Repository navigation
Claude/new session th4e9w lockregen - #441
Conversation
Resolves the slsa-github-generator and panic-attack records with a real token; the lock reaches main in a reviewed PR. This branch is deleted after use. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
… for merge) panic-attack's own scratch run hits startup_failure; panic-attack is public, so its lock can be resolved with this repo's token. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
…merge) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
… chain (not for merge) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 59 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bc0ee87ee9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| (cd pb && ACTIONS_LOCK_VERIFIER="$PWD/../std-gate/scripts/update-actions-lock.sh" \ | ||
| bash ../std-gate/scripts/check-actions-lock-gate.sh .github/workflows); echo "GATE_RC=$?" |
There was a problem hiding this comment.
When the generated lock fails the governance gate, the default GitHub Actions Bash shell still has errexit enabled, and set -uo pipefail does not disable it. A nonzero gate result therefore terminates the step at this subshell, so GATE_RC, the hash, and the LOCK-BEGIN payload are never printed—preventing inspection of the generated lock in exactly the failure case this diagnostic workflow needs to expose. Capture the status through an if or || branch before continuing.
Useful? React with 👍 / 👎.
| # Start from no lock: main's pins v1 at a commit the tag no longer | ||
| # names, which gh actions-lock rejects as a conflicting target. | ||
| rm -f pb/.github/workflows/actions.lock | ||
| (cd pb && { gh actions-lock >&2 || echo "seed gh actions-lock RC=$?"; }) |
There was a problem hiding this comment.
When the target branch contains broad refs such as the @v1 reference mentioned above or local ./ actions, this unqualified fix run can rewrite the checked-out workflow files while generating the lock; the upstream tool documents that fix runs migrate local-action references by default, and v0.2.0 also narrows resolvable refs (gh-actions-lock usage, v0.2.0 release). The later gate consequently validates the rewritten working tree, but this job emits only actions.lock, so copying that payload into the unchanged repair branch can produce a lock that no longer matches its workflows. Disable these rewrites (for example with the tool's no-narrow/no-migration options) or emit and transfer every workflow change as well.
Useful? React with 👍 / 👎.
| # actions.lock with the estate repair order (regen_lock in | ||
| # standards/scripts/regen-dependabot-locks.sh), runs the governance gate's own | ||
| # check against the result, and prints the lock base64-encoded. It has no | ||
| # `uses:` steps, so it needs no lock entry to start. It writes nothing back: |
There was a problem hiding this comment.
This repository enforces lock coverage by workflow path, including dependency-free workflows: the existing lock contains empty entries for label-triage.yml and labels.yml, and those workflows document that an unlisted path is rejected with startup_failure. This commit adds zz-one-off-lock-regen.yml without adding its empty entry to .github/workflows/actions.lock, so the push intended to launch this one-off can be rejected before the job starts; having no uses: steps only means the entry has no dependencies, not that the path can be omitted.
Useful? React with 👍 / 👎.
actions.lock v0.0.3 named two job-level reusable refs under `workflows:` with no top-level record (slsa-github-generator@f7dd8c54 and panic-attack@b689a74). Hypatia at aa34a4cc reports that as invalid_actions_lock in workflow_audit and workflow_hardening. The estate repair chain (gh actions-lock, relock-sha-keys, complete-job-refs, close-lock, prune-stale; standards 3c00687a) could not close the lock with the old pins. standards@75bd5994 (mirror-reusable.yml) and panic-attack@b689a74 pin dtolnay/rust-toolchain at e2a55d2 and 02cb101e. dtolnay moved its v1 tag, and no tag names either commit any more, so close-lock refuses to write their leaf records. Upstream main of both repos pins 683b588, the current v1, so the callers move there: - security-scan.yml: panic-attack scan-and-report.yml -> 8955f615 (one line changes in the called file: the dtolnay pin) - governance, hypatia-scan, mirror, scorecard, secret-scanner and spark-theatre-gate: standards reusables -> 3c00687a (standards#1315, hypatia-ref aa34a4cc; same workflow_call inputs and secrets) The lock is the chain's output for this exact tree, generated in CI (sha256 58d32e2d...). It was not edited by hand. Measured in that run: close-lock reports 0 dangling refs, check-lock-sync.sh passes, check-actions-lock-gate.sh passes at 75bd5994 and at 3c00687a, and the Hypatia scan at aa34a4cc finds 0 invalid_actions_lock (2 before). Raw `gh actions-lock --verify` (v0.2.0) still flags the job-level reusable records as unused, on main's lock too. It cannot see job-level `uses:`. The estate verifier (update-actions-lock.sh --verify-local) accepts that coverage and passes. The one-off lock-regen workflow left behind by #441 is deleted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015jzCHZx4Rt65NDaGLDrjLp
…stale reusable pins upstream (#446) ## Summary `.github/workflows/actions.lock` (v0.0.3) was not transitively closed. It listed two job-level reusable refs under `workflows:`, and neither had a top-level record: - `slsa-framework/slsa-github-generator@f7dd8c54…` (`generator-generic-ossf-slsa3-publish.yml`) - `hyperpolymath/panic-attack@b689a74…` (`security-scan.yml`) Since hyperpolymath/hypatia#938 (scanner `aa34a4cc`), Hypatia reports this as `invalid_actions_lock` / `{:workflow_dependencies_missing, …}` in both `workflow_audit` and `workflow_hardening`. That keeps `governance / Validate Hypatia Baseline` red once the hypatia-ref bump from hyperpolymath/standards#1315 lands. **Why the lock couldn't simply be regenerated.** I ran the estate repair chain (`gh actions-lock` → `relock-sha-keys` → `complete-job-refs` → `close-lock` → `prune-stale`, standards `3c00687a`) on main's pins. close-lock stops with exit 3 on two leaf refs: - `dtolnay/rust-toolchain@e2a55d2…`: pinned by standards@75bd5994 `mirror-reusable.yml` - `dtolnay/rust-toolchain@02cb101e…`: pinned by panic-attack@b689a74 `scan-and-report.yml` dtolnay moved its `v1` tag, so no tag names either commit any more. close-lock correctly refuses to write a self-SHA leaf (cf. standards cf8f9121). Upstream main of both repos now pins `683b588`, the current `v1`. The fix is therefore to move the stale caller pins, then run the chain again. ## Changes - `security-scan.yml`: panic-attack `scan-and-report.yml` `b689a74` → `8955f615`. Only one line changes in the called file: the dtolnay pin. - `governance`, `hypatia-scan`, `mirror`, `scorecard`, `secret-scanner`, `spark-theatre-gate`: standards reusables `75bd5994` → `3c00687a` (standards#1315). This also brings in `hypatia-ref` `aa34a4cc`. The `workflow_call` inputs and secrets are unchanged; `hypatia-scan-reusable` gains a `verdict` output. - `actions.lock`: the chain's output for this exact tree, regenerated in CI (sha256 `58d32e2d…`). It was not edited by hand. - Deleted `zz-one-off-lock-regen.yml`, a scratch workflow left behind by #441. It was reused on this branch to run the chain (this session has no GitHub API access), then removed. ## RSR Quality Checklist ### Required - [x] Tests pass: no code changes; lock checks below - [x] Code is formatted: workflow lines changed only in their pin and comment - [x] Linter is clean: `actionlint` clean on all workflows - [x] No banned language patterns - [x] No `unsafe` blocks without `// SAFETY:` comments: n/a - [x] No banned functions: n/a - [x] SPDX license headers present on all new/modified source files - [x] No secrets, credentials, or `.env` files included ### As Applicable - [ ] Docs/deeds/roadmap: n/a (CI pins only) ## Testing Measured in [run 39423933176](https://github.com/hyperpolymath/echidna/actions/runs/39423933176), on three variants of the caller pins: | Variant | close-lock | check-lock-sync, gate @75bd59 and @3c00687a | Hypatia@aa34a4cc `invalid_actions_lock` | |---|---|---|---| | v0: pins as on main | 2 unresolvable | pass | 2 → 2 | | v1: panic-attack bump only | 1 unresolvable (`e2a55d2`) | pass | 2 → 2 | | **v2: this PR** | **0 dangling** (re-run idempotent) | **pass** | **2 → 0** | - Locally, on the final tree: `check-lock-sync.sh` passes, and an independent count of edges with no matching key gives 0. - Known gap: raw `gh actions-lock --verify` (v0.2.0) fails on every variant, main's current lock included. It cannot see job-level reusable `uses:`, so it calls exactly the records close-lock requires "unused". The estate verifier `update-actions-lock.sh --verify-local` (what the governance gate runs) accepts that coverage and passes. With the maintainer's agreement, that wrapper counts as the verify criterion here. - Risk to watch on this PR's CI: callers now run 17 newer standards commits, so Governance or Hypatia may surface new baseline findings unrelated to the lock. --- _Generated by [Claude Code](https://claude.ai/code/session_015jzCHZx4Rt65NDaGLDrjLp)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
… (#442) ## Summary [#441](#441) merged the scratch branch `claude/new-session-th4e9w-lockregen` into `main`. That branch existed only to run `.github/workflows/zz-one-off-lock-regen.yml`. That job clones hyperpolymath/panic-attack, regenerates that repository's `actions.lock` with a real token, and prints the result to the job log. The workflow triggers only on pushes to the scratch branch, so on `main` it is dead weight, and its own header says "scratch branch only, deleted after use". ## Changes - Delete `.github/workflows/zz-one-off-lock-regen.yml`. It has no `uses:` steps, so `actions.lock` needs no change. This branch also used to carry the `Cargo.toml` workspace exclude for `.standards-js/tools/js-runtimes`. [#440](#440) landed the same exclude on `main`. After the merge of `main` into this branch, the diff against `main` is the one deletion above. ## RSR Quality Checklist ### Required - [x] Tests pass (`just test` or equivalent): no code changed. - [x] Code is formatted: no code changed. - [x] Linter is clean: a workflow file is removed, none added. - [x] No banned language patterns. - [x] No `unsafe` blocks without `// SAFETY:` comments. - [x] No banned functions. - [x] SPDX license headers present on all new/modified source files: none added. - [x] No secrets, credentials, or `.env` files included. ### As Applicable - [ ] Repo deed, roadmap, docs, TOPOLOGY, CHANGELOG, dependencies, ABI/FFI: not applicable. ## Testing - `git diff --stat origin/main...HEAD` shows one file, 55 deletions. - `grep -c zz-one-off .github/workflows/actions.lock` is 0 on `main` and on this branch, so the lock gate sees no change. ## Screenshots None. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
2 participants
Summary
Changes
RSR Quality Checklist
Required
just testor equivalent)just fmtor equivalent)unsafeblocks without// SAFETY:commentsbelieve_me,unsafeCoerce,Obj.magic,Admitted,sorry).envfiles includedAs Applicable
*_chora.deed)(status)/(maturity)updated (if project state changed)(ecosystem)updated (if integrations changed)(meta)and/ordocs/decisions/updated (if architectural decisions changed)docs/status/ROADMAP.adocupdated (if milestones or next actions changed)TOPOLOGY.mdupdated (if architecture changed)CHANGELOGor release notes updatedsrc/abi/andffi/zig/consistent)Testing
Screenshots