fix(ci): unbreak workflow YAML and add a complete actions.lock

[hyperpolymath]

Remediates GitHub Workflow Dependency Locking (public preview, no changelog entry), which rejects runs at startup_failure — zero jobs, no logs, nothing in REST or GraphQL. Full analysis: hyperpolymath/standards#657.

Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead → 0 startup_failure, 13 running.

Five steps, in order — each blocks the next

1. Unbreak the workflow YAML. Any permissions: carrying a scalar with an indented mapping under it:

permissions: read-all
  actions: read        # <- mapping under a scalar. Unparseable.

This reaches past the one file: gh actions-lock refuses to run when any workflow in the repo fails to parse, so the repo can never acquire a lockfile and can never self-heal.

2. Repin standards reusables off commits with no actions.lock. The rejection requires the callee to be covered at the pinned SHA — unsatisfiable at a pre-lockfile commit.

3. Generate the lockfile with gh actions-lock.

4. Hand-add the reusable-caller entries the tool omits, as '<path>': [].

⚠️ Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without — because every workflow a lockfile omits is rejected. A partial lock is worse than none. Running gh actions-lock and stopping there is how this outage spread.

5. Restore SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps via head -1.

Verified before this PR was opened

0 unparseable workflows · lockfile covers every workflow, no omissions · SPDX on line 1 in every file. The script refuses to push if any of the three fails.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b24aace9-d59b-4d82-b51c-878e3b101c81

📥 Commits

Reviewing files that changed from the base of the PR and between 7dcf355 and aa2c77b.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (14)

• .github/workflows/boj-build.yml
• .github/workflows/casket-pages.yml
• .github/workflows/ci.yml
• .github/workflows/codeql.yml
• .github/workflows/dependabot-automerge.yml
• .github/workflows/dogfood-gate.yml
• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/instant-sync.yml
• .github/workflows/mirror.yml
• .github/workflows/pages.yml
• .github/workflows/push-email-notify.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml

---

📝 Walkthrough

Summary by CodeRabbit

• Chores

  • Updated automated workflow configurations and management metadata.
  • Refreshed pinned versions for build, governance, scanning, mirroring, security, and notification automation.
  • Updated the email notification action version used by push notifications.

• Maintenance

  • Improved consistency across automated checks and deployment workflows.
  • No changes to user-facing functionality or application behaviour.

Walkthrough

The pull request updates GitHub Actions management comments and changes seven action or reusable workflow references. Most edits are header-only. Two action references use tags instead of their previous references.

Changes

Workflow maintenance

Layer / File(s)	Summary
Workflow header comments .github/workflows/*.yml	Management comments are added, duplicated, or repositioned across workflow headers.
Reusable workflow pins .github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/mirror.yml, .github/workflows/scorecard.yml, .github/workflows/secret-scanner.yml	Reusable workflow references use updated commit pins.
Action version references .github/workflows/ci.yml, .github/workflows/push-email-notify.yml	The Rust toolchain reference changes to v1. The mail action reference changes to v3.12.0.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit checks the workflows at dawn

Headers repeat, and blank lines are gone
Pins hop forward in tidy rows
Rust and mail wear newer clothes
The green checks greet the carrot lawn

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Not up to standards ⛔

🔴 Issues 2 high

Alerts:
⚠ 2 issues (≤ 0 issues of at least minor severity)

Results:
2 new issues

Category	Results
Security	2 high

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The PR attempts to fix GitHub Workflow dependency locking but introduces several regressions and verification obstacles. Codacy analysis indicates the changes are currently not up to standards due to security issues.

Specifically, the transition from immutable commit SHAs to mutable version tags (e.g., @v1, @v3.12.0) in ci.yml and push-email-notify.yml constitutes a security regression and supply chain risk. Furthermore, while the PR title claims to add a complete actions.lock, the file is excluded from the diff, making it impossible to verify the completeness or the mapping of tags to SHAs. There is also a systemic issue where a redundant management comment is being inserted into every modified workflow file.

About this PR

• The file '.github/workflows/actions.lock' is excluded from the diff. This makes it impossible to verify that all 13+ jobs are covered or that the mutable tags introduced in this PR are correctly mapped to immutable SHAs within the lockfile.
• Systemic Redundancy: All modified workflow files contain a duplicate header line ('# This workflow is managed by gh actions-lock.') on lines 2 and 3. This appears to be a tool-induced error that should be cleaned up across the repository.

Test suggestions

• Verify all workflow files are valid YAML and can be parsed by 'gh actions-lock'
• Verify SPDX-License-Identifier is the first line in every workflow file
• Verify that the lockfile covers every workflow to prevent P(startup_failure)
• Verify that dtolnay/rust-toolchain is correctly pinned (SHA vs Tag)

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that the lockfile covers every workflow to prevent P(startup_failure)

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

The version changed from @v18 to @v3.12.0. Please confirm if this downgrade is intended. Regardless, this third-party action should be pinned to a full length commit SHA rather than a mutable tag to prevent potential malicious code injection if the tag is ever updated or overwritten.

[codacy-production]

_{🔴 HIGH RISK}

Using a mutable version tag like '@v1' instead of a full length commit SHA allows the action to change without notice. Pinning to a SHA is the only way to ensure the action is immutable and the build is reproducible. Find the current commit SHA for dtolnay/rust-toolchain@v1 and replace the tag with that SHA.

[codacy-production]

_{⚪ LOW RISK}

Nitpick: Redundant duplicate comment: This line is identical to line 2. Please remove the extra management header here and in all other workflow files modified in this PR.

Suggested change

# This workflow is managed by gh actions-lock.