From 52b9aa7657317fd56033e7a846e21c69dd7591fc Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 16:32:34 +0000 Subject: [PATCH 1/8] ci(scratch): one-off actions.lock regeneration for main (not for merge) Resolves the slsa-github-generator and panic-attack records with a real token; the lock reaches main in a reviewed PR. This branch is deleted after use. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- .github/workflows/zz-one-off-lock-regen.yml | 46 +++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 .github/workflows/zz-one-off-lock-regen.yml diff --git a/.github/workflows/zz-one-off-lock-regen.yml b/.github/workflows/zz-one-off-lock-regen.yml new file mode 100644 index 00000000..d1ea067e --- /dev/null +++ b/.github/workflows/zz-one-off-lock-regen.yml @@ -0,0 +1,46 @@ +# SPDX-License-Identifier: MPL-2.0 +# ONE-OFF, scratch branch only, deleted after use. Regenerates main's +# actions.lock with the estate repair order (regen_lock in +# standards/scripts/regen-dependabot-locks.sh), runs the governance gate's own +# check against the result, and prints the lock base64-encoded. It has no +# `uses:` steps, so it needs no lock entry to start. It writes nothing back: +# the lock reaches the repository in a reviewed PR. +name: one-off actions.lock regeneration +on: + push: + branches: [claude/new-session-th4e9w-lockregen] +permissions: + contents: read +jobs: + regen: + runs-on: ubuntu-latest + timeout-minutes: 20 + env: + GH_TOKEN: ${{ github.token }} + REPO: ${{ github.repository }} + STANDARDS_REGEN_SHA: 39f895b717994df593c86de7d59915cec6a9bb38 + STANDARDS_GATE_SHA: 75bd5994470661a099df562d6d5ad2fe744dbd66 + steps: + - name: Regenerate main's actions.lock and check it with the gate + run: | + set -uo pipefail + git clone --quiet --branch main "https://github.com/$REPO.git" pb + git -C pb log --oneline -1 + git clone --quiet https://github.com/hyperpolymath/standards.git std + git -C std worktree add --quiet --detach ../std-regen "$STANDARDS_REGEN_SHA" + git -C std worktree add --quiet --detach ../std-gate "$STANDARDS_GATE_SHA" + sudo apt-get install -y -qq gawk >/dev/null + gh extension install github/gh-actions-lock --pin v0.2.0 + gh actions-lock --version + export GH_BIN=gh REGEN_TOOLS="$PWD/std-regen/scripts" + source std-regen/scripts/regen-dependabot-locks.sh + outcome="$(regen_lock "$PWD/pb")" + echo "OUTCOME=$outcome" + git -C pb status --porcelain + echo "== the governance gate, as pinned by echidna ($STANDARDS_GATE_SHA)" + (cd pb && ACTIONS_LOCK_VERIFIER="$PWD/../std-gate/scripts/update-actions-lock.sh" \ + bash ../std-gate/scripts/check-actions-lock-gate.sh .github/workflows); echo "GATE_RC=$?" + echo "LOCK-SHA256 $(sha256sum < pb/.github/workflows/actions.lock | cut -d' ' -f1)" + echo "LOCK-BEGIN" + base64 -w0 pb/.github/workflows/actions.lock; echo + echo "LOCK-END" From 09269e2d835094a51e615d254bf4bdcd7daece6a Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 16:45:47 +0000 Subject: [PATCH 2/8] ci(scratch): close-lock only, print the diff (not for merge) Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- .github/workflows/zz-one-off-lock-regen.yml | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/.github/workflows/zz-one-off-lock-regen.yml b/.github/workflows/zz-one-off-lock-regen.yml index d1ea067e..0b4ca4b2 100644 --- a/.github/workflows/zz-one-off-lock-regen.yml +++ b/.github/workflows/zz-one-off-lock-regen.yml @@ -18,7 +18,7 @@ jobs: env: GH_TOKEN: ${{ github.token }} REPO: ${{ github.repository }} - STANDARDS_REGEN_SHA: 39f895b717994df593c86de7d59915cec6a9bb38 + STANDARDS_REGEN_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7 STANDARDS_GATE_SHA: 75bd5994470661a099df562d6d5ad2fe744dbd66 steps: - name: Regenerate main's actions.lock and check it with the gate @@ -32,15 +32,17 @@ jobs: sudo apt-get install -y -qq gawk >/dev/null gh extension install github/gh-actions-lock --pin v0.2.0 gh actions-lock --version - export GH_BIN=gh REGEN_TOOLS="$PWD/std-regen/scripts" - source std-regen/scripts/regen-dependabot-locks.sh - outcome="$(regen_lock "$PWD/pb")" - echo "OUTCOME=$outcome" + # close-lock only: add the missing records and keep the ones main + # already has (a full regen drops records it cannot re-resolve). + export GH_BIN=gh + (cd pb && bash ../std-regen/scripts/close-lock.sh .github/workflows; echo "CLOSE_RC=$?") + (cd pb && bash ../std-regen/scripts/prune-stale.sh .github/workflows; echo "PRUNE_RC=$?") + (cd pb && bash ../std-regen/scripts/check-lock-sync.sh .github/workflows; echo "SYNC_RC=$?") git -C pb status --porcelain echo "== the governance gate, as pinned by echidna ($STANDARDS_GATE_SHA)" (cd pb && ACTIONS_LOCK_VERIFIER="$PWD/../std-gate/scripts/update-actions-lock.sh" \ bash ../std-gate/scripts/check-actions-lock-gate.sh .github/workflows); echo "GATE_RC=$?" echo "LOCK-SHA256 $(sha256sum < pb/.github/workflows/actions.lock | cut -d' ' -f1)" - echo "LOCK-BEGIN" - base64 -w0 pb/.github/workflows/actions.lock; echo - echo "LOCK-END" + echo "DIFF-BEGIN" + git -C pb diff -- .github/workflows/actions.lock + echo "DIFF-END" From 0d3645ce1bb50b87e59ad60a990267ed0aedcacf Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 16:56:18 +0000 Subject: [PATCH 3/8] ci(scratch): regenerate panic-attack's fix-branch lock from here (not for merge) panic-attack's own scratch run hits startup_failure; panic-attack is public, so its lock can be resolved with this repo's token. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- .github/workflows/zz-one-off-lock-regen.yml | 22 ++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/zz-one-off-lock-regen.yml b/.github/workflows/zz-one-off-lock-regen.yml index 0b4ca4b2..38306bbe 100644 --- a/.github/workflows/zz-one-off-lock-regen.yml +++ b/.github/workflows/zz-one-off-lock-regen.yml @@ -1,5 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 -# ONE-OFF, scratch branch only, deleted after use. Regenerates main's +# ONE-OFF, scratch branch only, deleted after use. Regenerates panic-attack's fix branch's # actions.lock with the estate repair order (regen_lock in # standards/scripts/regen-dependabot-locks.sh), runs the governance gate's own # check against the result, and prints the lock base64-encoded. It has no @@ -17,14 +17,14 @@ jobs: timeout-minutes: 20 env: GH_TOKEN: ${{ github.token }} - REPO: ${{ github.repository }} + REPO: hyperpolymath/panic-attack STANDARDS_REGEN_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7 - STANDARDS_GATE_SHA: 75bd5994470661a099df562d6d5ad2fe744dbd66 + STANDARDS_GATE_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7 steps: - - name: Regenerate main's actions.lock and check it with the gate + - name: Regenerate the repair branch's actions.lock and check it with the gate run: | set -uo pipefail - git clone --quiet --branch main "https://github.com/$REPO.git" pb + git clone --quiet --branch claude/new-session-th4e9w https://github.com/hyperpolymath/panic-attack.git pb git -C pb log --oneline -1 git clone --quiet https://github.com/hyperpolymath/standards.git std git -C std worktree add --quiet --detach ../std-regen "$STANDARDS_REGEN_SHA" @@ -32,14 +32,14 @@ jobs: sudo apt-get install -y -qq gawk >/dev/null gh extension install github/gh-actions-lock --pin v0.2.0 gh actions-lock --version - # close-lock only: add the missing records and keep the ones main - # already has (a full regen drops records it cannot re-resolve). + # The repair chain without a gh actions-lock fix-mode pass (it drops + # records it cannot re-resolve). export GH_BIN=gh - (cd pb && bash ../std-regen/scripts/close-lock.sh .github/workflows; echo "CLOSE_RC=$?") - (cd pb && bash ../std-regen/scripts/prune-stale.sh .github/workflows; echo "PRUNE_RC=$?") - (cd pb && bash ../std-regen/scripts/check-lock-sync.sh .github/workflows; echo "SYNC_RC=$?") + for s in relock-sha-keys complete-job-refs close-lock prune-stale check-lock-sync; do + (cd pb && { bash ../std-regen/scripts/$s.sh .github/workflows && echo "$s RC=0" || echo "$s RC=$?"; }) + done git -C pb status --porcelain - echo "== the governance gate, as pinned by echidna ($STANDARDS_GATE_SHA)" + echo "== the governance gate, as pinned by the repair branch ($STANDARDS_GATE_SHA)" (cd pb && ACTIONS_LOCK_VERIFIER="$PWD/../std-gate/scripts/update-actions-lock.sh" \ bash ../std-gate/scripts/check-actions-lock-gate.sh .github/workflows); echo "GATE_RC=$?" echo "LOCK-SHA256 $(sha256sum < pb/.github/workflows/actions.lock | cut -d' ' -f1)" From ea3cf8221e7e7d2adae6d796b7b6a59b53327323 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 16:59:49 +0000 Subject: [PATCH 4/8] ci(scratch): full regen for panic-attack's lock (not for merge) Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- .github/workflows/zz-one-off-lock-regen.yml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/.github/workflows/zz-one-off-lock-regen.yml b/.github/workflows/zz-one-off-lock-regen.yml index 38306bbe..6f0aadf2 100644 --- a/.github/workflows/zz-one-off-lock-regen.yml +++ b/.github/workflows/zz-one-off-lock-regen.yml @@ -32,12 +32,14 @@ jobs: sudo apt-get install -y -qq gawk >/dev/null gh extension install github/gh-actions-lock --pin v0.2.0 gh actions-lock --version - # The repair chain without a gh actions-lock fix-mode pass (it drops - # records it cannot re-resolve). - export GH_BIN=gh - for s in relock-sha-keys complete-job-refs close-lock prune-stale check-lock-sync; do - (cd pb && { bash ../std-regen/scripts/$s.sh .github/workflows && echo "$s RC=0" || echo "$s RC=$?"; }) - done + # Full estate regen (gh actions-lock first, which also migrates the + # format to v0.0.3, then the repair chain). + export GH_BIN=gh REGEN_TOOLS="$PWD/std-regen/scripts" + source std-regen/scripts/regen-dependabot-locks.sh + outcome="$(regen_lock "$PWD/pb" || true)" + echo "OUTCOME=$outcome" + (cd pb && { bash ../std-regen/scripts/check-lock-sync.sh .github/workflows && echo "SYNC RC=0" || echo "SYNC RC=$?"; }) + head -5 pb/.github/workflows/actions.lock git -C pb status --porcelain echo "== the governance gate, as pinned by the repair branch ($STANDARDS_GATE_SHA)" (cd pb && ACTIONS_LOCK_VERIFIER="$PWD/../std-gate/scripts/update-actions-lock.sh" \ From df1d58d8a10387eff2424a7721e58e27039db330 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 17:01:38 +0000 Subject: [PATCH 5/8] ci(scratch): rerun full regen for panic-attack after re-pin (not for merge) Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 From a77edeccc0b2fb24f30c3d8e9cda850b0d2b53b8 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 17:03:20 +0000 Subject: [PATCH 6/8] ci(scratch): regenerate panic-attack's lock from scratch (not for merge) Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- .github/workflows/zz-one-off-lock-regen.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/zz-one-off-lock-regen.yml b/.github/workflows/zz-one-off-lock-regen.yml index 6f0aadf2..b0d6a6bb 100644 --- a/.github/workflows/zz-one-off-lock-regen.yml +++ b/.github/workflows/zz-one-off-lock-regen.yml @@ -35,6 +35,9 @@ jobs: # Full estate regen (gh actions-lock first, which also migrates the # format to v0.0.3, then the repair chain). export GH_BIN=gh REGEN_TOOLS="$PWD/std-regen/scripts" + # Start from no lock: main's pins v1 at a commit the tag no longer + # names, which gh actions-lock rejects as a conflicting target. + rm -f pb/.github/workflows/actions.lock source std-regen/scripts/regen-dependabot-locks.sh outcome="$(regen_lock "$PWD/pb" || true)" echo "OUTCOME=$outcome" From c585d67f8a4b0e59fdb577fcc1890dc210297c44 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 17:03:30 +0000 Subject: [PATCH 7/8] ci(scratch): print the regenerated lock (not for merge) Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- .github/workflows/zz-one-off-lock-regen.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/zz-one-off-lock-regen.yml b/.github/workflows/zz-one-off-lock-regen.yml index b0d6a6bb..1550897c 100644 --- a/.github/workflows/zz-one-off-lock-regen.yml +++ b/.github/workflows/zz-one-off-lock-regen.yml @@ -48,6 +48,6 @@ jobs: (cd pb && ACTIONS_LOCK_VERIFIER="$PWD/../std-gate/scripts/update-actions-lock.sh" \ bash ../std-gate/scripts/check-actions-lock-gate.sh .github/workflows); echo "GATE_RC=$?" echo "LOCK-SHA256 $(sha256sum < pb/.github/workflows/actions.lock | cut -d' ' -f1)" - echo "DIFF-BEGIN" - git -C pb diff -- .github/workflows/actions.lock - echo "DIFF-END" + echo "LOCK-BEGIN" + cat pb/.github/workflows/actions.lock + echo "LOCK-END" From bc0ee87ee95fe6c5f06d695674e32970b11b173f Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 17:08:53 +0000 Subject: [PATCH 8/8] ci(scratch): seed a fresh lock with gh actions-lock before the repair chain (not for merge) Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- .github/workflows/zz-one-off-lock-regen.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/zz-one-off-lock-regen.yml b/.github/workflows/zz-one-off-lock-regen.yml index 1550897c..a66359d9 100644 --- a/.github/workflows/zz-one-off-lock-regen.yml +++ b/.github/workflows/zz-one-off-lock-regen.yml @@ -38,6 +38,8 @@ jobs: # Start from no lock: main's pins v1 at a commit the tag no longer # names, which gh actions-lock rejects as a conflicting target. rm -f pb/.github/workflows/actions.lock + (cd pb && { gh actions-lock >&2 || echo "seed gh actions-lock RC=$?"; }) + test -f pb/.github/workflows/actions.lock && echo SEEDED source std-regen/scripts/regen-dependabot-locks.sh outcome="$(regen_lock "$PWD/pb" || true)" echo "OUTCOME=$outcome"