Automated sweep for lockfile version drift — the estate's recurring CI killer.
The fault. Dependabot bumps an action version in a workflow; actions.lock is not regenerated; the workflow then requests a version the lockfile does not record, and GitHub rejects the run at startup_failure with zero jobs — no log, no annotation. It is self-reinflicting, so affected repos recur.
To fix a listed repo: run gh actions-lock, then restore the SPDX header to line 1 (the tool restamps its banner above it and the workflow-security linter greps head -1 only).
Calibration: a listed row is a genuine inconsistency but is not proof that workflow is dead — some drift is survivable. The reliable direction is the converse: workflows that were dead had drifted entries.
Full list in the run's lockfile-drift-report.tsv artifact.
|
|
| scanned |
346 |
| carrying a lockfile |
133 |
| with drift |
25 |
| drifted entries |
173 |
Automated sweep for lockfile version drift — the estate's recurring CI killer.
The fault. Dependabot bumps an action version in a workflow;
actions.lockis not regenerated; the workflow then requests a version the lockfile does not record, and GitHub rejects the run atstartup_failurewith zero jobs — no log, no annotation. It is self-reinflicting, so affected repos recur.To fix a listed repo: run
gh actions-lock, then restore the SPDX header to line 1 (the tool restamps its banner above it and the workflow-security linter grepshead -1only).Calibration: a listed row is a genuine inconsistency but is not proof that workflow is dead — some drift is survivable. The reliable direction is the converse: workflows that were dead had drifted entries.
Full list in the run's
lockfile-drift-report.tsvartifact.