fix(ci): restore the required-check producers — allow-list, actions.lock gate, K9 pedigree - #108

Merged

hyperpolymath merged 21 commits into

mainfrom

arena/01a108d1-game-server-admin

Oct 5, 2026

Commits on Oct 4, 2026

fix(ci): get the workflows past the estate Actions allow-list

hyperpolymath
and
arena-agent
committed
43d94e7
chore(ci): gate actions.lock, and re-onboard it from scratch

hyperpolymath
and
arena-agent
committed
10dca37
chore(ci): give the lockfile gate a token, and surface tool stderr as annotations

hyperpolymath
and
arena-agent
committed
3694553
fix(ci): pin every action to a full commit SHA, and keep actions.lock

hyperpolymath
and
arena-agent
committed
e7a7d06
chore(ci): compute the relock decision in the shell, not in an if: expression

hyperpolymath
and
arena-agent
committed
fefd6e5
chore(ci): deliver the regenerated lockfile even when the tool still objects

hyperpolymath
and
arena-agent
committed
ded6629
chore(ci): make the relock job report which step failed

hyperpolymath
and
arena-agent
committed
cee8d63
chore(ci): capture git commit/push failures as annotations

hyperpolymath
and
arena-agent
committed
e19deae
chore(ci): the runner shell is bash -e, so set -uo pipefail never disabled errexit

hyperpolymath
and
arena-agent
committed
dbacd36
chore(ci): the relock push needs workflows: write, not just contents: write

hyperpolymath
and
arena-agent
committed
c94512f
chore(ci): deliver the regenerated lockfile without a GitHub App writing workflows

hyperpolymath
and
arena-agent
committed
85137e5
chore(ci): regenerate actions.lock from the current workflows

hyperpolymath
and
arena-agent
committed
78ffe83
chore(ci): key actions.lock by the SHA the workflows actually name

hyperpolymath
and
arena-agent
committed
e93bf1d
fix(ci): put the write permission on the job that writes, and audit egress

hyperpolymath
and
arena-agent
committed
00a3171
fix(ci): drop harden-runner from the gate rather than fake containment

hyperpolymath
and
arena-agent
committed
7a898fe
fix(ci): make the gate a pull-request gate so egress auditing is allowed

hyperpolymath
and
arena-agent
committed
7f67e21
chore(ci): regenerate actions.lock for harden-runner in the gate

hyperpolymath
and
arena-agent
committed
e683631
fix(ci): test haskell-actions/setup against the allow-list instead of assuming

hyperpolymath
and
arena-agent
committed
f0b1d21
chore(ci): temporary allow-list probe (deleted after it reports)

hyperpolymath
and
arena-agent
committed
a24b3a0
fix(ci): haskell-actions/setup is rejected too — restore the GHC installer

hyperpolymath
and
arena-agent
committed
a6a260e

Commits on Oct 5, 2026

docs(scripts): document fetch_verify download, checksum, and failure behavior
coderabbitai[bot]
committed
17b0751

Navigation Menu

Uh oh!

fix(ci): restore the required-check producers — allow-list, actions.lock gate, K9 pedigree - #108

fix(ci): restore the required-check producers — allow-list, actions.lock gate, K9 pedigree#108
hyperpolymath merged 21 commits into
mainfrom
arena/01a108d1-game-server-admin

Commits on Oct 4, 2026

fix(ci): get the workflows past the estate Actions allow-list

chore(ci): gate actions.lock, and re-onboard it from scratch

chore(ci): give the lockfile gate a token, and surface tool stderr as annotations

fix(ci): pin every action to a full commit SHA, and keep actions.lock

chore(ci): compute the relock decision in the shell, not in an if: expression

chore(ci): deliver the regenerated lockfile even when the tool still objects

chore(ci): make the relock job report which step failed

chore(ci): capture git commit/push failures as annotations

chore(ci): the runner shell is bash -e, so set -uo pipefail never disabled errexit

chore(ci): the relock push needs workflows: write, not just contents: write

chore(ci): deliver the regenerated lockfile without a GitHub App writing workflows

chore(ci): regenerate actions.lock from the current workflows

chore(ci): key actions.lock by the SHA the workflows actually name

fix(ci): put the write permission on the job that writes, and audit egress

fix(ci): drop harden-runner from the gate rather than fake containment

fix(ci): make the gate a pull-request gate so egress auditing is allowed

chore(ci): regenerate actions.lock for harden-runner in the gate

fix(ci): test haskell-actions/setup against the allow-list instead of assuming

chore(ci): temporary allow-list probe (deleted after it reports)

fix(ci): haskell-actions/setup is rejected too — restore the GHC installer

Commits on Oct 5, 2026

docs(scripts): document fetch_verify download, checksum, and failure behavior