Repository navigation
CI: pre-existing reds on main since 5e75753 (lock drift, startup_failure ×4, unnamed runs ×3) #211
Description
Context
Since 5e75753 (2026-09-28), these workflows have been red on main and on every PR head. #209 fixes only CodeQL: it re-keys codeql.yml's actions.lock entry, and CodeQL is the only required check. The rest are pre-existing. #209 introduces none of them.
The table below was measured on 2026-10-01. It compares main 5e75753, the #209 head 39081ec, and the unrelated PR branch docs/signing-policy-d218.
| Workflow | Conclusion | Likely cause |
|---|---|---|
| chapel-ci, Dogfood Gate, Dependency Review, bridge-gate | startup_failure |
Probably the same class as CodeQL: an actions.lock entry that is stale against the workflow's refs. gh actions-lock --no-fix --json reports 58 repo errors after #209. |
.github/workflows/{cargo-audit,coverage,release}.yml |
failure, and the run has no workflow name |
The file does not parse, or the run is refused before it is named. |
| Governance (Workflow security linter, Actions lockfile verify) | failure |
Lock drift and linter findings. |
| Secret Scanner (gitleaks) | failure |
Needs triage. |
| Rust CI (clippy, fmt) | failure on main |
Needs triage. |
Acceptance criteria
-
gh actions-lock --no-fix --jsonreports 0 errors. Edit the lock by hand:gh actions-lockwrite mode de-pins SHAs and corrupts local action refs. - No workflow on
mainends instartup_failure. - cargo-audit, coverage and release each run under their
name:. - Each remaining red is either fixed, or has its own issue with a reason.
🤖 Generated with Claude Code
Activity
fix(ci): SHA-pin scan-and-report steps so sha_pinning callers can sta…