Follow-ups: link check, digest/SHA pins, licence review worksheet (stacked on #2)

.github/workflows/ci.yml

@@ -9,8 +9,8 @@ jobs:
     name: Catalog integrity
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with: {python-version: '3.12'}
       - run: pip install -r requirements.txt
       - name: Schema, duplicates, licences, evidence, no submodules
@@ -25,13 +25,13 @@ jobs:
     name: Docs build + internal links
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with: {python-version: '3.12'}
       - run: pip install -r requirements.txt
       - run: mkdocs build --strict -d _check/Open-Source-Ai
       - name: Internal links (blocking)
-        uses: lycheeverse/lychee-action@v2
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
         with:
           args: --offline --no-progress --index-files index.html --root-dir ${{ github.workspace }}/_check --remap 'https://codesbyfebin.github.io/Open-Source-Ai file://${{ github.workspace }}/_check/Open-Source-Ai' --exclude-path _check/Open-Source-Ai/404.html '_check/**/*.html'
           fail: true
@@ -40,10 +40,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with: {python-version: '3.12'}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with: {node-version: '20'}
       - run: pip install -r requirements.txt
       - run: mkdocs build --strict -d _site/Open-Source-Ai
@@ -52,29 +52,19 @@ jobs:
       - working-directory: tests/browser
         run: npx playwright test
       - if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: playwright-results
           if-no-files-found: ignore
           path: |
             tests/browser/results.json
             tests/browser/test-results
-  upstream-links:
-    name: Upstream links (non-blocking)
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@v4
-      - uses: lycheeverse/lychee-action@v2
-        with:
-          args: --no-progress --max-retries 3 --max-concurrency 8 --accept 200,206,429 --exclude localhost --exclude codesbyfebin.github.io README.md CREDITS.md 'docs/**/*.md' 'recipes/**/*.md'
-          fail: true
   recipe-local-chat:
     name: Recipe smoke test – local-chat
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Validate both recipe compose files
         run: |
           docker compose -f recipes/local-chat/docker-compose.yml config --quiet

.github/workflows/links.yml

@@ -0,0 +1,68 @@
+name: Upstream links
+# Non-blocking: external sites can be flaky. Checks every upstream repo, licence and setup URL
+# in the catalog plus links in README/docs/recipes. On scheduled runs, failures open/update an issue.
+on:
+  push: {branches: [main]}
+  pull_request:
+  schedule: [{cron: '30 3 * * 1'}]   # weekly, Monday 03:30 UTC
+  workflow_dispatch:
+permissions: {contents: read}
+jobs:
+  lychee:
+    name: Upstream links (non-blocking)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    continue-on-error: true
+    permissions: {contents: read, issues: write}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with: {python-version: '3.12'}
+      - run: pip install -r requirements.txt && python scripts/upstream_links.py
+      - name: Check links
+        id: lychee
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
+        with:
+          token: ${{ github.token }}
+          fail: false
+          format: json
+          output: _links/report.json
+          args: >-
+            --no-progress --max-concurrency 8 --max-retries 4 --retry-wait-time 5 --timeout 30
+            --accept '200..=206'
+            --exclude 'localhost|127\.0\.0\.1|codesbyfebin\.github\.io'
+            _links/upstream.md README.md CREDITS.md 'docs/**/*.md' 'recipes/**/*.md'
+      - name: Summarise
+        id: sum
+        run: |
+          python3 - <<'PY'
+          import json, os
+          r = json.load(open("_links/report.json"))
+          keys = ("total", "successful", "errors", "timeouts", "redirects", "excludes", "unknown", "cached")
+          stats = {k: r.get(k, 0) for k in keys}
+          lines = ["## Upstream link check", "", "| " + " | ".join(keys) + " |", "|" + "---|" * len(keys), "| " + " | ".join(str(stats[k]) for k in keys) + " |", ""]
+          for src, errs in sorted((r.get("error_map") or r.get("fail_map") or {}).items()):
+              for e in errs:
+                  lines.append(f"- `{src}`: {e.get('url')} – {e.get('status', {}).get('text') if isinstance(e.get('status'), dict) else e.get('status')}")
+          out = "\n".join(lines) + "\n"
+          open("_links/summary.md", "w").write(out)
+          open(os.environ["GITHUB_STEP_SUMMARY"], "a").write(out)
+          bad = stats["errors"] + stats["timeouts"]
+          open(os.environ["GITHUB_OUTPUT"], "a").write(f"bad={bad}\ntotal={stats['total']}\n")
+          print(out)
+          PY
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: always()
+        with: {name: upstream-link-report, path: _links/}
+      - name: Open or update issue (scheduled runs only)
+        if: github.event_name == 'schedule' && steps.sum.outputs.bad != '0'
+        env: {GH_TOKEN: '${{ github.token }}'}
+        run: |
+          n=$(gh issue list --label link-check --state open --json number -q '.[0].number')
+          body="$(cat _links/summary.md)
+
+          Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          if [ -n "$n" ]; then gh issue comment "$n" --body "$body"; else gh issue create --title "Upstream link check failures" --label link-check --body "$body" || gh issue create --title "Upstream link check failures" --body "$body"; fi
+      - name: Mark job failed when links are broken (still non-blocking)
+        if: steps.sum.outputs.bad != '0'
+        run: exit 1

.github/workflows/pages.yml

@@ -8,17 +8,17 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with: {python-version: '3.12'}
       - run: pip install -r requirements.txt
       - run: mkdocs build --strict
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
         with: {path: site}
   deploy:
     needs: build
     runs-on: ubuntu-latest
     environment: {name: github-pages, url: "${{ steps.d.outputs.page_url }}"}
     steps:
       - id: d
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

.github/workflows/recipe-agent-memory.yml

@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 40
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with: {python-version: '3.12'}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with: {node-version: '22'}
       - run: pip install -r recipes/agent-memory-eval/requirements.txt
       - run: ./recipes/agent-memory-eval/smoke.sh

.github/workflows/refresh.yml

@@ -10,12 +10,12 @@ jobs:
     timeout-minutes: 20
     permissions: {contents: write, pull-requests: write}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with: {persist-credentials: false}
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with: {python-version: '3.12'}
       - run: pip install -r requirements.txt
-      - uses: actions/cache@v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .cache/etags.json
           key: etags-${{ github.run_id }}
@@ -31,11 +31,11 @@ jobs:
       - name: Mint GitHub App token (optional)
         id: app
         if: ${{ vars.OSA_APP_ID != '' }}
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
         with:
           app-id: ${{ vars.OSA_APP_ID }}
           private-key: ${{ secrets.OSA_APP_PRIVATE_KEY }}
-      - uses: peter-evans/create-pull-request@v7
+      - uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
         with:
           token: ${{ steps.app.outputs.token || github.token }}
           branch: bot/evidence-refresh

.gitignore

@@ -4,3 +4,4 @@ __pycache__/
 .venv/
 _check/
 _site/
+_links/

CHANGELOG.md

@@ -4,6 +4,10 @@ Catalog changes are recorded here. Evidence refreshes are listed by their pull r
 
 ## Unreleased
 
+- Upstream link check moved to its own workflow: checks all 140 unique upstream repo/licence/setup URLs plus docs links with a GitHub token, publishes a report artifact, and opens/updates an issue on scheduled failures (still non-blocking).
+- Ollama models pinned by manifest digest (`recipes/*/models.lock`), verified after pull; all GitHub Actions pinned to commit SHAs.
+- Added Licence Review Worksheet (`docs/licence-review.md`) for the 15 needs-review entries.
+
 - Licences: 15 projects now `needs-review`, each with a recorded `review_reason` (adds Phoenix, Trylon Gateway, llamafile and three AgentDomains repos: source-available or undetected). OpenMemory and PR-Agent re-verified as MIT from their LICENSE files.
 - Collector: failed / rate-limited lookups are reported as failed and keep previous evidence; records `moved` and `fetch_status`. Validator: moved repo and GitHub licence mismatch are errors; zone-aware date checks.
 - Unit tests (collector, validator, build) and Playwright browser tests (Chromium + WebKit, desktop and iPhone 13 emulation, axe-core).

CONTRIBUTING.md

@@ -76,3 +76,9 @@ PRs created with the default `GITHUB_TOKEN` **do not trigger** other workflows (
 **Option B – manual fallback (no setup):** open the PR, then either close and reopen it, or run *CI* via *Actions → CI → Run workflow* on the `bot/evidence-refresh` branch. Merge only when blocking checks are green.
 
 The refresh job never pushes to `main`, uses no `pull_request_target`, and the collection step runs before any write token is minted.
+
+## Pinned dependencies
+
+- **GitHub Actions** are pinned to full commit SHAs with the version in a comment (`uses: owner/action@<sha> # vX.Y.Z`). To update, resolve the new tag's commit (`gh api repos/<owner>/<action>/commits/<tag> -q .sha`) and change both.
+- **Ollama models** are pinned by manifest digest in `recipes/<recipe>/models.lock`. Get a digest with `curl -fsSL -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' https://registry.ollama.ai/v2/library/<name>/manifests/<tag> | sha256sum`.
+- **Upstream link check** (`.github/workflows/links.yml`) is non-blocking; on scheduled runs it opens or comments on an issue labelled `link-check`.

CREDITS.md

@@ -1,7 +1,7 @@
 <!-- GENERATED by scripts/build.py from catalog/. Do not edit by hand. -->
 # Credits & Licences
 
-Open Source Ai's own content is MIT-licensed © CodesbyFebin. Catalogued projects are not included in this repository; each is governed by its upstream licence, which is authoritative. Entries marked **needs review** have custom, multiple or undetected licences – read the upstream terms before use.
+Open Source Ai's own content is MIT-licensed © CodesbyFebin. Catalogued projects are not included in this repository; each is governed by its upstream licence, which is authoritative. Entries marked **needs review** have custom, multiple, source-available or undetected licences – read the upstream terms before use. Quoted clauses and open questions: [Licence Review Worksheet](docs/licence-review.md).
 
 | Project | Upstream | Licence | State | Checked |
 |---|---|---|---|---|

docs/credits.md

@@ -1,7 +1,7 @@
 <!-- GENERATED by scripts/build.py from catalog/. Do not edit by hand. -->
 # Credits & Licences
 
-Open Source Ai's own content is MIT-licensed © CodesbyFebin. Catalogued projects are not included in this repository; each is governed by its upstream licence, which is authoritative. Entries marked **needs review** have custom, multiple or undetected licences – read the upstream terms before use.
+Open Source Ai's own content is MIT-licensed © CodesbyFebin. Catalogued projects are not included in this repository; each is governed by its upstream licence, which is authoritative. Entries marked **needs review** have custom, multiple, source-available or undetected licences – read the upstream terms before use. Quoted clauses and open questions: [Licence Review Worksheet](licence-review.md).
 
 | Project | Upstream | Licence | State | Checked |
 |---|---|---|---|---|