severity	Count
🔴 Critical	1
🟠 High	59
🟡 Medium	147

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action actions/checkout@v4.1.7 needs attention",
    "type": "unpinned_action",
    "file": "boj-build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.3.1 needs attention",
    "type": "unpinned_action",
    "file": "build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action SonarSource/sonarqube-scan-action@v8.1.0 needs attention",
    "type": "unpinned_action",
    "file": "build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.1.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.1.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action haskell-actions/setup@v2.7.5 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/cache@v4.3.0 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/configure-pages@v5.0.0 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/upload-pages-artifact@v3.0.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/deploy-pages@v4.0.5 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

github-actions · 2026-08-04T04:35:49Z

🔍 Hypatia Security Scan

Findings: 207 issues detected

Severity	Count
🔴 Critical	1
🟠 High	59
🟡 Medium	147

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action actions/checkout@v4.1.7 needs attention",
    "type": "unpinned_action",
    "file": "boj-build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.3.1 needs attention",
    "type": "unpinned_action",
    "file": "build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action SonarSource/sonarqube-scan-action@v8.1.0 needs attention",
    "type": "unpinned_action",
    "file": "build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.1.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.1.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action haskell-actions/setup@v2.7.5 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/cache@v4.3.0 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/configure-pages@v5.0.0 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/upload-pages-artifact@v3.0.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/deploy-pages@v4.0.5 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

github-actions · 2026-08-04T09:56:55Z

🔍 Hypatia Security Scan

Findings: 207 issues detected

Severity	Count
🔴 Critical	1
🟠 High	59
🟡 Medium	147

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action actions/checkout@v4.1.7 needs attention",
    "type": "unpinned_action",
    "file": "boj-build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.3.1 needs attention",
    "type": "unpinned_action",
    "file": "build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action SonarSource/sonarqube-scan-action@v8.1.0 needs attention",
    "type": "unpinned_action",
    "file": "build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.1.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.1.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action haskell-actions/setup@v2.7.5 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/cache@v4.3.0 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/configure-pages@v5.0.0 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/upload-pages-artifact@v3.0.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/deploy-pages@v4.0.5 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

github-actions · 2026-08-04T10:08:37Z

🔍 Hypatia Security Scan

Findings: 207 issues detected

Severity	Count
🔴 Critical	1
🟠 High	59
🟡 Medium	147

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action actions/checkout@v4.1.7 needs attention",
    "type": "unpinned_action",
    "file": "boj-build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.3.1 needs attention",
    "type": "unpinned_action",
    "file": "build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action SonarSource/sonarqube-scan-action@v8.1.0 needs attention",
    "type": "unpinned_action",
    "file": "build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.1.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.1.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action haskell-actions/setup@v2.7.5 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/cache@v4.3.0 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/configure-pages@v5.0.0 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/upload-pages-artifact@v3.0.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/deploy-pages@v4.0.5 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

hyperpolymath enabled auto-merge (squash) August 4, 2026 04:16

gitar-bot Bot previously approved these changes Aug 4, 2026

View reviewed changes

gitar-bot Bot added the gitar-approved Added by Gitar label Aug 4, 2026

fix(ci): bump standards re-pin to bd0df9e (lockfile-aware governance …

3c6fb7a

…lint) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

hyperpolymath dismissed gitar-bot[bot]’s stale review via 3c6fb7a August 4, 2026 04:17

hyperpolymath closed this Aug 4, 2026

auto-merge was automatically disabled August 4, 2026 04:34
Pull request was closed

hyperpolymath reopened this Aug 4, 2026

hyperpolymath enabled auto-merge (squash) August 4, 2026 05:08

hyperpolymath closed this Aug 4, 2026

auto-merge was automatically disabled August 4, 2026 09:55
Pull request was closed

hyperpolymath reopened this Aug 4, 2026

hyperpolymath closed this Aug 4, 2026

hyperpolymath reopened this Aug 4, 2026

hyperpolymath enabled auto-merge (squash) August 4, 2026 10:34

hyperpolymath disabled auto-merge August 4, 2026 21:54

hyperpolymath merged commit fc4c88d into main Aug 4, 2026
71 of 88 checks passed

hyperpolymath deleted the ci/actions-lockfile branch August 4, 2026 21:54

Navigation Menu

Uh oh!

fix(ci): adopt Actions dependency lockfile (estate startup_failure remediation) - #295

fix(ci): adopt Actions dependency lockfile (estate startup_failure remediation)#295
hyperpolymath merged 3 commits into
mainfrom
ci/actions-lockfile

hyperpolymath commented Aug 4, 2026

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

gitar-bot Bot commented Aug 4, 2026

Uh oh!

gitar-bot Bot left a comment

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hyperpolymath commented Aug 4, 2026

Uh oh!

github-actions Bot commented Aug 4, 2026

🔍 Hypatia Security Scan

Uh oh!

gitar-bot Bot commented Aug 4, 2026

Uh oh!

gitar-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Aug 4, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented Aug 4, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented Aug 4, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented Aug 4, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented Aug 4, 2026

🔍 Hypatia Security Scan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant