[hyperpolymath]

fix(ci): reconcile the workflows with actions.lock (gh-actions-lock v0.1.6)

actions.lock is authoritative: the workflows carry readable refs and the lock records the
commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest
make the whole repository unstartable — startup_failure, "Invalid lockfile".

Regenerated with the official extension (github/gh-actions-lock). The hand-pinned SHA refs are
reverted to their readable form here precisely because the lockfile, not the workflow, is what
pins them.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Free

Run ID: e728480b-2fa0-4fe1-b7c3-efbd591ddec0

📥 Commits

Reviewing files that changed from the base of the PR and between 9dc4b58 and 0156f83.

📒 Files selected for processing (25)

• .github/workflows/ci.yml
• .github/workflows/codeql.yml
• .github/workflows/dependabot-automerge.yml
• .github/workflows/dogfood-gate.yml
• .github/workflows/estate-rules.yml
• .github/workflows/governance.yml
• .github/workflows/guix-nix-policy.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/instant-sync.yml
• .github/workflows/label-triage.yml
• .github/workflows/labels.yml
• .github/workflows/mirror.yml
• .github/workflows/openssf-compliance.yml
• .github/workflows/pages.yml
• .github/workflows/quality.yml
• .github/workflows/release.yml
• .github/workflows/rhodibot.yml
• .github/workflows/runtime-policy.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml
• .github/workflows/security-policy.yml
• .github/workflows/static-analysis-gate.yml
• .github/workflows/trope-check.yml
• .github/workflows/wellknown-enforcement.yml
• .github/workflows/workflow-linter.yml

 _________________________
< I am the bug whisperer. >
 -------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

---

Note

🎁 Summarized by CodeRabbit Free

The PR author is not assigned a seat. If you are a newly provisioned user and your organization has automatic seat assignment enabled, open a new pull request to trigger seat assignment. Otherwise, ask an organization administrator to assign a seat through the team management page at https://app.coderabbit.ai/settings/team-management.

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE