fix(ci): reconcile the workflows with actions.lock (gh-actions-lock)

[hyperpolymath]

fix(ci): reconcile the workflows with actions.lock (gh-actions-lock v0.1.6)

actions.lock is authoritative: the workflows carry readable refs and the lock records the
commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest
make the whole repository unstartable — startup_failure, "Invalid lockfile".

Regenerated with the official extension (github/gh-actions-lock). The hand-pinned SHA refs are
reverted to their readable form here precisely because the lockfile, not the workflow, is what
pins them.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 5f995484-44f3-404a-a7ff-78c8f2030e0a

📥 Commits

Reviewing files that changed from the base of the PR and between 81316ad and bbaa7d4.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (18)

• .github/workflows/aur-publish.yml
• .github/workflows/codeql.yml
• .github/workflows/container.yml
• .github/workflows/dependabot-automerge.yml
• .github/workflows/generator-generic-ossf-slsa3-publish.yml
• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/instant-sync.yml
• .github/workflows/label-triage.yml
• .github/workflows/labels.yml
• .github/workflows/language-policy.yml
• .github/workflows/main-estate-audit.yml
• .github/workflows/mirror.yml
• .github/workflows/pages.yml
• .github/workflows/push-email-notify.yml
• .github/workflows/release.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (21)

• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Debt ratchet
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: governance / Actions lockfile verify
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: scan / gitleaks
• GitHub Check: scan / shell-secrets
• GitHub Check: scan / rust-secrets
• GitHub Check: scan / Hypatia Neurosymbolic Analysis
• GitHub Check: check
• GitHub Check: Analyze (actions)
• GitHub Check: estate-audit

🔇 Additional comments (18)

.github/workflows/aur-publish.yml (1)

1-1: LGTM!

Also applies to: 23-23, 72-72, 88-88, 122-122

.github/workflows/codeql.yml (1)

1-1: LGTM!

Also applies to: 44-44, 46-46, 51-51

.github/workflows/container.yml (1)

1-1: LGTM!

Also applies to: 26-26, 28-28, 30-30, 32-32, 39-39, 49-49, 62-62

.github/workflows/dependabot-automerge.yml (1)

1-1: LGTM!

Also applies to: 58-58

.github/workflows/generator-generic-ossf-slsa3-publish.yml (1)

1-1: LGTM!

Also applies to: 30-30

.github/workflows/governance.yml (1)

1-1: LGTM!

.github/workflows/hypatia-scan.yml (1)

1-1: LGTM!

.github/workflows/instant-sync.yml (1)

1-1: LGTM!

Also applies to: 21-21

.github/workflows/label-triage.yml (1)

1-1: LGTM!

.github/workflows/labels.yml (1)

1-1: LGTM!

.github/workflows/language-policy.yml (1)

1-1: LGTM!

Also applies to: 23-23

.github/workflows/main-estate-audit.yml (1)

1-2: LGTM!

Also applies to: 19-19, 22-22, 25-25, 28-28, 31-31, 34-34, 37-37, 40-40, 43-43, 46-46, 49-49, 52-52, 55-55, 58-58, 61-61, 64-64, 67-67, 70-70, 73-73, 76-76, 79-79, 82-82, 85-85, 88-88, 91-91, 94-94, 97-97

.github/workflows/mirror.yml (1)

1-1: LGTM!

.github/workflows/pages.yml (1)

1-1: LGTM!

Also applies to: 26-26, 28-28, 45-45, 58-58

.github/workflows/push-email-notify.yml (1)

1-1: LGTM!

Also applies to: 45-45

.github/workflows/release.yml (1)

1-1: LGTM!

Also applies to: 50-50, 52-52, 83-83, 95-95, 97-97, 103-103, 114-114, 116-116, 128-128, 140-140, 142-142, 151-151

.github/workflows/scorecard.yml (1)

1-1: LGTM!

.github/workflows/secret-scanner.yml (1)

1-1: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated automated workflows to use versioned action references across publishing, security scanning, deployment, notifications, and release processes.
  • Added workflow management markers to support consistent maintenance.
  • Existing workflow triggers, permissions, job steps, and user-visible behaviour remain unchanged.

Walkthrough

The PR adds gh actions-lock markers to GitHub Actions workflows and changes selected action references from commit SHAs to version tags or @main. Workflow jobs and other logic remain unchanged.

Changes

GitHub Actions workflow updates

Layer / File(s)	Summary
Workflow management markers .github/workflows/{aur-publish,codeql,container,dependabot-automerge,generator-generic-ossf-slsa3-publish,governance,hypatia-scan,instant-sync,label-triage,labels,language-policy,main-estate-audit,mirror,pages,push-email-notify,release,scorecard,secret-scanner}.yml	The workflows add or consolidate gh actions-lock management comments.
Standard action references .github/workflows/{aur-publish,codeql,container,dependabot-automerge,generator-generic-ossf-slsa3-publish,instant-sync,language-policy,pages,push-email-notify}.yml	Selected commit-SHA references change to version tags.
Multi-job action references .github/workflows/{main-estate-audit,release}.yml	Action references change across multiple jobs. main-estate-audit uses cicd-suite@main; release uses the specified version tags.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Possibly related PRs

• hyperpolymath/vcs-ircd#98: Adds the action lock file and management markers for workflow lock validation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI workflow reconciliation with actions.lock and matches the main changeset.
Description check	✅ Passed	The description explains the actions.lock reconciliation, readable workflow references, and the reason for the changes. It matches the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks each workflow line,
And tags the actions neat and fine.
Lock markers hop from file to file,
SHA pins change in tidy style.
The jobs still run their usual way.
“Hop reviewed!” the rabbit says.}

_{Comment @coderabbitai help to get the list of available commands.}