Repository navigation
Actions lockfile verify red on main: 3 stale actions.lock entries #108
Description
governance / Actions lockfile verify is red on main (fa9bd38) and on every PR, e.g. #107.
The verifier reports "valid": false with 3 stale entries and 23 sha-as-ref warnings (lockfile_version v0.0.2). The timing fits #106 (dependabot bumping the actions group) landing without a matching actions.lock regeneration.
Acceptance criteria
-
actions.lockregenerated with the authoritative tool (gh actions-lock/scripts/update-actions-lock.sh), never edited by hand. -
governance / Actions lockfile verifyis green onmain. - Optional: the dependabot config regenerates the lock in the same PR, so the next bump does not reopen this.
Found while deferring the red check on #107 (§5c).
🤖 Generated with Claude Code
Activity
fix(parser): replace a Rust doc comment in the Parser module header (#…
hyperpolymath commentedon Oct 6, 2026
Related, but not yet confirmed to share a root cause:
Haskell CI(.github/workflows/haskell.yml) has ended instartup_failureon every run since 2026-10-03: pushfa9bd386, PR4317025d(#107), pushb0eba0f1. The last run that started was 2026-10-01 (564bcde3, failure). A workflow that never starts often means itsuses:pins are missing fromactions.lock, which would make this the same stale-lock drift. Check it when regenerating the lock: package compilation has not run in CI since the fix in #107.fix(licence): declare MPL-2.0 for code and CC-BY-SA-4.0 for prose (#110)
fix(ci): sync actions.lock with bumped pins; drop manifest-less Depen…