[groupthinking]

Merged — approved lockfile pilot, 2026-10-29

This PR locks the Actions dependencies of .github/workflows/dependency-review.yml and ensures future actions.lock-only changes reach Dependency Review. It preserves main's full-tree scans, complete npm/uv lock snapshots, graph-drift checks, evidence retention, timeouts and license/advisory policy.

Head: 854c4050ee9189b2665051615cab374416376cfb. Base reviewed: 0c99258342fa862e6bb1b38f8dc819879bf83175. Three changed files: workflow, generated Actions lock, workflow regression tests. The temporary generator is removed. Merged after Hayden's explicit approval at f258db8a6cc38c064ba4d7ca1baee02bedbd0534; merge tree matches the tested head exactly. Verified merge receipt. The validation and prior approval-blocker statements below describe the pre-merge checkpoint.

Closes #2448. Security prerequisite #2456 is merged; #2459 is not being reopened.

October 29 repair and acceptance

Fresh GitHub state reported the old head 5cd469a as conflicting. A local merge reproduced conflicts in the workflow and its tests. The repair preserves main's scanner v0.2.0, four-minute pip bound, complete lock-snapshot submission and graph checks, while retaining the exact Actions lockfile detector and gh-aw exclusions. Existing tests now resolve the generated lock to verify the same required commit hashes rather than assuming literal YAML SHA syntax.

• Official generator run 40831953764, source 3c4d90c25ea2dec4dd613fd30c6eea0bdf68b32c: generation, local coverage, online verification, missing-reference negative test, restoration and scoped changes all passed.
• Final generated lock SHA-256: 7c730cc452c55360d3d66aee401dd5a072d57f5cb32fb9a48930f7407628018f.
• Final workflow SHA-256: c3fd17377d2fc3d699ca665f60c6bc25d4aabed56539fc380d49d650ec8903cb.
• Exact bytes read back from hosted logs and hash-checked locally. Final tree: cd0624feea45849ca6d358927f5feb8d26d204f8.
• Python3.12 focused suite: 23 passed; Ruff, Black, diff check and official offline lock coverage passed.
• Final-head CI40832081768, Dependency Review40832081709, coverage, E2E, CodeQL and security jobs completed successfully. Observed31 checks:28 success,3 intentional skips (two Dependabot jobs and CodeRabbit), zero pending/failing.
• Python3.11 and Python3.12 each:2,988 passed,9 deselected,5 xpassed,118 subtests; separate security suite38 passed/20 subtests. All23 workflow regressions passed in each matrix job.
• Hosted Dependency Review logs explicitly report native locked action execution and all four expected commits. Complete snapshot115686538 submitted4 manifests/2,172 packages; unchanged advisory/license checks passed.
• Trivy completed as a report-only scan inherited from main, not a clean-image acceptance. Its report still contains high/critical findings (239 OS,33 Node,5 Python entries;3 critical entries total). Existing remediation is tracked in Bootstrap Trivy remediation while retaining exact scan evidence #2478 and Triage image findings despite successful Trivy job #2396; this pilot makes no risk exception or image-safety claim.
• Review thread is resolved; no approving review or exact merge authorization was found. All results apply to the head above; re-fetch before any approved merge.

Locked graph

Action	Ref	Executed commit
actions/checkout	v7.0.1	3d3c42e5aac5ba805825da76410c181273ba90b1
actions/dependency-review-action	v5.0.0	a1d282b36b6f3519aa1f3fc636f609c47dddb294
actions/upload-artifact	v7.0.1	043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
advanced-security/component-detection-dependency-submission-action	v0.2.0	a02aeda7a175ad4dd38a13c4d3ff2df9da8f2cf0

The additional upload-artifact action and scanner update come from current main; the generated graph preserves those exact commits.

Current official evidence, access and cost

GitHub's October28 GA announcement explicitly includes Free, Team, Enterprise Cloud and data-residency plans. The setup guide still displays Enterprise Cloud only; retain that documentation discrepancy. Concept documentation describes locked commits and repository identity; reusable workflows and other build inputs are outside its protection. Locking does not establish upstream code safety.

Official CLI v0.4.0 Linux-amd64 SHA-256: f9da98f2a6e9e0ae77deadf9a2319a8a86bb002b541cc3203b247cc59fb04842. Local generation could not authenticate; the existing safe alternative used a standard Ubuntu job in this public repository with only contents:read and its runner-issued token. No connector credential was exported. The generator uploaded no artifacts. Billing: standard public-repository hosted runners are free; artifact storage and larger runners have separate billing. Existing final workflow evidence upload is inherited from main.

Repeatable bounded recipe

Prerequisites: clean checkout of this exact head, Python3.11 or3.12 with pytest/pytest-asyncio/PyYAML, GitHub CLI and official actions-lock0.4.0; online verification needs authorized upstream read access.

1. Check out 854c4050ee9189b2665051615cab374416376cfb.
2. Run focused behavior tests:

   PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python -m pytest -q -o addopts= -p pytest_asyncio.plugin --confcutdir=tests/unit tests/unit/test_dependency_review_workflow.py
   gh actions-lock --verify-local .github/workflows/dependency-review.yml
   gh actions-lock --verify .github/workflows/dependency-review.yml
   git diff --check

   Expected:23 tests pass, one workflow has complete local coverage, online checks pass. Local coverage alone does not prove trusted pins or hosted enforcement.
3. In a disposable checkout only, replace checkout's ref with v0.0.0-pilot-missing; local verification must exit1. Restore the exact workflow and require exit0.
4. If dependencies changed, inspect their upstream revisions and run gh actions-lock --no-interactive .github/workflows/dependency-review.yml; review generated files. Never hand-edit the lock or use moved-ref exceptions unattended.
5. Before any approved merge, re-fetch current head, checks, reviews, unresolved threads and mergeability, then use expected-head protection and record the merge commit.

**ESTIMATE:**15–30 minutes to repeat/review; not measured savings. Possible deliverable: supervised workflow provenance audits for software teams; revenue remains a hypothesis. Rollback before merge: revert only this pilot's branch changes; after an approved merge, use a reviewed revert preserving unrelated main fixes.

Audit and limits

Interim dependency-review startup failure occurred with the stale pre-regeneration lock; it is superseded, not waived. After generation two literal-ref assertions failed; resolving the generated pins preserved their exact SHA expectations and all23 tests passed. Local Python3.11 was unavailable; hosted matrix remains the verification source. No new provider calls, production deployment, permission/license exception or merge was initiated. Canonical ledger action156; prior receipt remains historical.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Oct 29, 2026 6:55am UTC

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: groupthinking/EventRelay
• Branch: test/actions-lock-dependency-review
• File: .coderabbit.yaml
• Commit: 854c405
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 61bbc1d8-525f-4939-b54d-6516bff6a784

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	7.0.1	🟢 5.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
actions/actions/dependency-review-action	5.0.0	🟢 7.7	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 9 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches SAST 🟢 9 SAST tool detected but not run on all commits
actions/actions/upload-artifact	7.0.1	🟢 5.5	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Maintained 🟢 3 4 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3 Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches
actions/advanced-security/component-detection-dependency-submission-action	0.2.0	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/3 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• .github/workflows/dependency-review.yml

[Copilot]

🟡 Changes recommended

Lockfile-only updates are not recognized by dependency-change detection and would skip the dependency-review gate.

1 open issue

• Detect actions.lock as a dependency input · New

What changed in this PR

This PR pilots GitHub Actions dependency locking for EventRelay’s dependency-review workflow, adding recorded action commits and repository identities without changing its existing jobs or policies.

Changes:

• Adds a generated lockfile covering one workflow and three actions.
• Updates three action references to exact version tags backed by the lockfile.
• Preserves the security fixes inherited from merged PR #2456 and leaves separate gh-aw lock formats unchanged.

File	Description
.github/​workflows/​dependency-review.yml	Uses exact action version tags matching the locked graph.
.github/​workflows/​actions.lock	Records action commits and owner/repository identities.

_{Review effort: Balanced}

[groupthinking]

TEST — conflict repair and final-head verification, 2026-10-29

Owner: groupthinking / MCP Strategic Watch. Ledger action156.

Implemented and VERIFIED: reconciled this existing pilot with main 0c99258342fa862e6bb1b38f8dc819879bf83175, preserving full snapshot submission, graph-drift guards, security/license policy, timeout bounds and gh-aw exclusions. Regenerated only the selected workflow with official actions-lock0.4.0. Three final changed files; temporary generator removed.

Published: 854c4050ee9189b2665051615cab374416376cfb, tree cd0624feea45849ca6d358927f5feb8d26d204f8. Expected-head fast-forward updates used; no force-push.

• Generator/online verification/negative test: PASS; invalid ref rejected then restoration verified.
• CI: PASS. Python3.11 and3.12 each2,988 passed,9 deselected,5 xpassed,118 subtests; separate security suite38 passed/20 subtests. All23 workflow regressions passed on both.
• Dependency Review: PASS. Logs explicitly confirm native lock execution for all four expected commits; complete snapshot115686538 contains4 manifests/2,172 packages.
• Coverage, E2E, CodeQL, frontend/build and security job completion: PASS. At check,31 checks=28success/3skipped/0pending/0failed. Skips: two Dependabot jobs and CodeRabbit.
• Review thread resolved; no approving review or exact-PR/head merge authorization found.
• Trivy is inherited report-only: successful job does not mean clean image. Existing findings/remediation remain Bootstrap Trivy remediation while retaining exact scan evidence #2478/Triage image findings despite successful Trivy job #2396, including3 scanner-reported critical entries on this image.

Complete current recipe, official evidence, access/cost constraints and rollback. Effort to repeat: ESTIMATE15–30minutes, not measured savings. Workflow benefit: deterministic reviewed action commits; possible CI provenance service revenue remains a hypothesis.

Remaining: merge is BLOCKED on Hayden's explicit approval of PR#2460 or this exact head. Then re-fetch head/checks/reviews/threads/mergeability and use expected-head protection; record actual merge commit. No production deployment or live-provider acceptance is claimed. Existing Watch remains enabled; next execution timestamp returned null (UNKNOWN), and no duplicate timer was created.

Historical interim lock startup failure and two literal-ref test failures were repaired and retained in the audit trail. Earlier green old-head results were not reused as current proof.

[linear-code]

GRV-862

[groupthinking]

Approved merge verified — 2026-10-29

Hayden explicitly approved PR #2460 in the conversation following the request identifying this PR and head 854c4050ee9189b2665051615cab374416376cfb.

Executed: expected-head protected merge; GitHub returned merged=true at f258db8a6cc38c064ba4d7ca1baee02bedbd0534, merged at2026-10-29T17:42:09Z (12:42:09PM America/Chicago).
Fetched and verified: parents are prior main 0c99258342fa862e6bb1b38f8dc819879bf83175 and approved head 854c4050ee9189b2665051615cab374416376cfb; merge tree cd0624feea45849ca6d358927f5feb8d26d204f8 exactly equals the tested head tree. PR is closed/merged and #2448 automatically closed as completed.

Pre-merge checks were freshly fetched:34 checks (31success,3skipped), both external commit statuses success, zero pending/failing. Active main ruleset24057160 required issue-closer check passed; no bypass actors or override used. Legacy branch-protection detail returned403 due connector access, but branch summary and active ruleset were read successfully. One review thread was resolved; no CHANGES_REQUESTED reviews; mergeability true/clean. Expected-head SHA protected against races.

This completes the approved lockfile pilot integration. Earlier test/repair evidence and runnable recipe remains historical proof for the exact tree.

Automatic post-merge workflows started, including CI40923845147 and Dependency Review40923844984; at this receipt those fresh runs are IN PROGRESS, not yet claimed passed. No manual deployment or workflow dispatch was initiated. Existing main-push automation may interact with external services; production acceptance and external auto-deployment status are not inferred from this merge. Image findings #2478/#2396 and account applicability #2471 remain separate.

Canonical ledger action158; review follows readback.

[groupthinking]

Post-merge verification — 2026-10-30

Verified merge commit f258db8a6cc38c064ba4d7ca1baee02bedbd0534:

• CI, Dependency Review, Security, CodeQL, Coverage, and E2E completed successfully.
• Dependency Review attempts 1 and 2 both succeeded. Attempt 2 is not evidence of a repaired failure.
• Hosted job 123843863348 explicitly logged use of locked action versions and downloaded the pinned action SHAs. Complete lock snapshot submission returned snapshot 116116073, 4 manifests, 2,172 packages.

Scope of proof: the main-push snapshot and lock execution succeeded. PR-only comparison/evidence steps were skipped on this push; this is not a new PR comparison, vulnerability-free assertion, or production acceptance test. The six named runs were inspected individually; no claim is made that every repository automation was enumerated.

The approved #2448/#2460 pilot is integrated and its post-merge verification is complete. The separate identity/scope correction is already in draft #2515 for #2514; this run did not duplicate or merge that work. No deployment or paid provider call was initiated.