Repository navigation
fix(deonboard): one implementation, so the language-gate rollout gets the schema guard and the case fix - #56
Conversation
… the schema guard and the case fix scripts/deonboard-workflow.sh (#54) is a copy of the estate-audit de-onboard script taken before #52 and #53 landed, and it carried neither fix: * it accepted any actions.lock schema (rc=0 on a v9.9.9 lock), and * it compared dependency keys byte for byte, so it pruned 'Swatinem/rust-cache@<sha>' while the standards record still reached it as 'swatinem/rust-cache@<sha>', leaving a dangling edge that startup-fails the run. rollout_language_gates.sh de-onboards every Rust CI caller through it, and Rust callers are exactly the ones whose locks hold that edge. Its header and the README already said the estate-audit script delegates to it; it did not. deonboard-workflow.sh now holds the guard and the case-insensitive prune, and deonboard-estate-audit.sh is a two-line entry point that execs it. Both test suites run every check through both entry points and apply their mutants to the one implementation; a mutant must be killed through the wrapper too, which fails if the wrapper ever stops delegating. tests/deonboard-estate-audit.sh (#52) was not run in CI; it now runs in the Composite shell contract job, and the hygiene self-test triggers on deonboard-workflow.sh. Against main's scripts the new suites fail 4 + 4 checks (dangling edge, entry points disagree, v9.9.9 accepted, wrapper mutant survives); on this branch they pass 19/19 and 63/63. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VTeVWDEJgdYKsUNr4uhnXX
Move all 24 hyperpolymath/cicd-suite/actions/* refs in .github/workflows/main-estate-audit.yml from 1aa6bfb (#48) to 9a947fa, the current main HEAD (#54's merge commit). #51 changed actions/manifest-check and left the pins at 1aa6bfb, so main's "Composite shell contract" has been red since 8bf6d92: tests/lock-transitive-closure.sh reports that manifest-check is pinned at 1aa6bfb, which differs from HEAD's. The pin moves to 9a947fa rather than 8bf6d92 so it serves everything on main, including #54's additions. This also makes #51's manifest-deed-paths-ignore and manifest-k9-paths-ignore inputs take effect: manifest-check@1aa6bfb does not declare them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Kjdf4Mf4Z41bNQh2TrsEp9 (cherry picked from commit 80bea8c)
|
The failing step is Main has this failure on every push since #51. This PR does not touch The failure also mattered here: the two de-onboard test steps come after it in the same job, so CI skipped them and never ran this PR's tests. What I did: I cherry-picked #55's repin ( Locally on the new head:
Generated by Claude Code |
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes. ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Summary
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 53.85% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 13 functions across 4 files. (4 skipped: … | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Title check The title clearly identifies the main change: consolidating de-onboarding into one implementation and applying the schema guard and case-insensitive pruning fixes. Description check The description directly explains the defects, implementation changes, test coverage, CI updates, documentation updates, and reported validation results. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 53.85% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 13 functions across 4 files. (4 skipped: 4 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
✨ Finishing Touches
-
📝 Generate docstrings
-
- 🤖 Coding Agent task started for docstring generation.
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Warning
CI annotation context is incomplete: annotation collection unavailable or limited
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Add Carrot credits or activate Agent usage billing to use Autofix |
|
🤖 Coding task started for 1 failed pre-merge check. |
|
❌ Failed to create Coding Agent finishing-touch task. Please try again. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
…; pin Alire by hash; re-pin the theatre gate (#57) ## What the first live caller showed The first cross-repository call of `rust-ci.yml` (hyperpolymath/plasma-parser-writer#108, [run 39251770946](https://github.com/hyperpolymath/plasma-parser-writer/actions/runs/39251770946)) died at startup: > The action EmbarkStudios/cargo-deny-action@3c63498 is not allowed in hyperpolymath/plasma-parser-writer because all actions must be from a repository owned by hyperpolymath, created by GitHub, verified in the GitHub Marketplace, or match one of the patterns: … `creusot-gate.yml` from the same commit resolved and ran on that PR (detect, theatre gate and verdict all green), which also answers the callee-lock question #54 left open: a gate workflow that is deliberately not keyed in this repository's lock resolves fine. The Actions policy is evaluated in the **caller's** repository, so a reusable may only use what every caller is allowed, and nothing in this repository's own CI could ever see the refusal. ## What this PR does * **`rust-ci.yml`** — cargo-deny is installed through `taiki-e/install-action` (the installer the coverage job and hypatia's green workflows already use) at the version cargo-deny-action shipped (`0.20.2`, new input `cargo_deny_version`), and run as plain `cargo deny` steps with the argument shape the action used (global args, `--manifest-path`, command). * **`spark-gate.yml`** — Alire is a sha256-pinned release binary (alr `2.1.1` x86_64 Linux, the version `setup-alire` v6.0.0 defaults to; new inputs `alr_version` / `alr_sha256`, hash recorded from the downloaded asset) followed by `alr -n toolchain --select gnat_native=<v> gprbuild`, which is what `alire-project/setup-alire` does on Linux. That action is also outside the allowed owners, and it nests `actions/cache/restore@v4` and `actions/setup-node@v4`, floating tags no caller under `sha_pinning_required` may carry. The nested standards theatre gate moves from `95de3df` to `75bd599`: since about 2026-10-15 GitHub validates a called reusable against the callee's `actions.lock` and rejects records whose `ref:` is their own SHA; `95de3df`'s lock has them (hypatia PIN-003, hyperpolymath/hypatia#931, lists the 545 such standards commits), `75bd599` is the first that does not. The theatre gate's content is identical at both commits. * **`tests/gate-action-owners.sh`**, run by `language-gates-self-test.yml` — every `uses:` in the four gates names an owner in {actions, github, hyperpolymath, dtolnay, swatinem, goto-bus-stop, taiki-e} at a full SHA; a planted disallowed owner and a planted tag pin must both be refused or the guard reports NO CHECK (exit 2). * **README** — what a gate may use, what the callee lock must look like, and how a consumer with a lock-sync gate onboards a caller (hyperpolymath/cicd-squabbler#135 is the worked example for its standards callers). ## Evidence actionlint clean on the three workflows; shellcheck clean on the guard; the four gate test suites (31/27/19/19) and the composite shell contract (28) still pass; the owners guard passes with its planted control tripping. `tests/lock-transitive-closure.sh` fails 6 checks on this branch **and on main alike** (`manifest-check` pinned at `1aa6bfb` in `main-estate-audit.yml`, the subject of #56); nothing here touches it. ## Not yet witnessed live The pinned-alr path and `cargo deny` through install-action run for the first time on the first consumer that pins this commit; the planted controls still make a broken install report void, never green. After this merges, plasma-parser-writer#108's pin moves to the merged SHA and `Rust CI` runs there for the first time; cicd-squabbler can then onboard the Rust and SPARK gates with a closure that no longer needs ids this session could not obtain. Commits on this branch are unsigned: no signing key is available in this session (the configured key file is empty). GitHub signs the squash merge. --- _Generated by [Claude Code](https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8)_ --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
|
2 participants
What was wrong
scripts/deonboard-workflow.sh(#54) is a copy of the estate-audit de-onboard script, taken before #52 and #53 landed. It has neither fix:actions.lockschema. On av9.9.9lock it exits 0 and edits the lock. test(deonboard): pin the de-onboard script to the lockfile schemas it is tested on #53's fail-closed guard (exit 3) lives only indeonboard-estate-audit.sh.hyperpolymath/standardsrecord reachesswatinem/rust-cache@6323deb…but the record key isSwatinem/rust-cache@6323deb…. The script prunes that record and leaves a dangling edge, which startup-fails the run. This is the januskey shape fix(deonboard): compare owner/repo case-insensitively when pruning #52 fixed, but only in the estate-audit copy.Who was exposed:
rollout_language_gates.shde-onboards every Rust CI, Creusot, SPARK and miniKanren caller throughdeonboard-workflow.sh. Rust CI callers are exactly the repositories whose locks carry thestandards→rust-cacheedge.As far as this session knows, no rollout has run since #54 merged, so this is a latent defect rather than a broken estate. That is ASSUMED: I have no rollout logs.
The
deonboard-workflow.shheader and README line 273 on main already said the estate-audit script "now delegates" to it. It did not; it was a second copy.The change
scripts/deonboard-workflow.shis now the one implementation. It carries test(deonboard): pin the de-onboard script to the lockfile schemas it is tested on #53'sknown_versionsguard and fix(deonboard): compare owner/repo case-insensitively when pruning #52'slower_repoprune, with their comments carried over verbatim.scripts/deonboard-estate-audit.shis now just a usage check and oneexec …/deonboard-workflow.sh "$repo" .github/workflows/main-estate-audit.yml.rollout_estate.sh, the templates and the README keep working through it unchanged.tests/deonboard-lock-schemas.sh:known_versionsfrom the generic script.tests/deonboard-estate-audit.sh(fix(deonboard): compare owner/repo case-insensitively when pruning #52):| lower_repomutant is applied to the generic script and must be killed through both.code-hygiene-self-test.yml):tests/deonboard-estate-audit.shwas never run in CI. It now runs in the Composite shell contract job.scripts/deonboard-workflow.sh.uses:added.3325927is chore(ci): repin estate audit composites to #54 (follow-up to #51) #55's repin, cherry-picked with-x; the diff is byte-identical.lock-transitive-closurefailure would otherwise stop the Composite shell contract job before the de-onboard steps run.Evidence (TESTED)
I copied the new suites into a tree of
origin/main(9a947fa) and ran them against main's scripts.tests/deonboard-estate-audit.sh: PASS=14 FAIL=4FAIL pruned Swatinem/rust-cache, which the standards record still reachesFAIL dangling edge(s): swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6FAIL the entry points disagree: …FAIL mutant is identical to the script: the case-folding the test exists for is gonetests/deonboard-lock-schemas.sh: PASS=57 FAIL=4FAIL script declares no known_versionsFAIL exit 0 on schema v9.9.9 (want 3)FAIL lock modified despite refusalFAIL orphan check passed a mutant that does not prune(main's wrapper does not delegate)On this branch:
tests/deonboard-estate-audit.shtests/deonboard-lock-schemas.shtests/lock-transitive-closure.shtests/composite-shell-contract.shbash -nshellcheck -S warningactionlint"$/actions/…"findings in the hygiene self-test are also on main)🤖 Generated with Claude Code
https://claude.ai/code/session_01VTeVWDEJgdYKsUNr4uhnXX