Repository navigation
🔧 CodeRabbit CI Fix: Fix failing Dogfood Gate K9 contracts and Groove manifest checks - #64
Merged
hyperpolymath merged 1 commit intoSep 4, 2026
Conversation
Contributor
Author
|
Important Review skippedThis PR was authored by the user configured for CodeRabbit reviews. CodeRabbit does not review PRs authored by this user. It's recommended to use a dedicated user account to post CodeRabbit review feedback. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Essentials Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
hyperpolymath
approved these changes
Sep 4, 2026
hyperpolymath
merged commit Sep 4, 2026
e51b7d9
into
fix/find-exec-terminator
19 of 20 checks passed
4 of 16 tasks
hyperpolymath
added a commit
that referenced
this pull request
Oct 9, 2026
…126) ## Summary PR 1 of 2 for a signed, pinned release pipeline. When a `v*` tag is pushed, `release.yml` will build a static `squabble` binary for `x86_64-unknown-linux-musl` using the workspace MSRV toolchain (1.85.0). It publishes the binary with a `SHA256SUMS` file and a Sigstore build-provenance attestation for both files. The Justfile's `release-tag` now creates a **signed** tag. The crate version on `main` is **0.1.0**. **Sequencing.** No tag is created or pushed by this PR. 1. This PR merges. 2. The owner pushes a signed tag `v0.1.0`; tagging is the owner's call, and tags here are immutable. 3. `release.yml` runs and publishes `squabble-x86_64-linux-musl` and `SHA256SUMS`, with an attestation. 4. **PR 2** adds the consumer action (`verify-satisfied`). It pins the real sha256 from that release and checks it with `gh attestation verify`. ## Changes - **`.github/workflows/release.yml`** is rewritten in block YAML (not KYAML). The SPDX header is kept. - **Trigger and permissions:** `push: tags: ['v*']`. Top-level permissions are `contents: read` only. - **`build` job:** - checkout with `persist-credentials: false` - `dtolnay/rust-toolchain` with `toolchain: 1.85.0` and `targets: x86_64-unknown-linux-musl` - `sudo apt-get install -y musl-tools` - `cargo build --locked --release -p squabble-cli --target x86_64-unknown-linux-musl` - stages `dist/squabble-x86_64-linux-musl` and `dist/SHA256SUMS`, running `sha256sum` inside `dist/` so the names are bare - a step that **fails** if either file is missing or empty, then runs `sha256sum -c` - `upload-artifact` with `if-no-files-found: error` - **`release` job:** - `needs: build`. Its permissions are exactly `contents: write`, `id-token: write` and `attestations: write`. - `download-artifact`, then a guard that fails on an empty or incomplete `dist/` - `attest-build-provenance` with `subject-path: 'dist/*'`, with **no skip condition** - `softprops/action-gh-release` with `files: dist/*`, `generate_release_notes: true` and `fail_on_unmatched_files: true` - **Removed:** the git-cliff `changelog` job, and the language auto-detect build stub. - **Pinning:** every `uses:` is pinned to a full commit SHA, with its tag in a trailing comment. - **`.github/workflows/actions.lock`** is edited **by hand**. Only the `release.yml` entry and the records it alone used are touched. `gh actions-lock` was **not** run in rewrite/fix mode. - The `release.yml` list now names the six SHA refs. - It adds three SHA-keyed `dependencies:` records: - `actions/download-artifact@3e5f45b2…` - `actions/attest-build-provenance@4d101475…`, with its nested `actions/attest@508db95…`, which was already recorded - `softprops/action-gh-release@efb35369…` - It prunes the two tag-keyed records that only `release.yml` used: `actions/attest-build-provenance@v4.2.2` and `softprops/action-gh-release@v3.0.3`. - The lock stays transitively closed. Repo and owner IDs were re-read through GraphQL. - **`Justfile` `release-tag`:** `git tag -a` becomes `git tag -s`. The `Immutable-Tags` ruleset has a `required_signatures` rule. The recipe now produces a signed tag whatever the local `tag.gpgsign` setting is; on this machine `tag.gpgsign=true` was already set, so the behaviour here does not change. ## Type of change <!-- This repo's template has no "Type of change" section; added so the pins block below sits where the estate PR convention expects it. --> - New feature (CI/release pipeline). No Rust source, public API or behaviour of `squabble` changes. ## 📌 New pins **Head SHA: `9853570e107db3f4c5aec5b3266ed2c9e9703902`** | Action | Pinned commit | Tag | |---|---|---| | `actions/checkout` | **`3d3c42e5aac5ba805825da76410c181273ba90b1`** | v7.0.1 | | `dtolnay/rust-toolchain` | **`6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772`** | **no tag** (see below) | | `actions/upload-artifact` | **`043fb46d1a93c77aae656e7c1c64a875d1fc6a0a`** | v7.0.1 | | `actions/download-artifact` | **`3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c`** | v8.0.1 | | `actions/attest-build-provenance` | **`4d101475d8b20a2381f78447822ac1eab6504dd8`** | v4.2.2 | | ↳ nested `actions/attest` | **`508db95dd578ae2727ebd6217d5ba78e4fbda05d`** | v4.2.1 | | `softprops/action-gh-release` | **`efb35369e0ad2afab669f228072c1b0d510eae64`** | v3.0.3 (peeled commit; the annotated tag object is `e598afbe…`) | Each SHA was checked with `git ls-remote` against the upstream tag. `dtolnay/rust-toolchain@6c977a6c` is an untagged `master` commit from 2026-08-04, the merge of #182, and an ancestor of the moving `v1` branch. It is the SHA this repo's lock already records for the standards reusable workflows. It predates upstream's input-hardening change (`83d0610`, "Safely handle action inputs"). The inputs here are constant strings, so that change does not apply to this workflow. No other lockfile records, container digests or Cargo.lock entries change. ## RSR Quality Checklist ### Required - [x] Tests pass: `cargo +1.85.0 test --locked --workspace` gives 279 passed, 0 failed (123 + 64 + 59 + 33). - [ ] Code is formatted: N/A. No Rust source is changed; the only changes are YAML, the lockfile and one Justfile line. - [ ] Linter is clean: **not fully**. - `actionlint` is clean on `release.yml`. - Pre-commit `editorconfig-checker` fails on `Justfile` lines 210–216 (indentation). That failure is **already on `origin/main`**: the same check on `git show origin/main:Justfile` fails identically. This PR changes only line 533. - The repo-wide `lint-workflows` (Workflow Security Linter) red is pre-existing; see "CI on this head" under Testing. - [x] No banned language patterns. YAML, lockfile and Justfile only. - [ ] No `unsafe` blocks without `// SAFETY:`: N/A, no Rust changed. - [ ] No banned functions: N/A, no Rust, Idris, Lean or OCaml changed. - [x] SPDX header present on the modified `release.yml` (line 1, kept). `actions.lock` keeps the machine-generated header it already had, and `Justfile` keeps its existing header. - [x] No secrets, credentials or `.env` files. Pre-commit `gitleaks` and `detect-private-key` passed. ### As Applicable - [ ] `STATE.a2ml`: N/A. A2ML is retired estate-wide and is not created or edited here. - [ ] `ECOSYSTEM.a2ml`: N/A, same reason. - [ ] `META.a2ml`: N/A, same reason. - [ ] Documentation: N/A in this PR. The verify commands are in the `release.yml` header comment; user-facing install docs land with PR 2. - [ ] `TOPOLOGY.md`: N/A, no architecture change. - [ ] `CHANGELOG`: not updated. The release now uses `generate_release_notes: true`, and the git-cliff job is gone. - [ ] New dependencies license review: N/A. No crate dependencies are added; only CI actions are pinned. - [ ] ABI/FFI: N/A, untouched. ## Testing ### How has this been verified? | Command | Result | |---|---| | `rustup toolchain install 1.85.0 --profile minimal --target x86_64-unknown-linux-musl` (into the estate tools rustup) | installed rustc 1.85.0 (4d91de4e4 2025-02-17) | | `cargo +1.85.0 build --locked --release -p squabble-cli --target x86_64-unknown-linux-musl` | **rc=0**; produced `ELF 64-bit LSB pie executable, x86-64, static-pie linked`, 2,343,240 bytes. `squabble --version` printed `squabble 0.1.0` | | `cargo tree --locked -p squabble-cli --target x86_64-unknown-linux-musl -e normal,build` | 29 lines. No C-compiling crate (`ring`, `cc`, `*-sys`) is in the default tree, which is why the musl link works here without `musl-gcc` | | `cargo metadata --locked` (`rust-version` of every package) | the highest in the default graph is 1.85; `wasip2` declares 1.87.0 but is not in the musl default tree, and the 1.85.0 build above succeeded | | `cargo +1.85.0 test --locked --workspace` | 279 passed, 0 failed | | `bash scripts/check-lock-sync.sh` | rc=0: in sync, transitively closed, 0 dangling edges, every workflow keyed | | `gh actions-lock --no-fix` | rc=0; the working tree was byte-identical before and after | | `actionlint .github/workflows/release.yml` (1.7.7) | rc=0 | | `pre-commit run --files <the 3 files>` | all hooks pass except two (details below) | | `bash standards/.githooks/docstring-scan.sh --worktree --check` | rc=0. No shell functions were added or modified (0 touched), so §5d does not apply | | `git log -1 --show-signature` | `Good "git" signature … ED25519` | **Positive controls.** Each one shows that a check above can return a failure. - Dropping the `softprops@efb35369` record makes `check-lock-sync.sh` exit 1. - A wrong `commit:` digest on the `download-artifact` SHA record makes `gh actions-lock --no-fix` exit 2. - A planted `needs: buidl` makes `actionlint` exit 1. - **`gh actions-lock --no-fix` exited 0 on the dangling-edge plant.** That is the blind spot documented in `check-lock-sync.sh`; `check-lock-sync.sh` is the gate that catches it. **The two pre-commit hooks that did not pass:** - **`editorconfig-checker` fails** on `Justfile` lines 210–216. This is pre-existing on `origin/main` (see the checklist above), and this PR changes only line 533. - **`validate-k9` could not run.** Its hook repo, `https://github.com/hyperpolymath/k9-pre-commit`, does not resolve: `git fetch` reports "Repository not found", and GraphQL `repository(...)` returns NOT_FOUND. As a result, `pre-commit run` aborts before any hook runs. Every other hook was run from a scratch copy of `.pre-commit-config.yaml` with only that repo block removed. No `.k9` files are changed in this PR. **Not verified locally, and only provable by the first tag run:** - `apt-get install musl-tools` on the runner. It is not needed for the current default dependency tree, but is kept for any future C dependency. - `actions/download-artifact` reading a same-run artifact without `actions: read`. The README at `3e5f45b2` scopes default access to the current run. - The OIDC and Sigstore attestation itself. The repo is **public**, so it uses the Sigstore public-good instance and the attestation is publicly verifiable. - `softprops/action-gh-release` creating the release. ### CI on this head (`9853570e`) Read from `commits/9853570e…/check-runs` with `--paginate` (52 runs), `commits/9853570e…/statuses` (plural, deduped by context), REST `pulls/126/reviews`, GraphQL `reviewThreads` and `rules/branches/main`. - **Effective rules on `main`:** `deletion`, `non_fast_forward`, `required_status_checks`. The only required context is `scan / gitleaks`, and it is **success**. - **Check-runs:** 47 success, 3 skipped (`automerge`, `rust-ci / Cargo audit (security)`, `rust-ci / llvm-cov line coverage`; skipped satisfies, but they carry no evidence), 2 failure (both `lint-workflows`, one run per trigger). - **Apps that reported:** github-actions, codefactor-io, gitguardian, github-advanced-security, semgrep-code-hyperpolymath and sonarqubecloud (Quality Gate passed) as check-runs, plus `CodeRabbit` and `Codeac analyze results` as legacy statuses. Codeac says "1 errors and 3 warnings" in a `success` state, which is the same text it gives on `main` @ `a4cd088`. - **CodeRabbit:** APPROVED, "No actionable comments were generated". There are 0 review threads and 0 inline comments. - **Code scanning:** I took the set difference by alert number. The 31 open alerts on `refs/pull/126/merge` (Hypatia and CodeQL analyses of merge commit `76836fa6`) are a subset of the 46 open alerts on `main`, so this PR introduces **0 alerts**. That includes the pre-existing Hypatia #64 and #76, which fire on the case-folded duplicate `Swatinem/rust-cache` / `swatinem/rust-cache@6323deb1` record already present in `main`'s `actions.lock`. This PR does not touch that record. - **`lint-workflows` is red, and it is pre-existing.** - The failing step is `Check SHA-Pinned Actions`; `Check SPDX Headers` and `Check Permissions Declaration` pass. - The same step is red on `main` (run 36649482714 at `b12657f5`, whose `.github/workflows/` is identical to `a4cd088`; 39 findings). This head has 36 findings, all in files this PR does not change. The PR **removes 3** of them, the tag-pinned `release.yml` refs. - 5 of the 36 are the linter matching the nested `uses:` keys inside `actions.lock` itself. That is a linter false positive, and `main` has the same 5. - **Deferral:** `lint-workflows` is deferred to #127 (acceptance: the step is green on `main`, the 31 refs are SHA-pinned and lock-covered, and the linter no longer reads `actions.lock`). ## Screenshots N/A. Terminal results are in the Testing table above. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015bTuGfwCcvjrmNFejydTML Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI failure fixes was requested by @hyperpolymath.
The following files were modified:
.machine_readable/self-validating/methodology-guard.k9.ncl