[hyperpolymath]

Summary

This PR clears four CI reds on main (b42ca64) that come from workflow files rather than from the code: the governance Allowlist Preflight, the governance Workflow security linter, readme-derive, and release.yml. release.yml has never been green: it failed at startup on every push.

Changes

• .github/workflows/abi-drift.yml: deleted a stray second with: block (toolchain: v1) on the dtolnay/rust-toolchain@v1 step. GitHub rejects a workflow that has duplicate keys before any job starts.
• .github/workflows/governance.yml: bumped governance-reusable.yml from 84355587 (08-27) to standards main 5a0891e9. In the old reusable, Allowlist Preflight ran the live Actions-policy read with an empty GH_TOKEN and exited 3. At 5a0891e9 that read is a separate credentialed advisory job.
• .github/workflows/readme-derive.yml: bumped readme-derive-reusable.yml to standards main 5a0891e9, which fixes the gem install … -v multi-gem error. Also rewrote the stale pin comment.
• .github/workflows/release.yml: removed runs-on: ubuntu-latest from the provenance job. That job calls the SLSA reusable workflow, and a job that calls a reusable workflow may not set runs-on. GitHub therefore failed to parse the file and recorded a zero-job failed run on every push, even though the trigger is tags only.

Reds addressed (decisive log line on main)

Check	Decisive line	Outcome
governance / Allowlist Preflight	ERROR: could not read live Actions permissions for hyperpolymath/boj-server (exit 3, GH_TOKEN: empty)	fixed (pin bump)
governance / Workflow security linter	##[error]duplicate key(s): 'with' (line 86)	fixed
readme-derive / Derive & verify README.md	ERROR: Can't use --version with multiple gems.	fixed (pin bump)
release.yml	startup failure, 0 jobs; actionlint: when a reusable workflow is called with "uses", "runs-on" is not available	fixed
deploy (pages-deploy.yml)	CLOUDFLARE_API_TOKEN / CLOUDFLARE_ACCOUNT_ID empty, so wrangler fails	owner item (secrets), not changed
SonarQube	HTTP 403 on SONAR_TOKEN	owner item, not changed

Type of change

• 🔧 Build / CI / tooling. This repo's template has no "Type of change" section, so this one comes from the org default.

📌 New pins

Head SHA: 2592ba45aa2cee7693034a06b3c4e46701cac56b

• hyperpolymath/standards/.github/workflows/governance-reusable.yml@5a0891e9e58b785181a92e141505ca96ca987b42 (was 84355587…)
• hyperpolymath/standards/.github/workflows/readme-derive-reusable.yml@5a0891e9e58b785181a92e141505ca96ca987b42
• 5a0891e9 is a commit (gh api repos/hyperpolymath/standards/git/commits/5a0891e9… returned 200) and an ancestor of standards main (compare reports ahead, behind_by=0).
• actions.lock: no change. Reusable-workflow callers keep [] entries. The callee's own lock at 5a0891e9 covers both reusables.

RSR Quality Checklist

Required

• Tests pass (just test not run): these are workflow-only changes, and the affected gates were re-run locally (see Testing). No source code changed.
• Code is formatted (just fmt not run): no source code changed. actionlint (non-shellcheck rules) is clean on all 27 workflows.
• Linter is clean: duplicate-key check reports 27 workflow file(s) clean; SPDX + permissions report All workflows have SPDX headers + permissions.
• No banned language patterns: no new code.
• No unsafe blocks: none touched.
• No banned functions: none touched.
• SPDX headers present: all four modified workflows keep their existing SPDX header. No new files.
• No secrets or .env files.

As Applicable

• .machine_readable/STATE.a2ml: N/A, project state did not change.
• .machine_readable/ECOSYSTEM.a2ml: N/A, no integration change.
• .machine_readable/META.a2ml: N/A.
• Documentation: N/A. README.md re-derived locally is byte-identical to the committed file.
• TOPOLOGY.md: N/A.
• CHANGELOG: N/A, CI-only.
• New dependencies: none.
• ABI/FFI changes: none.

Testing

All of these ran locally on this branch, rebased onto b42ca648:

• gh actions-lock --verify (v0.1.6) printed Scanning 27 workflows, rc=0. Positive control: changing one uses: ref made it fail with rc=1.
• Standards check-workflow-duplicate-keys.sh printed duplicate-key check: 27 workflow file(s) clean. On main the same script reports abi-drift.yml line 86.
• SPDX + permissions step (verbatim logic from the 5a0891e9 reusable) printed All workflows have SPDX headers + permissions.
• check-action-pins-resolve.sh with GH_TOKEN set printed All 3 verifiable action pin(s) resolve upstream., rc=0.
• check-actions-lock-gate.sh (new actions-lock-verify job) printed Immutable direct and transitive lockfile coverage verified.
• readme-derive pipeline (asciidoctor-reducer, then asciidoctor docbook5 --failure-level=WARN, then pandoc gfm, then the stamp): reducer stderr was empty, the freshness diff rc=0 (identical), and the vocab gate passed at 98.4% against a threshold of 98. Positive control: threshold 99 gave rc=1.
• actionlint on release.yml: before the change it reported the runs-on error; after, it is clean.

Notes for reviewers

• Expected new red after the jump: uuid-v7-conformance. The 5a0891e9 reusable adds this job, and ./.machine_readable/CLADE.a2ml contains a non-v7 UUID literal (5f5df93b-789d-5ff6-8a44-9dc6ed90a7b1). It is listed as a finding and not changed here.
• release.yml is verified at parse level only. Whether GitHub's lock enforcement accepts the SLSA reusable will show on the first tag push.
• mirror.yml, scorecard.yml and secret-scanner.yml stay on 84355587; they were not red.
• Findings not addressed here:
  • e2e: src/bench.zig:27:60: enum 'Io.Clock' has no member named 'monotonic' (Zig 0.16 API).
  • proofs.yml is red on the new main.
  • deploy uses npx wrangler@latest, which breaks bun-only doctrine and leaves the version floating.
  • release.yml around line 105 has shellcheck SC2046.
  • .machine_readable/6a2/ has not been migrated to descriptiles/.

🤖 Generated with Claude Code

https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: f1a6bca5-2abe-4915-ab9b-2339978bd368

📥 Commits

Reviewing files that changed from the base of the PR and between b42ca64 and 2592ba4.

📒 Files selected for processing (4)

• .github/workflows/abi-drift.yml
• .github/workflows/governance.yml
• .github/workflows/readme-derive.yml
• .github/workflows/release.yml

 ______________________________________________________________________
< I see you chose the 'dynamic typing' difficulty setting. On purpose. >
 ----------------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 Hypatia Security Scan

Findings: 114 issues detected

Severity	Count
🔴 Critical	10
🟠 High	22
🟡 Medium	82

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Job `sonarqube` in build.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sonarqube"
  },
  {
    "reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/label-triage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "triage"
  },
  {
    "reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/labels.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sync"
  },
  {
    "reason": "Job `deploy` in pages-deploy.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/pages-deploy.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "deploy"
  },
  {
    "reason": "Step uses `peter-evans/repository-dispatch` with `token: ${{ secrets.FARM_DISPATCH_TOKEN }}` but has no `if: secrets.FARM_DISPATCH_TOKEN != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.",
    "type": "secret_action_without_presence_gate",
    "file": ".github/workflows/instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high",
    "fix_recipe": "add_secret_presence_gate"
  },
  {
    "reason": "codeql.yml does not list `language: actions` in its matrix, but the repo has workflow files. CodeQL's `actions` language scans workflow YAML for injection and other CI/CD-specific weaknesses — every repo with workflows benefits. Add an entry to `matrix.include` with `language: actions` + `build-mode: none`.",
    "type": "codeql_missing_actions_language",
    "file": ".github/workflows/codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "fix_recipe": "add_codeql_actions_language"
  },
  {
    "line": 39,
    "reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/labels.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 46,
    "reason": "job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/push-email-notify.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 32,
    "reason": "job in .github/workflows/build.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/build.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 44,
    "reason": "job in .github/workflows/container-publish.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/container-publish.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[coderabbitai]

Add Carrot credits or activate Agent usage billing to use Autopilot