ci: pin cicd-suite, dtolnay/rust-toolchain and the Hypatia clone (#401) by hyperpolymath · Pull Request #410 · hyperpolymath/echidna

hyperpolymath · 2026-10-06T13:19:06Z

Summary

Pins the three floating references left in echidna's workflows: the cicd-suite action at @main, dtolnay/rust-toolchain@master ×4, and an unpinned Hypatia clone. actions.lock was regenerated in a scratch copy, audited entry by entry, and copied in by hand; write mode never ran inside the repo.

Refs #401. Criteria 1–3 of that issue are already met on main at a71aa2c (run URLs in the close-out comment there); criterion 4 is tracked by #314. This PR removes the last floating refs.

Narrowed after the first push. The first head (010c7ba) also moved the six hyperpolymath/standards reusable callers from 571cc734 to 5751b97e. That produced two new reds, so those callers are back at 571cc734 in 5e9f5a9:

governance / Security policy checks: standards' R5 canonical-reference step exits 1 with no output under the runner's bash -e whenever an include file has no match (out=$(grep …) aborts before rc=$?). Reproduced locally: bash -e gives rc=1, plain bash reports "clean across 1 rule(s)". This is a standards bug, not echidna content, and is fixed upstream before the bump returns.
governance / UUID v7 conformance: a new job at 5751b97e flags Project.toml's Julia package UUID (v4) and a v5 in .machine_readable/CLADE.a2ml. Changing a package UUID is an owner decision.

📌 New pins

Head: 5e9f5a9911bddff915681514553d011573c80310

hyperpolymath/cicd-suite/actions/zig-unified-api-adapter-check@4c772eb235b04455307d5c03cbbc4f45130f7f0f (main 2026-10-02; cicd-suite has no tags) — was @main
dtolnay/rust-toolchain@v1 → lock sha1-7e38f4b43b4db5c8dd498af069a4f6196df1d067 — was @master at 02cb101e; v1 relocked because the tag moved
actions.lock: hyperpolymath/cicd-suite@4c772eb2… → sha1-4c772eb235b04455307d5c03cbbc4f45130f7f0f (new); removed dtolnay/rust-toolchain@master and hyperpolymath/cicd-suite@main
Hypatia clone in static-analysis-gate.yml: HYPATIA_REF=51ab6496bf47e30a0576d503df31fec30f3cfe56 — was HEAD of the default branch
Standards reusables: unchanged at 571cc734cd69fb846032ec77a662aa8ee4fc32cd

Changes

zig-ffi-ci.yml: cicd-suite action @main → @4c772eb2…. A bare SHA is the only immutable form for a repo with no tags; the lock tool's sha-as-ref warning is expected.
rust-ci.yml: dtolnay/rust-toolchain@master ×4 → @v1, the ref the other 13 call sites already use, so the lock holds one entry. Comment above the step reworded to match.
static-analysis-gate.yml: Hypatia fetched at a fixed commit (git init + fetch --depth 1 <sha>), the commit standards@5751b97e vets as its default; the clone's stderr is no longer discarded.
scorecard.yml: the calling job grants actions: read. Harmless at 571cc734 and required by scorecard-reusable.yml at the newer ref, so the later bump does not need it.
actions.lock: 18 dependency entries (was 19); every commit is sha1-<40 hex>.

RSR Quality Checklist

Required

Tests pass — workflow-only change; gh actions-lock --no-fix --verify → valid: true, 0 errors (see Testing)
Code is formatted — the 5 changed files parse with yq
Linter is clean — actionlint message set identical before and after on the edited workflows (static-analysis-gate carries 8 pre-existing findings, unchanged)
No banned language patterns — the only new shell is a git fetch of a fixed SHA
No unsafe blocks — n/a, no Rust touched
No banned functions — n/a, no source code touched
SPDX license headers present — no new files; headers on modified files untouched
No secrets, credentials, or .env files included

As Applicable

New dependencies reviewed — the only movement is dtolnay/rust-toolchain v1 to its current tag commit; rust-ci on this branch is the test

Testing

All lock runs in a scratch copy of .github/workflows under the job's tmp dir, never in the repo:

Step	Command	Result
Baseline (main)	`gh actions-lock --no-fix --json`	valid, 1 warning (cicd-suite `main` had moved d9ebcf99 → 4c772eb2)
RED (edits, old lock)	same	`valid: false`, 1 error `ref-changed dtolnay/rust-toolchain@v1`
GREEN (head `5e9f5a9`, in worktree)	`gh actions-lock --no-fix --verify --json`	`valid: true`, 0 errors, 1 warning `sha-as-ref` cicd-suite
Control A: one lock commit corrupted to a well-formed wrong SHA	`--no-fix`	passed (`valid: true`), because plain read mode does not resolve commits
Control A again	`--no-fix --verify`	`unreachable-pin … lockfile may have been tampered with`
Control B: `uses:` ref the lock does not track	`--no-fix`	`ref-changed actions/checkout@v6.0.0`
De-pin audit	baseline vs new, per dependency key	0 common entries changed except the dtolnay relock; 0 malformed
R5 repro (standards bug)	R5 step script from the run log, `bash -e` vs `bash`, in this tree	rc=1 silent vs rc=0 "clean"

CI is read with --paginate on check-runs and the plural statuses endpoint; each App's verdict is named in a review comment.

Pre-existing reds, deferred, not introduced here: Mirror (3 forges) and Security Scan (HTTP 401 at the verisimdb send) fail on main today; both are tracked by #310 (VERISIMDB_PAT rotation, owner-only).

Screenshots

n/a, CI configuration only

🤖 Generated with Claude Code

https://claude.ai/code/session_01P48P9ErT8UFFeDUfEQiYV7

@main

…751b97e - zig-ffi-ci: hyperpolymath/cicd-suite/actions/zig-unified-api-adapter-check @main -> @4c772eb2 (main 2026-10-02); the lock carries that SHA. cicd-suite has no tags, so a bare SHA is the only immutable form (the tool's sha-as-ref warning stays). - rust-ci: dtolnay/rust-toolchain@master x4 -> @v1, the ref the other 13 call sites already use, so the lock holds one entry; v1 relocked from 02cb101e to 7e38f4b4 because the tag moved (verify mode: ref-moved x8). - static-analysis-gate: the hypatia clone is pinned to 51ab6496, the commit standards@5751b97e vets as the hypatia-ref default, so the baseline job, hypatia-scan and this gate build one scanner. The clone's stderr is no longer discarded. - six standards reusable callers: 571cc734 (2026-08-04, 398 commits behind) -> 5751b97e (2026-10-06); scorecard's calling job now grants actions: read, which scorecard-reusable requires at that ref. - actions.lock regenerated in a scratch copy and copied by hand: 18 entries; no existing pin changed except the dtolnay relock; every commit is sha1-<40 hex>. Verified: gh actions-lock --no-fix --verify -> valid, 0 errors. Planted controls: a corrupted pin -> unreachable-pin error (plain read mode did NOT catch it; verify mode did); an untracked uses: ref -> ref-changed error. actionlint message set unchanged on all 9 edited workflows. Refs #401 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P48P9ErT8UFFeDUfEQiYV7

coderabbitai · 2026-10-06T13:19:36Z

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 04593da3-7a9d-4826-8aa2-699e99f5dc59

📥 Commits

Reviewing files that changed from the base of the PR and between a71aa2c and 010c7ba.

⛔ Files ignored due to path filters (1)

.github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (9)

.github/workflows/governance.yml
.github/workflows/hypatia-scan.yml
.github/workflows/mirror.yml
.github/workflows/rust-ci.yml
.github/workflows/scorecard.yml
.github/workflows/secret-scanner.yml
.github/workflows/spark-theatre-gate.yml
.github/workflows/static-analysis-gate.yml
.github/workflows/zig-ffi-ci.yml

 _______________________________________________
< Finding more bugs than your brain at 4:00 pm. >
 -----------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

standards@5751b97e's governance-reusable R5 canonical-reference step exits 1 silently under the runner's `bash -e` whenever an include file has no match (`out=$(grep …)` aborts before `rc=$?`), and adds a new UUID v7 conformance job that flags Project.toml's package UUID. Both would land as new reds on main. Hold the six callers at 571cc734; the bump returns once standards fixes R5 and the UUID question is ruled. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P48P9ErT8UFFeDUfEQiYV7

coderabbitai · 2026-10-06T13:46:23Z

Add Carrot credits or activate Agent usage billing to use Autopilot

…eck (#411) ## Summary Removes the remaining python and deno tooling from echidna, and makes the banned-runtime check actually enforce what it claims. The eclexiaiser manifest check moves from a `python3` tomllib heredoc to a tested bun script. `scripts/ban-npm.sh` said deno was banned but never checked for it; it now does, under 5 planted-fixture tests. ## 📌 New pins - Head SHA: **1b2561e0857f06aaea13e69a3d119b217ba1fd59** - **oven-sh/setup-bun@v2.2.0 → 0c5077e51419868618aeaa5fe8019c62421857d6**: a new `actions.lock` entry, plus a workflow entry under `dogfood-gate.yml`. It is the same SHA standards already vets. The lock diff against main is additive only. - bun **1.3.14** via `bun-version:`, matching `mise.lock`. ## Changes - `dogfood-gate.yml` / eclexiaiser job: the python heredoc is replaced by `bun scripts/validate-eclexiaiser.js`, with the same four rejection messages plus a parse-error case. - `dogfood-gate.yml`: a new **Banned-runtime check** job runs `bun test scripts/` and `bash scripts/ban-npm.sh`. It is added to the summary job's `needs:`. - `scripts/ban-npm.sh`: now fails on any `deno.json`, `deno.jsonc` or `deno.lock`. The Deno bare-import warning (which scanned a nonexistent `src/provers/`) and the "Deno approved" text are gone. - `hooks/pre-commit` (the `core.hooksPath` hook): runs `ban-npm.sh` before the `just` check, so it runs even when `just` is missing. - Deleted: - `.github/hooks/pre-commit`: unreferenced; it ran deno lint/check on a path that does not exist. - `.pre-commit-config.yaml`: needs the Python pre-commit framework; `hooks/` is the canonical hook set. - `scripts/build-production.sh`: builds the nonexistent `src/rescript` via `node_modules` and `python3 -m http.server`; referenced nowhere. - `NOTICE`: the `deno.json` dependency line is replaced by the bun scripts line. ## RSR Quality Checklist ### Required - [x] Tests pass: `bun test scripts/` → 12 pass, 0 fail. No Rust code changed, so `cargo test` is not affected. - [x] Code is formatted. The new JS follows the repo's existing style; there is no JS formatter configured. - [x] Linter is clean. `actionlint dogfood-gate.yml` reports only the pre-existing SC2129/SC2295 findings, identical to main. - [x] No banned language patterns: this PR *removes* python, deno and ReScript tooling. (The template text "no npm/bun" predates the estate bun doctrine; bun is the estate runtime.) - [x] No `unsafe` blocks: no Rust touched. - [x] No banned functions. - [x] SPDX headers on all new files (`MPL-2.0`). - [x] No secrets, credentials or `.env` files. ### As Applicable - [ ] Repo deed status/maturity: not applicable, project state unchanged. - [ ] Repo deed ecosystem: not applicable, no integration changed. - [ ] Deed meta / `docs/decisions/`: not applicable, not an architectural decision. - [ ] `ROADMAP.adoc`: not applicable. - [ ] Documentation: not applicable beyond the `NOTICE` line above. - [ ] `TOPOLOGY.md`: not applicable. - [ ] CHANGELOG: not applicable to a tooling-only change. - [x] New dependencies reviewed: `oven-sh/setup-bun` is MIT, CI-only, and not distributed. - [ ] ABI/FFI: not applicable, untouched. ## Testing - **TDD.** `scripts/validate-eclexiaiser.test.js` (7 tests) and `scripts/ban-npm.test.js` (5 tests) were each run RED before the implementation existed. The three deno cases failed before the check was added. Both now give 12 pass / 0 fail. - **CLI.** `bun scripts/validate-eclexiaiser.js eclexiaiser.toml` exits 0 on the repo manifest and 1 on a broken one. - **Lock.** `gh actions-lock --no-fix --verify --json=valid,findings` reports `valid: true`, 0 errors, and 1 warning (`cicd-suite@4c772eb sha-as-ref`, from #410; cicd-suite has no tags). - The lock was regenerated in a scratch copy with `--no-narrow --no-migrate-local-actions --no-interactive`. Write mode was never run in the repo. - Planted control: corrupting the setup-bun commit by one hex digit reports `unreachable-pin`. - **Python check.** `grep -c python dogfood-gate.yml` gives 0. Out of scope, recorded as findings rather than changed here: `echidna-playground/src/PlaygroundServer.affine` still drives `deno serve`/`deno task`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01P48P9ErT8UFFeDUfEQiYV7 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

hyperpolymath changed the title ~~ci: pin every floating action ref and move the standards callers to 5751b97e~~ ci: pin cicd-suite, dtolnay/rust-toolchain and the Hypatia clone (#401) Oct 6, 2026

hyperpolymath enabled auto-merge (squash) October 6, 2026 13:31

hyperpolymath merged commit c28d09a into main Oct 6, 2026
67 of 68 checks passed

hyperpolymath deleted the chore/ci-pins-20261006 branch October 6, 2026 13:34

This was referenced Oct 6, 2026

chore(runtime): purge python and deno tooling; bun validator + ban check #411

Merged

CI: pre-existing reds on main (Cargo Audit, governance linters, 3 startup_failures from lock drift) #401

Open

coderabbitai Bot mentioned this pull request Oct 20, 2026

fix(ci): close actions.lock (Hypatia invalid_actions_lock) by moving stale reusable pins upstream #446

Merged

8 of 9 tasks

Navigation Menu

Repository navigation

ci: pin cicd-suite, dtolnay/rust-toolchain and the Hypatia clone (#401) - #410

ci: pin cicd-suite, dtolnay/rust-toolchain and the Hypatia clone (#401)#410
hyperpolymath merged 2 commits into
mainfrom
chore/ci-pins-20261006

hyperpolymath commented Oct 6, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 6, 2026 •

edited by hyperpolymath

Loading

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

hyperpolymath commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

📌 New pins

Changes

RSR Quality Checklist

Required

As Applicable

Testing

Screenshots

Uh oh!

coderabbitai Bot commented Oct 6, 2026 • edited by hyperpolymath Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

hyperpolymath commented Oct 6, 2026 •

edited

Loading

coderabbitai Bot commented Oct 6, 2026 •

edited by hyperpolymath

Loading