[rishitank]

What changed

Deletes the reusable lockfile.yml workflow. CONTRIBUTING's Dependencies section now says to regenerate a lockfile by ticking lock file maintenance under "Awaiting Schedule" on the repo's Dependency Dashboard; for a package.json change on your own branch, run the package manager's install locally. The README drops the workflow's table row and the runner-selection exception for its commit job, and notes the dashboard checkbox next to "Lockfile maintenance is quarterly".

Why

Renovate already does this job, with less code and a smaller attack surface:

• default.json enables lockFileMaintenance, which deletes the lockfile, re-resolves and opens a PR. The dashboard's "Awaiting Schedule" checkbox runs it on demand (checked in Renovate's dependency-dashboard.ts).
• That PR runs node-ci.yml, whose npm ci / pnpm install --frozen-lockfile and build are the same proof lockfile.yml ran.
• Renovate disables package-manager scripts by default, and the Mend-hosted app never runs them (Renovate docs, ignoreScripts). So the write-token isolation that took lockfile.yml two jobs, an artifact and a hash check doesn't arise.

Nothing calls it. I checked every non-fork, non-archived repository on rishitank and TanksterAI (72 in all) and found no caller of rishitank/.github/.github/workflows/lockfile.yml. The only lockfile callers, TanksterAI/quarterdeck and TanksterAI/tankster-ai-public, use TanksterAI/.github's own copy, which this PR doesn't touch.

Callers reference these workflows at @v1, so the file stays available there until v1 is moved with move-major-tag.yml. With no callers, moving it breaks nothing.

How it was verified

• actionlint: clean.

• tests/reconcile/test.sh: 60 passed, 0 failed. tests/auto-merge-sweep/test.sh: 25 passed, 0 failed.

• git grep lockfile.yml: no references left.

• Caller sweep: sparse-cloned .github/ and the Markdown files of all 72 repositories and grepped for workflows/lockfile.yml. Two hits, both TanksterAI/.github/...@v1.

• The repo's quality gate passes locally

• New behaviour has a test that fails without the change (n/a: removal only)

Risk

If a caller I couldn't see exists (for example a repository outside these two owners), it keeps working until v1 moves past this commit, then fails with a missing-workflow error on its next manual run. It would be a workflow_dispatch run, so nothing breaks unattended.

• No secrets, tokens or credentials in the diff
• No safety threshold, budget cap or dry-run flag weakened without a recorded decision

---

Generated by Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 8e332e98-0b1d-45db-ae16-daa0c2ebcc64

📥 Commits

Reviewing files that changed from the base of the PR and between 990fb7e and 7d5eb79.

📒 Files selected for processing: 3

• .github/workflows/lockfile.yml
• CONTRIBUTING.md
• README.md

💤 Files with no reviewable changes: 1

• .github/workflows/lockfile.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🧰 Additional context used

🪛 LanguageTool

CONTRIBUTING.md

[grammar] ~38-~38: The word ‘install’ is not a noun.
Context: ...e opens a pull request (without running install scripts) and CI proves it installs and ...

(A_INSTALL)

[grammar] ~41-~41: An apostrophe ‘s’ denotes possession. Did you mean to use the plural form of the noun (no apostrophe)?
Context: ... branch is fixed by running the package manager's install locally; CI's frozen install fa...

(NOUN_APOSTROPHE_S_VERB)

[grammar] ~41-~41: The word ‘install’ is not a noun.
Context: ... manager's install locally; CI's frozen install fails until it is.

(A_INSTALL)

🔇 Additional comments: 2

README.md: 1

237-238: LGTM!

CONTRIBUTING.md: 1

39-39: 🎯 Functional Correctness

The build input already runs by default, Apprentice.

.github/workflows/node-ci.yml defines build with the non-empty default npm run build, and the Build step runs whenever inputs.build != ''. A caller does not need to pass the input unless it deliberately disables the build.

📝 Summary

Summary by CodeRabbit

• Documentation
  • Updated contributor guidance to explain how to request lockfile maintenance through Renovate and how to update a lockfile locally when it is out of sync with package changes.
  • Updated the README with information about requesting quarterly lockfile maintenance from the Dependency Dashboard.
• Chores
  • Removed the reusable lockfile maintenance workflow; it is no longer listed among the available workflows.

The reusable lockfile workflow was removed. The contributor guidance and README now describe Renovate’s lockfile maintenance option and local updates when a lockfile does not match package.json.

Changes: Lockfile maintenance

Layer / File(s)	Summary
Remove the reusable lockfile workflow .github/workflows/lockfile.yml	The workflow for regenerating, verifying, and committing lockfiles was removed.
Update lockfile maintenance guidance CONTRIBUTING.md, README.md	The guidance now describes Renovate’s “Awaiting Schedule” option and local lockfile updates. The README no longer lists the workflow or its runner exception.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 7d5eb

No actionable merge-blocking risk remains after the review.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely summarises the main change: retiring lockfile.yml and replacing it with Renovate lockfile maintenance.
Description check		The description is directly related to the changes. It explains the workflow removal, documentation updates, Renovate replacement, verification performed, and associated risk.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Apprentice, the lockfile workflow departs.
Renovate waits beneath the schedule.
Local installs restore the matching pair.
CI checks the install and build.
The Dark Side keeps the guidance clear.}

_{Comment @coderabbitai help to get the list of available commands.}

[rishitank]

@coderabbitai review

---

Generated by Claude Code

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.