Skip to content

Claude/new session th4e9w lockregen #441

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 8 commits into from
Oct 19, 2026
Merged

Claude/new session th4e9w lockregen #441

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
52b9aa7
ci(scratch): one-off actions.lock regeneration for main (not for merge)
claude Oct 19, 2026
09269e2
ci(scratch): close-lock only, print the diff (not for merge)
claude Oct 19, 2026
0d3645c
ci(scratch): regenerate panic-attack's fix-branch lock from here (not…
claude Oct 19, 2026
ea3cf82
ci(scratch): full regen for panic-attack's lock (not for merge)
claude Oct 19, 2026
df1d58d
ci(scratch): rerun full regen for panic-attack after re-pin (not for …
claude Oct 19, 2026
a77edec
ci(scratch): regenerate panic-attack's lock from scratch (not for merge)
claude Oct 19, 2026
c585d67
ci(scratch): print the regenerated lock (not for merge)
claude Oct 19, 2026
bc0ee87
ci(scratch): seed a fresh lock with gh actions-lock before the repair…
claude Oct 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 55 additions & 0 deletions .github/workflows/zz-one-off-lock-regen.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
# SPDX-License-Identifier: MPL-2.0
# ONE-OFF, scratch branch only, deleted after use. Regenerates panic-attack's fix branch's
# actions.lock with the estate repair order (regen_lock in
# standards/scripts/regen-dependabot-locks.sh), runs the governance gate's own
# check against the result, and prints the lock base64-encoded. It has no
# `uses:` steps, so it needs no lock entry to start. It writes nothing back:

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Register the new workflow in actions.lock

This repository enforces lock coverage by workflow path, including dependency-free workflows: the existing lock contains empty entries for label-triage.yml and labels.yml, and those workflows document that an unlisted path is rejected with startup_failure. This commit adds zz-one-off-lock-regen.yml without adding its empty entry to .github/workflows/actions.lock, so the push intended to launch this one-off can be rejected before the job starts; having no uses: steps only means the entry has no dependencies, not that the path can be omitted.

Useful? React with 👍 / 👎.

# the lock reaches the repository in a reviewed PR.
name: one-off actions.lock regeneration
on:
push:
branches: [claude/new-session-th4e9w-lockregen]
permissions:
contents: read
jobs:
regen:
runs-on: ubuntu-latest
timeout-minutes: 20
env:
GH_TOKEN: ${{ github.token }}
REPO: hyperpolymath/panic-attack
STANDARDS_REGEN_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7
STANDARDS_GATE_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7
steps:
- name: Regenerate the repair branch's actions.lock and check it with the gate
run: |
set -uo pipefail
git clone --quiet --branch claude/new-session-th4e9w https://github.com/hyperpolymath/panic-attack.git pb
git -C pb log --oneline -1
git clone --quiet https://github.com/hyperpolymath/standards.git std
git -C std worktree add --quiet --detach ../std-regen "$STANDARDS_REGEN_SHA"
git -C std worktree add --quiet --detach ../std-gate "$STANDARDS_GATE_SHA"
sudo apt-get install -y -qq gawk >/dev/null
gh extension install github/gh-actions-lock --pin v0.2.0
gh actions-lock --version
# Full estate regen (gh actions-lock first, which also migrates the
# format to v0.0.3, then the repair chain).
export GH_BIN=gh REGEN_TOOLS="$PWD/std-regen/scripts"
# Start from no lock: main's pins v1 at a commit the tag no longer
# names, which gh actions-lock rejects as a conflicting target.
rm -f pb/.github/workflows/actions.lock
(cd pb && { gh actions-lock >&2 || echo "seed gh actions-lock RC=$?"; })

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Avoid mutating workflows when exporting only the lock

When the target branch contains broad refs such as the @v1 reference mentioned above or local ./ actions, this unqualified fix run can rewrite the checked-out workflow files while generating the lock; the upstream tool documents that fix runs migrate local-action references by default, and v0.2.0 also narrows resolvable refs (gh-actions-lock usage, v0.2.0 release). The later gate consequently validates the rewritten working tree, but this job emits only actions.lock, so copying that payload into the unchanged repair branch can produce a lock that no longer matches its workflows. Disable these rewrites (for example with the tool's no-narrow/no-migration options) or emit and transfer every workflow change as well.

Useful? React with 👍 / 👎.

test -f pb/.github/workflows/actions.lock && echo SEEDED
source std-regen/scripts/regen-dependabot-locks.sh
outcome="$(regen_lock "$PWD/pb" || true)"
echo "OUTCOME=$outcome"
(cd pb && { bash ../std-regen/scripts/check-lock-sync.sh .github/workflows && echo "SYNC RC=0" || echo "SYNC RC=$?"; })
head -5 pb/.github/workflows/actions.lock
git -C pb status --porcelain
echo "== the governance gate, as pinned by the repair branch ($STANDARDS_GATE_SHA)"
(cd pb && ACTIONS_LOCK_VERIFIER="$PWD/../std-gate/scripts/update-actions-lock.sh" \
bash ../std-gate/scripts/check-actions-lock-gate.sh .github/workflows); echo "GATE_RC=$?"
Comment on lines +50 to +51

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve the lock output when the gate rejects it

When the generated lock fails the governance gate, the default GitHub Actions Bash shell still has errexit enabled, and set -uo pipefail does not disable it. A nonzero gate result therefore terminates the step at this subshell, so GATE_RC, the hash, and the LOCK-BEGIN payload are never printed—preventing inspection of the generated lock in exactly the failure case this diagnostic workflow needs to expose. Capture the status through an if or || branch before continuing.

Useful? React with 👍 / 👎.

echo "LOCK-SHA256 $(sha256sum < pb/.github/workflows/actions.lock | cut -d' ' -f1)"
echo "LOCK-BEGIN"
cat pb/.github/workflows/actions.lock
echo "LOCK-END"
Loading