[hyperpolymath]

fix(ci): reconcile the workflows with actions.lock (gh-actions-lock v0.1.6)

actions.lock is authoritative: the workflows carry readable refs and the lock records the
commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest
make the whole repository unstartable — startup_failure, "Invalid lockfile".

Regenerated with the official extension (github/gh-actions-lock). The hand-pinned SHA refs are
reverted to their readable form here precisely because the lockfile, not the workflow, is what
pins them.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 4230f396-2213-45c0-b5be-4b04c4e63027

📥 Commits

Reviewing files that changed from the base of the PR and between 2c98910 and b0c1b0d.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• .github/workflows/release.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (5)

• GitHub Check: Live TLS handshake canary (gmail:465)
• GitHub Check: E2E delivery vs containerized sink
• GitHub Check: Unit tests + release targets
• GitHub Check: FSM drift gate (spec is source of truth)
• GitHub Check: Analyze (actions)

🧰 Additional context used

🪛 zizmor (1.30.0)

.github/workflows/release.yml

[warning] 25-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[error] 25-25: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

.github/workflows/ci.yml

[warning] 25-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[error] 25-25: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

---

[warning] 49-49: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[error] 49-49: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

---

[warning] 67-67: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[error] 67-67: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

---

[warning] 120-120: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[error] 120-120: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🔇 Additional comments (2)

.github/workflows/ci.yml (1)

1-1: LGTM!

Also applies to: 25-25, 49-49, 67-67, 120-120

.github/workflows/release.yml (1)

1-1: LGTM!

Also applies to: 25-25

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated automated workflow configuration to use the specified checkout action version.
  • Added workflow management markers for easier maintenance.
  • Existing testing, drift checks, end-to-end checks, TLS canaries, and release workflow behaviour remain unchanged.

Walkthrough

The CI and release workflows add gh actions-lock management comments. They change actions/checkout references from the pinned v7.0.1 commit SHA to the v7.0.1 tag. Job behaviour remains unchanged.

Changes

Workflow updates

Layer / File(s)	Summary
Checkout references and workflow markers .github/workflows/ci.yml, .github/workflows/release.yml	Both workflows add management comments. The CI workflow updates four checkout references. The release workflow updates one checkout reference.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the CI workflow changes and their reconciliation with actions.lock.
Description check	✅ Passed	The description explains the actions.lock mismatch, the workflow reference changes, and the resulting startup_failure and Invalid lockfile errors.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow trail
Tags now guide each checkout tale
Four CI steps hop in line
Release follows the same sign
The lock marker keeps watch fine}

_{Comment @coderabbitai help to get the list of available commands.}