From 010c7ba6de5230c5f121d6e4c437a8358c46cb3e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 6 Oct 2026 14:18:41 +0100 Subject: [PATCH 1/2] ci: pin every floating action ref and move the standards callers to 5751b97e - zig-ffi-ci: hyperpolymath/cicd-suite/actions/zig-unified-api-adapter-check @main -> @4c772eb2 (main 2026-10-02); the lock carries that SHA. cicd-suite has no tags, so a bare SHA is the only immutable form (the tool's sha-as-ref warning stays). - rust-ci: dtolnay/rust-toolchain@master x4 -> @v1, the ref the other 13 call sites already use, so the lock holds one entry; v1 relocked from 02cb101e to 7e38f4b4 because the tag moved (verify mode: ref-moved x8). - static-analysis-gate: the hypatia clone is pinned to 51ab6496, the commit standards@5751b97e vets as the hypatia-ref default, so the baseline job, hypatia-scan and this gate build one scanner. The clone's stderr is no longer discarded. - six standards reusable callers: 571cc734 (2026-08-04, 398 commits behind) -> 5751b97e (2026-10-06); scorecard's calling job now grants actions: read, which scorecard-reusable requires at that ref. - actions.lock regenerated in a scratch copy and copied by hand: 18 entries; no existing pin changed except the dtolnay relock; every commit is sha1-<40 hex>. Verified: gh actions-lock --no-fix --verify -> valid, 0 errors. Planted controls: a corrupted pin -> unreachable-pin error (plain read mode did NOT catch it; verify mode did); an untracked uses: ref -> ref-changed error. actionlint message set unchanged on all 9 edited workflows. Refs #401 Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01P48P9ErT8UFFeDUfEQiYV7 --- .github/workflows/actions.lock | 15 +++++---------- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/rust-ci.yml | 11 ++++++----- .github/workflows/scorecard.yml | 3 ++- .github/workflows/secret-scanner.yml | 2 +- .github/workflows/spark-theatre-gate.yml | 2 +- .github/workflows/static-analysis-gate.yml | 10 +++++++++- .github/workflows/zig-ffi-ci.yml | 2 +- 10 files changed, 28 insertions(+), 23 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index ce95a606..611eccd0 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -68,7 +68,7 @@ workflows: - 'swatinem/rust-cache@v2.9.2' '.github/workflows/rust-ci.yml': - 'actions/checkout@v7.0.1' - - 'dtolnay/rust-toolchain@master' + - 'dtolnay/rust-toolchain@v1' - 'swatinem/rust-cache@v2.9.2' '.github/workflows/s4-loop.yml': - 'actions/checkout@v7.0.1' @@ -94,7 +94,7 @@ workflows: - 'actions/checkout@v7.0.1' '.github/workflows/zig-ffi-ci.yml': - 'actions/checkout@v7.0.1' - - 'hyperpolymath/cicd-suite@main' + - 'hyperpolymath/cicd-suite@4c772eb235b04455307d5c03cbbc4f45130f7f0f' - 'mlugg/setup-zig@v2.2.1' dependencies: 'actions/attest-build-provenance@v4.2.2': @@ -146,14 +146,9 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' - 'dtolnay/rust-toolchain@master': - ref: 'master' - commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de' - owner_id: 1940490 - repo_id: 260749683 'dtolnay/rust-toolchain@v1': ref: 'v1' - commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de' + commit: 'sha1-7e38f4b43b4db5c8dd498af069a4f6196df1d067' owner_id: 1940490 repo_id: 260749683 'erlef/setup-beam@v1.24.1': @@ -176,9 +171,9 @@ dependencies: commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d' owner_id: 75048950 repo_id: 623796603 - 'hyperpolymath/cicd-suite@main': + 'hyperpolymath/cicd-suite@4c772eb235b04455307d5c03cbbc4f45130f7f0f': ref: 'main' - commit: 'sha1-d9ebcf99ad4593611b4fa0e18f09b03801f200e8' + commit: 'sha1-4c772eb235b04455307d5c03cbbc4f45130f7f0f' owner_id: 6759885 repo_id: 1326697643 'mlugg/setup-zig@v2.2.1': diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index d29d77de..a34aedab 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -18,4 +18,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5751b97ed597e560573242f56f1287db159edd00 # main 2026-10-06 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 220a6d90..34ea37a2 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -21,5 +21,5 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5751b97ed597e560573242f56f1287db159edd00 # main 2026-10-06 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: inherit diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 72f69c35..bf270b64 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -24,5 +24,5 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@5751b97ed597e560573242f56f1287db159edd00 # main 2026-10-06 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: inherit diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index acdafcc8..3d9b71f1 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -78,12 +78,13 @@ jobs: ref: ${{ github.ref }} - name: Install Rust toolchain - # `toolchain:` is mandatory because the action is pinned by commit SHA: + # `toolchain:` is mandatory because the ref is `@v1` (pinned to a commit + # through actions.lock), not a toolchain name: # dtolnay/rust-toolchain infers the toolchain from the `@`-ref (e.g. # `@stable`), but a SHA ref carries no version, so the action's "parse # toolchain version" step fails with `'toolchain' is a required input`. # See standards estate-wide rust-ci red. - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@v1 with: toolchain: stable components: clippy, rustfmt @@ -132,7 +133,7 @@ jobs: - name: Install Rust toolchain # `toolchain:` mandatory under SHA pin — see Cargo check job above. - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@v1 with: toolchain: stable @@ -183,7 +184,7 @@ jobs: - name: Install Rust toolchain # `toolchain:` mandatory under SHA pin — see Cargo check job above. - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@v1 with: toolchain: stable @@ -219,7 +220,7 @@ jobs: - name: Install Rust toolchain # `toolchain:` mandatory under SHA pin — see Cargo check job above. - uses: dtolnay/rust-toolchain@master + uses: dtolnay/rust-toolchain@v1 with: toolchain: stable components: llvm-tools-preview diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 075b227d..bb2db186 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -22,8 +22,9 @@ jobs: # contents: read must be restated here — the reusable declares it # (checkout needs it) and startup-fails if the caller doesn't grant it. permissions: + actions: read security-events: write id-token: write contents: read - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5751b97ed597e560573242f56f1287db159edd00 # main 2026-10-06 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: inherit diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 82b73b42..3f358b65 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -23,5 +23,5 @@ jobs: # caller must grant at least that or the run startup-fails. permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@5751b97ed597e560573242f56f1287db159edd00 # main 2026-10-06 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: inherit diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml index 96143b0e..8f955f19 100644 --- a/.github/workflows/spark-theatre-gate.yml +++ b/.github/workflows/spark-theatre-gate.yml @@ -20,7 +20,7 @@ permissions: jobs: spark-theatre-gate: - uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@5751b97ed597e560573242f56f1287db159edd00 # main 2026-10-06 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) with: paths: "." enforce_zero_contract: false diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml index 30e75ac7..da86cda2 100644 --- a/.github/workflows/static-analysis-gate.yml +++ b/.github/workflows/static-analysis-gate.yml @@ -166,8 +166,16 @@ jobs: - name: Clone and build Hypatia id: build continue-on-error: true + env: + # Pinned to the hypatia commit that standards@5751b97e vets as the default + # for hypatia-scan-reusable.yml and the governance baseline job; move all + # three together so one scanner build produces the baseline and this gate. + HYPATIA_REF: 51ab6496bf47e30a0576d503df31fec30f3cfe56 run: | - git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" 2>/dev/null || true + git init -q "$HOME/hypatia" \ + && git -C "$HOME/hypatia" fetch -q --depth 1 https://github.com/hyperpolymath/hypatia.git "$HYPATIA_REF" \ + && git -C "$HOME/hypatia" checkout -q FETCH_HEAD \ + || true if [ -f "$HOME/hypatia/mix.exs" ]; then cd "$HOME/hypatia" # Build escript if neither hypatia nor hypatia-v2 exists diff --git a/.github/workflows/zig-ffi-ci.yml b/.github/workflows/zig-ffi-ci.yml index 2d783fb9..e2f41955 100644 --- a/.github/workflows/zig-ffi-ci.yml +++ b/.github/workflows/zig-ffi-ci.yml @@ -59,4 +59,4 @@ jobs: persist-credentials: false - name: Zig unified-api-adapter check (hyperpolymath/cicd-suite) - uses: hyperpolymath/cicd-suite/actions/zig-unified-api-adapter-check@main + uses: hyperpolymath/cicd-suite/actions/zig-unified-api-adapter-check@4c772eb235b04455307d5c03cbbc4f45130f7f0f # main 2026-10-02 From 5e9f5a9911bddff915681514553d011573c80310 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 6 Oct 2026 14:26:29 +0100 Subject: [PATCH 2/2] ci: keep standards reusables at 571cc734 until the R5 gate is fixed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit standards@5751b97e's governance-reusable R5 canonical-reference step exits 1 silently under the runner's `bash -e` whenever an include file has no match (`out=$(grep …)` aborts before `rc=$?`), and adds a new UUID v7 conformance job that flags Project.toml's package UUID. Both would land as new reds on main. Hold the six callers at 571cc734; the bump returns once standards fixes R5 and the UUID question is ruled. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01P48P9ErT8UFFeDUfEQiYV7 --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- .github/workflows/spark-theatre-gate.yml | 2 +- .github/workflows/static-analysis-gate.yml | 6 +++--- 7 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index a34aedab..d29d77de 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -18,4 +18,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5751b97ed597e560573242f56f1287db159edd00 # main 2026-10-06 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 34ea37a2..220a6d90 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -21,5 +21,5 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5751b97ed597e560573242f56f1287db159edd00 # main 2026-10-06 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: inherit diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index bf270b64..72f69c35 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -24,5 +24,5 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@5751b97ed597e560573242f56f1287db159edd00 # main 2026-10-06 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: inherit diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index bb2db186..d30a4a1c 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -26,5 +26,5 @@ jobs: security-events: write id-token: write contents: read - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5751b97ed597e560573242f56f1287db159edd00 # main 2026-10-06 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: inherit diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 3f358b65..82b73b42 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -23,5 +23,5 @@ jobs: # caller must grant at least that or the run startup-fails. permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@5751b97ed597e560573242f56f1287db159edd00 # main 2026-10-06 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: inherit diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml index 8f955f19..96143b0e 100644 --- a/.github/workflows/spark-theatre-gate.yml +++ b/.github/workflows/spark-theatre-gate.yml @@ -20,7 +20,7 @@ permissions: jobs: spark-theatre-gate: - uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@5751b97ed597e560573242f56f1287db159edd00 # main 2026-10-06 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) + uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) with: paths: "." enforce_zero_contract: false diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml index da86cda2..6f335965 100644 --- a/.github/workflows/static-analysis-gate.yml +++ b/.github/workflows/static-analysis-gate.yml @@ -167,9 +167,9 @@ jobs: id: build continue-on-error: true env: - # Pinned to the hypatia commit that standards@5751b97e vets as the default - # for hypatia-scan-reusable.yml and the governance baseline job; move all - # three together so one scanner build produces the baseline and this gate. + # Pinned to the hypatia commit standards@5751b97e vets as its default. + # When the standards callers move to that ref, the governance baseline + # job and this gate build the same scanner; move them together. HYPATIA_REF: 51ab6496bf47e30a0576d503df31fec30f3cfe56 run: | git init -q "$HOME/hypatia" \