ci(actions.lock): resync Dependabot bumps; close the standards@11ba299 record

[hyperpolymath]

Summary

Fixes the lint-workflows red on main (c09e531) and the startup failures behind it. Those failures produce no check runs, so they do not appear in the check list at all.

• lint-workflows, run 37534419872. The Dependabot bump (chore(deps): Bump the actions group with 2 updates #37) moved jekyll.yml to ruby/setup-ruby@v1.327.0 and sonarqube.yml to SonarSource/sonarqube-scan-action@v8.3.0, but did not update actions.lock. The decisive line was: ERROR: these action refs are neither SHA-pinned nor covered by the lockfile: jekyll.yml:16 … sonarqube.yml:68 ….
• Startup failures (jobs=0) on c09e531.
  • governance 37534425564, mirror 37534421622 and secret-scanner 37534428119 all failed with: lockfile missing pin for actions/checkout@3d3c42e5….
  • jekyll 37534424490 failed with: lockfile could not be validated.
  • hypatia-scan 37534423059 and sonarqube 37534426885 also failed at startup. I could not retrieve their annotation text.
  • Cause: fix(ci): retire scorecard enforcer, resync actions.lock, fix Dependabot and scorecard permissions #38 listed hyperpolymath/standards@11ba299 under the five job-level reusable callers, but gave it a dependency record with no uses: list. GitHub then requires the callee's transitive actions in the caller lock. This is the same failure shape that scripts/check-lock-sync.sh in rsr-template-repo documents for cicd-squabbler.

The other reds on this head are not changed here. They are owner items, listed under Testing.

Changes

• .github/workflows/actions.lock, hand-edited and diffed. Fix mode was not used.
  • ruby/setup-ruby: v1.326.0 → v1.327.0, commit 14594264cd68ce8a2345dd349bc3d138a4ef85c8.
  • sonarsource/sonarqube-scan-action: v8.2.2 → v8.3.0, commit d209202bc7d53ff1cc128f7f907dac145c9d6ae9. This is the same record that harvard-dehallucinator's sonarqube run starts with. That run was green on 1d9faa2, with the same SonarSource/ workflow casing and a lowercase lock key.
  • The hyperpolymath/standards@11ba299dca221b6d4e970eeb58dd17ccbb825a9a record gains a uses: list.
    • The list is the union of the callee actions recorded in standards' own actions.lock at 11ba299, for the governance, hypatia-scan, mirror, scorecard and secret-scanner reusables.
    • Eight new leaf records close it: actions/cache@55cc8345, actions/upload-artifact@043fb46d, dtolnay/rust-toolchain@02cb101e, editorconfig-checker/action-editorconfig-checker@51f63319, erlef/setup-beam@54075bcc, github/codeql-action@b96794f0, ossf/scorecard-action@2d114668, webfactory/ssh-agent@e8387483.
  • Two SHAs leave the lock, both deliberately: the superseded tag commits 762794c1 (setup-ruby v1.326.0) and ba9859ea (scan-action v8.2.2). Every other prior SHA survives (comm -23 over the 40-hex sets).
• Workflow files are unchanged. The standards pins stay at 11ba299, because its gates pass locally here (see Testing).

Type of change

CI fix (lockfile only). No product code changed.

📌 New pins

• Head SHA: d2c8e89
• actions.lock entries changed:
  • ruby/setup-ruby@v1.327.0 → 14594264cd68ce8a2345dd349bc3d138a4ef85c8
  • sonarsource/sonarqube-scan-action@v8.3.0 → d209202bc7d53ff1cc128f7f907dac145c9d6ae9
• actions.lock records added (transitive closure of hyperpolymath/standards@11ba299dca221b6d4e970eeb58dd17ccbb825a9a):
  • actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
  • actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
  • dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
  • editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393 (v3.0.0)
  • erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124
  • github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63
  • ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc
  • webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555
• Workflow uses: pins: none changed.

RSR Quality Checklist

Required

• Tests pass: not run. The change touches only actions.lock, and no test reads it.
• Code is formatted: no source code changed.
• Linter is clean: bun scripts/check-action-pinning.js (the lint-workflows step) exits 0. Before this change it exited 1.
• No banned language patterns: no new files, and the lockfile is YAML that the tool demands.
• No unsafe blocks: no code changed.
• No banned functions: no code changed.
• SPDX headers: no new or modified source files. actions.lock is machine-format and carries none upstream.
• No secrets, credentials or .env files.

As Applicable

• STATE / ECOSYSTEM / META descriptiles: not applicable. No project-state change, and A2ML is retired (AGENTS.md §2a), so no .a2ml is touched.
• Documentation: not applicable; nothing user-facing.
• TOPOLOGY.md: not applicable.
• CHANGELOG: not applicable to a CI lock resync.
• New dependencies reviewed: none added. These are the same actions the standards reusables already run; they are now listed in the caller lock.
• ABI/FFI: not applicable.

Testing

Run locally in the worktree at the head SHA. Every check below exits non-zero on failure, and none had its stderr suppressed.

Command	Before (origin/main c09e531)	After (d2c8e89)
bun scripts/check-action-pinning.js	rc=1, sonarqube.yml:68 … v8.3.0 (and jekyll)	rc=0, 32 ref(s) resolvable, all action refs are pinned
gh actions-lock --verify-local (v0.1.6)	rc=1, 2 of 32 workflows failed: 2 ref-changed, 2 stale	rc=0, All 32 workflows have complete lockfile coverage.
gh actions-lock --verify	not run	rc=0, Scanning 32 workflows
template scripts/check-lock-sync.sh (copy from harvard-dehallucinator, rsr-template-repo)	rc=1, 4 FAIL lines (refs missing or stale for jekyll and sonarqube)	rc=0, in sync and transitively closed
standards@7d51f30f check-actions-lock-gate.sh (the governance Actions lockfile verify gate)	not run	rc=0, Immutable direct and transitive lockfile coverage verified.
standards@11ba299 check-workflow-staleness.sh (job.workflow_sha)	not run	rc=0, All workflow staleness checks passed.

Positive control: I planted uses: evil-org/bogus-action@v9.9.9 in a scratch workflow. check-action-pinning.js exited 1 and named it. The scratch file was removed before commit.

Not verified until CI runs on this head:

• Whether GitHub now starts governance, mirror, secret-scanner, hypatia-scan, scorecard, jekyll and sonarqube. GitHub's startup validation cannot be run locally. The evidence is harvard-dehallucinator, whose lock has the same closed-record shape and whose workflows start.
• What those workflows report once they start:
  • governance / UUID v7 conformance is expected red. The tree carries v5 clade IDs (a5ea1382-…-5334-… in CLAUDE.md and the CLADE descriptile, e216170e-… in build/templates/CLADE.a2ml.in). The checker fails on them at both 11ba299 and 7d51f30f. Fixing this needs an owner ruling (a clade-v5 exemption or an ADR-008 P3 remint), not a mechanical change.
  • Mirror jobs depend on the mirror SSH secrets being set.

Reds on this head that this PR does not touch (owner items):

• analyze (actions, none): dual CodeQL config. Default setup has been configured since 2026-08-26, and the advanced codeql.yml upload is refused ("cannot be processed when the default setup is enabled"). Owner action under standards#1031: disable default setup (Settings → Code security → CodeQL → switch to advanced), or remove the duplicate. codeql.yml is left in place.
• dispatch (instant-sync.yml): Parameter token or opts.auth is required. The secret FARM_DISPATCH_TOKEN is not set on this repo.
• estate-rules: FAIL: 33 root entries are not on the allowlist. This is a structural decision about the repo root.
• openssf-compliance: FAIL: 35 file(s) contain unfilled {{PLACEHOLDER}} tokens. These need owner values (just init), and I did not invent them.

Screenshots

Not applicable; terminal output is quoted above.

🤖 Generated with Claude Code

https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: c577faa3-37d0-4afa-8b9f-f48a392a115c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}