diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..1a8be20 --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,101 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/cflite_batch.yml': + - 'google/clusterfuzzlite@v1' + '.github/workflows/cflite_pr.yml': + - 'actions/checkout@v7.0.1' + - 'google/clusterfuzzlite@v1' + '.github/workflows/codeql.yml': + - 'actions/checkout@v7.0.1' + - 'github/codeql-action@v4.37.3' + '.github/workflows/deno-ci.yml': [] + '.github/workflows/governance.yml': [] + '.github/workflows/hypatia-scan.yml': [] + '.github/workflows/language-policy.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/mirror.yml': [] + '.github/workflows/pages.yml': + - 'actions/checkout@v7.0.1' + - 'actions/deploy-pages@v5.0.0' + - 'actions/upload-pages-artifact@v5.0.0' + '.github/workflows/proofs.yml': + - 'actions/checkout@v7.0.1' + '.github/workflows/publish-container.yml': + - 'actions/attest-build-provenance@v4.1.1' + - 'actions/checkout@v7.0.1' + - 'docker/build-push-action@v7.3.0' + - 'docker/login-action@v4.5.2' + - 'docker/metadata-action@v6.2.0' + '.github/workflows/push-email-notify.yml': + - 'dawidd6/action-send-mail@v3.12.0' + '.github/workflows/rust-ci.yml': [] + '.github/workflows/scorecard.yml': [] + '.github/workflows/secret-scanner.yml': [] +dependencies: + 'actions/attest-build-provenance@v4.1.1': + ref: 'v4.1.1' + commit: 'sha1-0f67c3f4856b2e3261c31976d6725780e5e4c373' + owner_id: 44036562 + repo_id: 760702757 + uses: + - 'actions/attest@a1948c3f048ba23858d222213b7c278aabede763' + 'actions/attest@a1948c3f048ba23858d222213b7c278aabede763': + ref: 'v4.1.1' + commit: 'sha1-a1948c3f048ba23858d222213b7c278aabede763' + owner_id: 44036562 + repo_id: 760701061 + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/deploy-pages@v5.0.0': + ref: 'v5.0.0' + commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128' + owner_id: 44036562 + repo_id: 438112499 + 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f': + ref: 'v7.0.0' + commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-pages-artifact@v5.0.0': + ref: 'v5.0.0' + commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9' + owner_id: 44036562 + repo_id: 496012378 + uses: + - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + 'dawidd6/action-send-mail@v3.12.0': + ref: 'v3.12.0' + commit: 'sha1-12335b969ae3fb71bee5f2c6b829744261aec34c' + owner_id: 9713907 + repo_id: 222439721 + 'docker/build-push-action@v7.3.0': + ref: 'v7.3.0' + commit: 'sha1-53b7df96c91f9c12dcc8a07bcb9ccacbed38856a' + owner_id: 5429470 + repo_id: 241092383 + 'docker/login-action@v4.5.2': + ref: 'v4.5.2' + commit: 'sha1-371161bbe7024a29a25c5e19bfcbc0804fe9ad2c' + owner_id: 5429470 + repo_id: 287743349 + 'docker/metadata-action@v6.2.0': + ref: 'v6.2.0' + commit: 'sha1-dc802804100637a589fabce1cb79ff13a1411302' + owner_id: 5429470 + repo_id: 306769011 + 'github/codeql-action@v4.37.3': + ref: 'v4.37.3' + commit: 'sha1-e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81' + owner_id: 9919 + repo_id: 259445878 + 'google/clusterfuzzlite@v1': + ref: 'v1' + commit: 'sha1-884713a6c30a92e5e8544c39945cd7cb630abcd1' + owner_id: 1342004 + repo_id: 400046858 diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml index e7248f2..1620ada 100644 --- a/.github/workflows/cflite_batch.yml +++ b/.github/workflows/cflite_batch.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: ClusterFuzzLite batch fuzzing on: schedule: @@ -18,14 +19,14 @@ jobs: steps: - name: Build Fuzzers (${{ matrix.sanitizer }}) id: build - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 + uses: google/clusterfuzzlite/actions/build_fuzzers@v1 with: language: rust sanitizer: ${{ matrix.sanitizer }} - name: Run Fuzzers (${{ matrix.sanitizer }}) id: run - uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 + uses: google/clusterfuzzlite/actions/run_fuzzers@v1 with: github-token: ${{ secrets.GITHUB_TOKEN }} fuzz-seconds: 1800 diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml index f9ac7cf..b984ca3 100644 --- a/.github/workflows/cflite_pr.yml +++ b/.github/workflows/cflite_pr.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: ClusterFuzzLite PR fuzzing on: pull_request: @@ -16,18 +17,18 @@ jobs: sanitizer: [address] steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Build Fuzzers (${{ matrix.sanitizer }}) id: build - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 + uses: google/clusterfuzzlite/actions/build_fuzzers@v1 with: language: rust sanitizer: ${{ matrix.sanitizer }} - name: Run Fuzzers (${{ matrix.sanitizer }}) id: run - uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 + uses: google/clusterfuzzlite/actions/run_fuzzers@v1 with: github-token: ${{ secrets.GITHUB_TOKEN }} fuzz-seconds: 300 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index eb9b68f..1efd968 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: CodeQL Security Analysis on: @@ -36,15 +37,15 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.28.1 + uses: github/codeql-action/init@v4.37.3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.28.1 + uses: github/codeql-action/analyze@v4.37.3 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/deno-ci.yml b/.github/workflows/deno-ci.yml index 256cd7b..5537219 100644 --- a/.github/workflows/deno-ci.yml +++ b/.github/workflows/deno-ci.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Thin wrapper around the estate-wide reusable Deno CI bundle. # See: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml name: Deno CI @@ -17,4 +18,4 @@ permissions: jobs: deno-ci: - uses: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 # standards#168 head + uses: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # standards#168 head diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 5a45c42..235c601 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # governance.yml — single wrapper calling the shared estate governance bundle # in hyperpolymath/standards instead of carrying per-repo copies. # @@ -31,4 +32,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 # main 2026-05-27 (post-#219 workflow_sha fix) + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # main 2026-05-27 (post-#219 workflow_sha fix) diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 2e7e939..8df8727 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml. # See standards#191 for the reusable's purpose and design. @@ -25,5 +26,5 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 secrets: inherit \ No newline at end of file diff --git a/.github/workflows/language-policy.yml b/.github/workflows/language-policy.yml index 91cbb6b..dfa6dd7 100644 --- a/.github/workflows/language-policy.yml +++ b/.github/workflows/language-policy.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Language Policy Enforcement on: push: @@ -18,7 +19,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: Enforce language policies run: | # Block new Python files (except SaltStack) diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 81e9903..797be50 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Mirror to Git Forges on: @@ -11,5 +12,5 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 secrets: inherit diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index a1a1aa3..3be681d 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: GitHub Pages (Ddraig SSG) on: push: @@ -19,9 +20,9 @@ jobs: image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff steps: - name: Checkout Site - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Checkout Ddraig SSG - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/ddraig-ssg path: .ddraig-ssg @@ -38,7 +39,7 @@ jobs: fi ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/} - name: Upload artifact - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 + uses: actions/upload-pages-artifact@v5.0.0 with: path: '_site' deploy: @@ -51,4 +52,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 + uses: actions/deploy-pages@v5.0.0 diff --git a/.github/workflows/proofs.yml b/.github/workflows/proofs.yml index 36d0507..f59609b 100644 --- a/.github/workflows/proofs.yml +++ b/.github/workflows/proofs.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Copyright (c) Jonathan D.A. Jewell # # Proof verification CI. Runs the LIGHTWEIGHT provers that are fast and reliable @@ -37,7 +38,7 @@ jobs: name: Coq — CNO + OND (14 theories) runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + - uses: actions/checkout@v7.0.1 - name: Install Coq run: sudo apt-get update && sudo apt-get install -y coq - name: Build all theories via coq_makefile @@ -53,7 +54,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 25 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + - uses: actions/checkout@v7.0.1 - name: Install Agda (binary only) # Install just the `agda` binary (2.6.3 on 24.04). NOT `agda-stdlib` — # the Ubuntu stdlib package ships no usable library manifest; we fetch a @@ -82,7 +83,7 @@ jobs: name: Z3 — CNO + OND bounded checks runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + - uses: actions/checkout@v7.0.1 - name: Install Z3 run: sudo apt-get update && sudo apt-get install -y z3 - name: Run Z3 checks diff --git a/.github/workflows/publish-container.yml b/.github/workflows/publish-container.yml index 003a9ba..02bd3f4 100644 --- a/.github/workflows/publish-container.yml +++ b/.github/workflows/publish-container.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Publish Container on: @@ -20,10 +21,10 @@ jobs: id-token: write # mint the OIDC token the attestation is signed with attestations: write # write the build-provenance attestation (the "claim") steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 + - uses: actions/checkout@v7.0.1 - name: Log in to GitHub Container Registry - uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v3 + uses: docker/login-action@v4.5.2 with: registry: ghcr.io username: ${{ github.actor }} @@ -31,7 +32,7 @@ jobs: - name: Extract metadata id: meta - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v5 + uses: docker/metadata-action@v6.2.0 with: images: ghcr.io/${{ github.repository }} tags: | @@ -42,7 +43,7 @@ jobs: - name: Build and push id: push - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v6 + uses: docker/build-push-action@v7.3.0 with: context: . file: ./Containerfile @@ -51,7 +52,7 @@ jobs: labels: ${{ steps.meta.outputs.labels }} - name: Attest container provenance - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@v4.1.1 with: subject-name: ghcr.io/${{ github.repository }} subject-digest: ${{ steps.push.outputs.digest }} diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 2a95f5d..b69c87f 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by @@ -15,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Send push notification email - uses: dawidd6/action-send-mail@12335b969ae3fb71bee5f2c6b829744261aec34c # pinned + uses: dawidd6/action-send-mail@v3.12.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index c35e98a..b9b3dd8 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. # Rust CI — thin wrapper calling the shared estate reusable in # hyperpolymath/standards. Configure once, propagate everywhere. # See: docs/CI-REUSABLE-WORKFLOWS.adoc in standards. @@ -14,7 +15,7 @@ permissions: jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@412a7031577112b31ee287cc6060179d638d6500 + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 with: enable_audit: true enable_coverage: true diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 2d9ea22..df71468 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Scorecards supply-chain security on: @@ -15,5 +16,5 @@ jobs: permissions: security-events: write id-token: write - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 secrets: inherit diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 9ed74ef..2e351e7 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,4 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. name: Secret Scanner on: @@ -19,5 +20,5 @@ jobs: contents: read pull-requests: write actions: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 secrets: inherit \ No newline at end of file