diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 1414f87..34079dd 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -17,17 +17,17 @@ workflows: '.github/workflows/estate-rules.yml': - 'actions/checkout@v7.0.1' '.github/workflows/governance.yml': - - 'hyperpolymath/standards@8f2ee50841e216cd8c192eeb68953118190f105c' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/guix-policy.yml': - 'actions/checkout@v7.0.1' '.github/workflows/hypatia-scan.yml': - - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/instant-sync.yml': [] '.github/workflows/label-triage.yml': [] '.github/workflows/labels.yml': [] '.github/workflows/lock-sync-gate.yml': [] '.github/workflows/mirror.yml': - - 'hyperpolymath/standards@8f2ee50841e216cd8c192eeb68953118190f105c' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/openssf-compliance.yml': - 'actions/checkout@v7.0.1' '.github/workflows/pages.yml': @@ -35,7 +35,7 @@ workflows: - 'actions/deploy-pages@v5.0.1' - 'actions/upload-pages-artifact@v5.0.0' '.github/workflows/push-email-notify.yml': - - 'hyperpolymath/smtp-notify-action@v0.3.0' + - 'hyperpolymath/smtp-notify-action@v0.5.0' '.github/workflows/quality.yml': - 'actions/checkout@v7.0.1' - 'editorconfig-checker/action-editorconfig-checker@v3.0.0' @@ -51,20 +51,20 @@ workflows: '.github/workflows/runtime-policy.yml': - 'actions/checkout@v7.0.1' '.github/workflows/rust-ci.yml': - - 'hyperpolymath/standards@8f2ee50841e216cd8c192eeb68953118190f105c' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/scorecard.yml': - - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/secret-scanner.yml': - - 'hyperpolymath/standards@8f2ee50841e216cd8c192eeb68953118190f105c' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/security-policy.yml': - 'actions/checkout@v7.0.1' '.github/workflows/squabble-action.yml': [] '.github/workflows/standards-pipeline.yml': - - 'hyperpolymath/standards@ed5e3f651305dd1ce0d0b5d2d08b97a963634632' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/static-analysis-gate.yml': - 'actions/checkout@v7.0.1' - - 'actions/download-artifact@v8.0.1' - - 'actions/upload-artifact@v7.0.1' + - 'actions/download-artifact@v8.0.2' + - 'actions/upload-artifact@v7.0.2' - 'erlef/setup-beam@v1.24.1' '.github/workflows/wellknown-enforcement.yml': - 'actions/checkout@v7.0.1' @@ -72,7 +72,7 @@ workflows: - 'actions/checkout@v7.0.1' dependencies: 'actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8': - ref: '4d101475d8b20a2381f78447822ac1eab6504dd8' + ref: 'v4.2.2' commit: 'sha1-4d101475d8b20a2381f78447822ac1eab6504dd8' owner_id: 44036562 repo_id: 760702757 @@ -84,12 +84,12 @@ dependencies: owner_id: 44036562 repo_id: 760701061 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9': - ref: '55cc8345863c7cc4c66a329aec7e433d2d1c52a9' + ref: 'v6.1.0' commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' owner_id: 44036562 repo_id: 215566462 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': - ref: '3d3c42e5aac5ba805825da76410c181273ba90b1' + ref: 'v7.0.1' commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' owner_id: 44036562 repo_id: 197814629 @@ -108,16 +108,11 @@ dependencies: commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' owner_id: 44036562 repo_id: 192626254 - 'actions/download-artifact@v8.0.1': - ref: 'v8.0.1' - commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c' + 'actions/download-artifact@v8.0.2': + ref: 'v8.0.2' + commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' owner_id: 44036562 repo_id: 192626254 - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a': - ref: '043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' - commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' - owner_id: 44036562 - repo_id: 192625955 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f': ref: 'v7.0.0' commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' @@ -128,9 +123,9 @@ dependencies: commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' owner_id: 44036562 repo_id: 192625955 - 'actions/upload-artifact@v7.0.1': - ref: 'v7.0.1' - commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' + 'actions/upload-artifact@v7.0.2': + ref: 'v7.0.2' + commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' owner_id: 44036562 repo_id: 192625955 'actions/upload-pages-artifact@v5.0.0': @@ -140,6 +135,11 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed': + ref: 'v2.0.5' + commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' + owner_id: 42048915 + repo_id: 356423100 'dependabot/fetch-metadata@v3.1.0': ref: 'v3.1.0' commit: 'sha1-25dd0e34f4fe68f24cc83900b1fe3fe149efef98' @@ -150,13 +150,13 @@ dependencies: commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8' owner_id: 1940490 repo_id: 260749683 - 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772': - ref: '6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' - commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' + 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f': + ref: 'v1' + commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f' owner_id: 1940490 repo_id: 260749683 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393': - ref: '51f63319f592f97930c73d9c46184d20bd206393' + ref: 'v3.0.0' commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393' owner_id: 26415196 repo_id: 297874902 @@ -166,7 +166,7 @@ dependencies: owner_id: 26415196 repo_id: 297874902 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124': - ref: '54075bcc5e249e4758d363f27d099f55d843f124' + ref: 'v1.24.1' commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' owner_id: 47606891 repo_id: 331103973 @@ -175,9 +175,9 @@ dependencies: commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' owner_id: 47606891 repo_id: 331103973 - 'github/codeql-action@cdf488f595d80d6e07e03d4674febd5ab45fa938': - ref: 'cdf488f595d80d6e07e03d4674febd5ab45fa938' - commit: 'sha1-cdf488f595d80d6e07e03d4674febd5ab45fa938' + 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63': + ref: 'v4.38.0' + commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' owner_id: 9919 repo_id: 259445878 'github/codeql-action@v4.39.0': @@ -186,83 +186,74 @@ dependencies: owner_id: 9919 repo_id: 259445878 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406': - ref: 'abea47f85e598557f500fa1fd2ab7464fcb39406' + ref: 'v2.2.1' commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406' owner_id: 1006268 repo_id: 212984112 - 'haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d': - ref: '6037f33647c3f17758a2356c80fc4a53d7e0685d' - commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' + 'haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d': + ref: 'v2.12.1' + commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d' owner_id: 75048950 repo_id: 623796603 - 'hyperpolymath/smtp-notify-action@v0.3.0': - ref: 'v0.3.0' - commit: 'sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be' + 'hyperpolymath/smtp-notify-action@v0.5.0': + ref: 'v0.5.0' + commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef' owner_id: 6759885 repo_id: 1352485172 - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd': - ref: '571cc734cd69fb846032ec77a662aa8ee4fc32cd' - commit: 'sha1-571cc734cd69fb846032ec77a662aa8ee4fc32cd' - owner_id: 6759885 - repo_id: 1116521501 - 'hyperpolymath/standards@8f2ee50841e216cd8c192eeb68953118190f105c': - ref: '8f2ee50841e216cd8c192eeb68953118190f105c' - commit: 'sha1-8f2ee50841e216cd8c192eeb68953118190f105c' + 'hyperpolymath/standards@427eb35c40552d912d8c757518e8326f0d20f597': + ref: '427eb35c40552d912d8c757518e8326f0d20f597' + commit: 'sha1-427eb35c40552d912d8c757518e8326f0d20f597' owner_id: 6759885 repo_id: 1116521501 uses: - - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' - - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393' - - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' + - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f' - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406' - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540': - ref: 'da2c748aad55c1a1dcba00b60fe4a35017bc6540' - commit: 'sha1-da2c748aad55c1a1dcba00b60fe4a35017bc6540' + 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': + ref: '75bd5994470661a099df562d6d5ad2fe744dbd66' + commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66' owner_id: 6759885 repo_id: 1116521501 uses: - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' + - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' + - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' + - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393' - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' - - 'github/codeql-action@cdf488f595d80d6e07e03d4674febd5ab45fa938' + - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' + - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406' + - 'haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d' + - 'hyperpolymath/standards@427eb35c40552d912d8c757518e8326f0d20f597' - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' - 'hyperpolymath/standards@ed5e3f651305dd1ce0d0b5d2d08b97a963634632': - ref: 'ed5e3f651305dd1ce0d0b5d2d08b97a963634632' - commit: 'sha1-ed5e3f651305dd1ce0d0b5d2d08b97a963634632' - owner_id: 6759885 - repo_id: 1116521501 - uses: - - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d' - - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd' - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6' + - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': - ref: '2d1146689b8cda280b9bc96326124645441f03bc' + ref: 'v2.4.4' commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' owner_id: 67707773 repo_id: 421101922 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6': - ref: '0c5077e51419868618aeaa5fe8019c62421857d6' + ref: 'v2.2.0' commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6' owner_id: 108928776 repo_id: 512644635 'softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64': - ref: 'efb35369e0ad2afab669f228072c1b0d510eae64' + ref: 'v3.0.3' commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64' owner_id: 2242 repo_id: 204253808 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6': - ref: '6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + ref: 'v2.9.2' commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' owner_id: 580492 repo_id: 298565987 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555': - ref: 'e83874834305fe9a4a2997156cb26c5de65a8555' + ref: 'v0.10.0' commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555' owner_id: 135788 repo_id: 208510314 diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index a543403..c9605f7 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -18,7 +18,7 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 permissions: actions: read contents: read diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index efcf77c..d7b0447 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -27,4 +27,4 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 805b98e..9d0e5cd 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -13,8 +13,18 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c - secrets: inherit + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + # Only the seven forge keys the callee declares (standards#1108 §6b); + # `secrets: inherit` forwarded every repository secret (WH008, zizmor + # secrets-inherit) to a workflow that asks for exactly these. + secrets: + GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} + BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} + CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }} + SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }} + DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }} + GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }} + RADICLE_KEY: ${{ secrets.RADICLE_KEY }} permissions: actions: read contents: read diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index c41879d..a6ff8b7 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -16,7 +16,7 @@ permissions: contents: read jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 permissions: actions: read contents: read diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 8dfa29b..941aade 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -16,7 +16,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 permissions: actions: read contents: read diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 16a3eaf..40a0e44 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -22,8 +22,11 @@ permissions: # .github/workflows/README.adoc. jobs: scan: - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c - secrets: inherit + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + # No `secrets:` block, deliberately: secret-scanner-reusable.yml @75bd5994 + # declares no caller secrets and reads no `secrets.*` context, so + # `secrets: inherit` only forwarded every repository secret to a workflow + # that never asked for one (WH008, zizmor secrets-inherit). permissions: actions: read contents: read diff --git a/.github/workflows/standards-pipeline.yml b/.github/workflows/standards-pipeline.yml index e9bf8c8..64e8f43 100644 --- a/.github/workflows/standards-pipeline.yml +++ b/.github/workflows/standards-pipeline.yml @@ -33,10 +33,10 @@ permissions: jobs: pipeline: - # hyperpolymath/standards @ ed5e3f65 — ci-pipeline.yml blob ea87c43a. + # hyperpolymath/standards @ 75bd5994 (standards main 2026-10-19; see actions.lock). # # NO `secrets:` block, deliberately. ci-pipeline.yml declares # `workflow_call.inputs` only, has no `secrets:` block and references no # `secrets.*` anywhere; `secrets: inherit` would hand the whole store to a # workflow that consumes none of it. - uses: hyperpolymath/standards/.github/workflows/ci-pipeline.yml@ed5e3f651305dd1ce0d0b5d2d08b97a963634632 + uses: hyperpolymath/standards/.github/workflows/ci-pipeline.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 92e738b..e9b550c 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -68,21 +68,48 @@ jobs: - name: Check SHA-Pinned Actions run: | echo "=== Checking Action Pinning ===" - # Find any uses: lines that don't have @SHA format - # Pattern: uses: owner/repo@<40-char-hex> - unpinned=$(grep -rnE "^[[:space:]]+uses:" .github/workflows/ | \ - grep -v "@[a-f0-9]\{40\}" | \ - grep -v "uses: \./\|uses: docker://\|uses: actions/github-script" || true) + # Every `uses:` must resolve to a commit. Two forms count: + # 1. `owner/repo[/path]@<40-hex>` in the workflow itself; + # 2. `owner/repo[/path]@` whose `owner/repo@` record in + # .github/workflows/actions.lock carries a `commit: 'sha1-…'` + # line — that record IS the pin, and the runner resolves the + # tag through it ("Using locked action versions from the + # workflow's lockfile"). This repository is managed by + # gh actions-lock, whose convention is tag refs in YAML and + # SHAs in the lock; a lock record whose ref is itself a bare + # SHA is what GitHub rejects as an invalid lockfile pin. + # An unlocked tag ref is still unpinned and still fails. The lock's + # sync with the YAML is a separate gate (scripts/check-lock-sync.sh). + lock=.github/workflows/actions.lock + unpinned="" + while IFS= read -r line; do + ref=$(printf '%s' "$line" | sed -E 's/^[^:]+:[0-9]+:[[:space:]]*(-[[:space:]]+)?uses:[[:space:]]*//; s/[[:space:]]*#.*$//; s/^["'"'"']//; s/["'"'"']$//') + case "$ref" in + ./*|docker://*) continue ;; + esac + if printf '%s' "$ref" | grep -qE '@[a-f0-9]{40}$'; then + continue + fi + # owner/repo@ref, sub-path stripped, compared case-insensitively + # (GitHub owner and repository names are case-insensitive). + key=$(printf '%s' "$ref" | sed -E 's#^([^/@]+/[^/@]+)(/[^@]*)?@(.+)$#\1@\3#' | tr '[:upper:]' '[:lower:]') + if [ -f "$lock" ] && awk -v key="$key" ' + /^ '"'"'/ { rec = tolower($0); sub(/^ '"'"'/, "", rec); sub(/'"'"':[[:space:]]*$/, "", rec); inrec = (rec == key); next } + inrec && /^ commit: '"'"'sha1-[0-9a-f]{40}'"'"'$/ { found = 1 } + END { exit found ? 0 : 1 }' "$lock"; then + continue + fi + unpinned="${unpinned}${line}"$'\n' + done < <(grep -rnE "^[[:space:]]+(-[[:space:]]+)?uses:" .github/workflows/ --include='*.yml' --include='*.yaml') if [ -n "$unpinned" ]; then - echo "ERROR: Found unpinned actions:" - echo "$unpinned" + echo "ERROR: Found unpinned actions (neither a 40-hex SHA in the workflow nor a commit-bearing record in $lock):" + printf '%s' "$unpinned" echo "" - echo "Replace version tags with SHA pins, e.g.:" - echo " uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.1" + echo "Pin with a SHA, or lock the tag: run gh actions-lock and commit $lock." exit 1 fi - echo "All actions are SHA-pinned" + echo "All actions are pinned: by SHA in the workflow, or by a commit-bearing actions.lock record" - name: Check for Duplicate Workflows run: | diff --git a/.machine_readable/descriptiles/CLADE.a2ml b/.machine_readable/descriptiles/CLADE.a2ml index 4234703..b497269 100644 --- a/.machine_readable/descriptiles/CLADE.a2ml +++ b/.machine_readable/descriptiles/CLADE.a2ml @@ -3,7 +3,8 @@ # See: https://github.com/hyperpolymath/gv-clade-index [identity] -uuid = "38bec2ed-bb12-44ee-9fb4-08872370c27b" # PROVISIONAL — owner ratifies via gv-clade-index +# ESTATE-UUID-V8 profile C: gv-clade-index:github.com/hyperpolymath/cicd-squabbler +uuid = "02d29e41-94bc-80c5-b741-09a9d39b858c" # PROVISIONAL — owner ratifies via gv-clade-index primary-forge = "github" primary-owner = "hyperpolymath" canonical-name = "cicd-squabbler" diff --git a/.machine_readable/descriptiles/STATE.a2ml b/.machine_readable/descriptiles/STATE.a2ml index 2492683..bebc964 100644 --- a/.machine_readable/descriptiles/STATE.a2ml +++ b/.machine_readable/descriptiles/STATE.a2ml @@ -49,7 +49,7 @@ actions = [ "Add the squabble-app GitHub App webhook leg (check_run.requested_action + octocrab — the \"Squabble!\" button) so a fight can be triggered from a PR, not only from the CLI; still honestly absent (no webhook route registered).", "Live-fire --summon against a running boj-server with the expert backends up (hypatia :7701, panic-attack, echidna) — today's verification proves the wiring + fail-closed degradation; the experts themselves are not yet deployed.", "Extend the SPARK invariant to cover the licence-policy gate class (v0.2; v0.1 moves are Rust-only for that class).", - "Register the CLADE (uuid 38bec2ed-bb12-44ee-9fb4-08872370c27b) into hyperpolymath/gv-clade-index (owner action).", + "Register the CLADE (uuid 02d29e41-94bc-80c5-b741-09a9d39b858c) into hyperpolymath/gv-clade-index (owner action).", ] [maintenance-status] diff --git a/CLAUDE.md b/CLAUDE.md index 6bb5a6f..e4794a6 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -6,7 +6,7 @@ SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell - + # You are in the hyperpolymath estate — orient before acting @@ -59,9 +59,10 @@ Deny: **Guix, Node/npm, TypeScript, Python, Go, AGPL**. (Guix, not Guix.) (This file is generated by the arrival-pack from `.machine_readable/` a2ml via `just claude-md` — it needs `nickel`. The identity block below was hand-synced -to the descriptiles on 2026-07-01; regenerate when `nickel` is available.) +to the descriptiles on 2026-10-19 (uuid moved to its ADR-008 profile C value); +regenerate when `nickel` is available.) -- **Identity** — uuid `38bec2ed-bb12-44ee-9fb4-08872370c27b`; clade `UNASSIGNED` (pending gv-clade-index ratification); born 2026-06-29; forge `hyperpolymath/cicd-squabbler`. +- **Identity** — uuid `02d29e41-94bc-80c5-b741-09a9d39b858c`; clade `UNASSIGNED` (pending gv-clade-index ratification); born 2026-06-29; forge `hyperpolymath/cicd-squabbler`. - **IS** — A standalone, per-repo CI/CD **fighter**: drives a stuck branch-protection gate to a *legitimately-satisfied* green by satisfying its required checks — Rust fight engine + a SPARK-proved gate invariant. Operationalises Doctrine #5 ("squabble, don't bypass") as a detachable tool. - **IS-NOT** — a bypass tool · hypatia-dependent · a red→green code-fixer (deferred past v0.1) · a merge-commit lander (linear history only). - **Where it sits** — pipeline position **CI/CD tooling**; standalone (operationalises a doctrine, not a sibling of a larger system); coordination = `standards`. @@ -69,4 +70,4 @@ to the descriptiles on 2026-07-01; regenerate when `nickel` is available.) - **Golden path** (ANCHOR) — `just test && just quality` → Core tests pass; Quality gates pass; No unresolved critical security findings. - **State** — phase implementation; maturity beta; ~85% complete; status active. Engine + SPARK invariant + CLI real; GitHub App webhook is an honest stub. - + diff --git a/Cargo.toml b/Cargo.toml index ec0b967..e03d63f 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -9,6 +9,12 @@ members = [ "crates/squabble-app", "crates/squabble-forge", ] +# standards' governance "JS runtimes" job checks its js-runtimes crate out at +# .standards-js/ inside this checkout and `cargo install`s it from there. It is +# an independent package, not a member of this workspace; without this cargo +# refuses to build it (governance run 39253292198, 2026-10-19; root fix is +# hyperpolymath/standards#1299, after which this is harmless). +exclude = [".standards-js"] [workspace.package] version = "0.1.0" diff --git a/crates/squabble-core/src/lib.rs b/crates/squabble-core/src/lib.rs index c1ab68b..4e95851 100644 --- a/crates/squabble-core/src/lib.rs +++ b/crates/squabble-core/src/lib.rs @@ -81,12 +81,12 @@ fn propose_for(required_context: &str) -> Move { /// /// `diagnose` is deliberately name-only: [`gate::Gate`] carries nothing about /// *why* a check is unsatisfied, so its default proposal falls back to -/// [`propose_for`]'s heuristics. A host with more context (fetched workflow +/// `propose_for`'s heuristics. A host with more context (fetched workflow /// source, a check's own failure history, known-bad reusable-workflow /// patterns — see `hyperpolymath/hypatia#566`) can supply a `hints` map from /// `required_context` to the specific [`Move`] it has already classified, /// and this function uses that instead of guessing. Contexts absent from -/// `hints` fall back to [`propose_for`], so this is a strict refinement of +/// `hints` fall back to `propose_for`, so this is a strict refinement of /// `diagnose`, never a divergence from it. pub fn diagnose_with_hints( gate: &Gate, diff --git a/crates/squabble-core/src/polarity.rs b/crates/squabble-core/src/polarity.rs index eafe953..a4252c0 100644 --- a/crates/squabble-core/src/polarity.rs +++ b/crates/squabble-core/src/polarity.rs @@ -167,7 +167,7 @@ pub struct ScannerSignature { /// So the set quantifies with `any`: a job is vacuous if it matches ANY /// scanner's signature, having matched that scanner's steps in full. /// -/// The disjunction cannot leak across scanners. [`step_concluded`] returns +/// The disjunction cannot leak across scanners. `step_concluded` returns /// `false` for a step that is absent from the list, so signature A cannot /// match a job that never recorded A's steps — the panic-attack job cannot be /// judged by the hypatia signature. That is asserted in the tests, not