From 9285f4fe73ff9f4bdb02da80fd712e0f9d4fb98e Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 13 Oct 2026 23:21:06 +0000 Subject: [PATCH] ci(lock): drop orphan asana/setup-python records signed-push stopped calling Asana/push-signed-commits in #1233, which replaced it with push-verified.sh (bash, gh, jq). Two records it brought into actions.lock were left behind and nothing references them now: - asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897 - actions/setup-python@v2, its only transitive edge. This was the only non-SHA key in the lock. No workflows: list and no nested uses: names either ref. The lock tools cannot remove them: prune-stale.sh works only on the workflows: section, and close-lock.sh only adds records. So the two dependencies: blocks were deleted with a gawk filter that only touches that section. Nothing else in the lock changed. Checks, run before and after the deletion: - check-lock-sync: in sync. - validate-actions-lock: 25 refs, 27 keys (was 28). - check-actions-lock-gate with gh-actions-lock v0.1.6: coverage verified. - prune-stale: no-op. - close-lock: 0 dangling refs. Refs #1122. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_014h2gFLLQibfB5N5hFz9ZCD --- .github/workflows/actions.lock | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 08354b414..c7445fb45 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -196,11 +196,6 @@ dependencies: commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3' owner_id: 44036562 repo_id: 205262760 - 'actions/setup-python@v2': - ref: 'v2' - commit: 'sha1-e9aba2c848f5ebd159c070c61ea2c4e2b122355e' - owner_id: 44036562 - repo_id: 192625525 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f': ref: 'v7.0.0' commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' @@ -218,13 +213,6 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' - 'asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897': - ref: 'v1.3' - commit: 'sha1-d615ca88d8e1a946734c24970d1e7a6c56f34897' - owner_id: 1472111 - repo_id: 772313726 - uses: - - 'actions/setup-python@v2' 'dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067': ref: 'v1' commit: 'sha1-7e38f4b43b4db5c8dd498af069a4f6196df1d067'