fix(ci): reconcile the workflows with actions.lock (gh-actions-lock)

[hyperpolymath]

fix(ci): reconcile the workflows with actions.lock (gh-actions-lock v0.1.6)

actions.lock is authoritative: the workflows carry readable refs and the lock records the
commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest
make the whole repository unstartable — startup_failure, "Invalid lockfile".

Regenerated with the official extension (github/gh-actions-lock). The hand-pinned SHA refs are
reverted to their readable form here precisely because the lockfile, not the workflow, is what
pins them.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: c609741b-aa46-44ea-b423-2b11dd2c5a9e

📥 Commits

Reviewing files that changed from the base of the PR and between 8ed6c55 and 3acf508.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (17)

• .github/workflows/cflite_batch.yml
• .github/workflows/cflite_pr.yml
• .github/workflows/checker-scaling.yml
• .github/workflows/codeql.yml
• .github/workflows/coverage.yml
• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/label-triage.yml
• .github/workflows/labels.yml
• .github/workflows/mirror.yml
• .github/workflows/pages.yml
• .github/workflows/proofs.yml
• .github/workflows/push-email-notify.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml
• .github/workflows/spark-theatre-gate.yml
• .github/workflows/stack-depth.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (31)

• GitHub Check: spark-theatre-gate / SPARK Theatre Gate
• GitHub Check: governance / Debt ratchet
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Actions lockfile verify
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: scan / rust-secrets
• GitHub Check: scan / shell-secrets
• GitHub Check: scan / gitleaks
• GitHub Check: scaling (ubuntu-latest)
• GitHub Check: scaling (windows-latest)
• GitHub Check: Idris2 solo-core
• GitHub Check: analyze (actions, none)
• GitHub Check: Coq solo-core
• GitHub Check: measure (ubuntu-latest)
• GitHub Check: llvm-cov
• GitHub Check: measure (windows-latest)
• GitHub Check: scaling (windows-latest)
• GitHub Check: scaling (ubuntu-latest)
• GitHub Check: measure (ubuntu-latest)
• GitHub Check: llvm-cov
• GitHub Check: measure (windows-latest)

🔇 Additional comments (19)

.github/workflows/cflite_batch.yml (2)

1-1: LGTM!

---

34-34: 🔒 Security & Privacy | 🛡️ Analyzed with Security Review

The listed action references are covered by actions.lock. The lockfile records each workflow dependency and its verified commit. Onboarded workflows execute the locked commit, so replacing these references with SHA pins is not required for this concern.

Likely an incorrect or invalid review comment.

.github/workflows/cflite_pr.yml (1)

1-1: LGTM!

.github/workflows/checker-scaling.yml (1)

1-1: LGTM!

.github/workflows/codeql.yml (1)

1-1: LGTM!

.github/workflows/coverage.yml (1)

1-1: LGTM!

.github/workflows/governance.yml (1)

1-1: LGTM!

.github/workflows/hypatia-scan.yml (1)

1-1: LGTM!

.github/workflows/label-triage.yml (1)

1-1: LGTM!

.github/workflows/labels.yml (1)

1-1: LGTM!

.github/workflows/mirror.yml (1)

1-1: LGTM!

.github/workflows/proofs.yml (1)

1-1: LGTM!

.github/workflows/push-email-notify.yml (2)

1-1: LGTM!

---

45-45: 🔒 Security & Privacy | 🛡️ Analyzed with Security Review

The lockfile enforcement already protects this action reference.

The repository rejects workflows with stale actions.lock entries before job steps run. The workflow is listed in the lockfile, and the SMTP action reference is recorded there. A tag retarget would therefore cause a startup failure rather than execute replacement action code.

Likely an incorrect or invalid review comment.

.github/workflows/scorecard.yml (1)

1-1: LGTM!

.github/workflows/secret-scanner.yml (1)

1-1: LGTM!

.github/workflows/spark-theatre-gate.yml (1)

1-1: LGTM!

.github/workflows/stack-depth.yml (1)

1-1: LGTM!

.github/workflows/pages.yml (1)

57-57: 🗄️ Data Integrity & Integration

No lock-management gap exists. .github/workflows/pages.yml has the management marker, and .github/workflows/actions.lock contains the exact actions/deploy-pages@v5.0.1 entry. The proposed concern is not actionable.

---

📝 Summary

Summary by CodeRabbit

• Chores

  • Updated several continuous integration and deployment workflows to use refreshed, versioned action references.
  • Workflow behaviour, triggers, permissions, conditions and job configurations remain unchanged.

• Documentation

  • Added management markers to CI workflow definitions to indicate they are maintained by the workflow-locking tool.
  • These comments are informational only and do not affect builds, checks, deployments or notifications.

Walkthrough

The workflows add gh actions-lock management comments. Five action references change from pinned commit SHAs to version tags. Existing workflow triggers, permissions, jobs, and configuration remain unchanged.

Changes

Workflow management

Layer / File(s)	Summary
Add workflow management markers .github/workflows/*.yml	Sixteen workflows now include a top-level gh actions-lock management comment.
Update action references .github/workflows/cflite_*.yml, .github/workflows/codeql.yml, .github/workflows/pages.yml, .github/workflows/push-email-notify.yml	Five action references now use version tags instead of pinned commit SHAs.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI workflow reconciliation with actions.lock and matches the main change.
Description check	✅ Passed	The description explains the actions.lock reconciliation, readable workflow references, authoritative lockfile pinning, and the startup errors addressed. It is directly related to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks each workflow line
Tags now hop in ordered time
Lock marks sit where headers glow
Pinned commits yield to versions in tow
The CI burrow runs as before}

_{Comment @coderabbitai help to get the list of available commands.}