From 34a02880326035ce5c53280f10328c487c6f826c Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 21:22:55 +0000 Subject: [PATCH 1/5] chore(ci): remove the one-off lock-regeneration workflow merged by #441 zz-one-off-lock-regen.yml was a scratch workflow for a scratch branch: it triggers only on pushes to claude/new-session-th4e9w-lockregen, clones hyperpolymath/panic-attack, and prints a regenerated actions.lock to its log. It was never meant for main and does nothing there. It has no uses: steps, so actions.lock needs no change. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- .github/workflows/zz-one-off-lock-regen.yml | 55 --------------------- 1 file changed, 55 deletions(-) delete mode 100644 .github/workflows/zz-one-off-lock-regen.yml diff --git a/.github/workflows/zz-one-off-lock-regen.yml b/.github/workflows/zz-one-off-lock-regen.yml deleted file mode 100644 index a66359d9..00000000 --- a/.github/workflows/zz-one-off-lock-regen.yml +++ /dev/null @@ -1,55 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# ONE-OFF, scratch branch only, deleted after use. Regenerates panic-attack's fix branch's -# actions.lock with the estate repair order (regen_lock in -# standards/scripts/regen-dependabot-locks.sh), runs the governance gate's own -# check against the result, and prints the lock base64-encoded. It has no -# `uses:` steps, so it needs no lock entry to start. It writes nothing back: -# the lock reaches the repository in a reviewed PR. -name: one-off actions.lock regeneration -on: - push: - branches: [claude/new-session-th4e9w-lockregen] -permissions: - contents: read -jobs: - regen: - runs-on: ubuntu-latest - timeout-minutes: 20 - env: - GH_TOKEN: ${{ github.token }} - REPO: hyperpolymath/panic-attack - STANDARDS_REGEN_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7 - STANDARDS_GATE_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7 - steps: - - name: Regenerate the repair branch's actions.lock and check it with the gate - run: | - set -uo pipefail - git clone --quiet --branch claude/new-session-th4e9w https://github.com/hyperpolymath/panic-attack.git pb - git -C pb log --oneline -1 - git clone --quiet https://github.com/hyperpolymath/standards.git std - git -C std worktree add --quiet --detach ../std-regen "$STANDARDS_REGEN_SHA" - git -C std worktree add --quiet --detach ../std-gate "$STANDARDS_GATE_SHA" - sudo apt-get install -y -qq gawk >/dev/null - gh extension install github/gh-actions-lock --pin v0.2.0 - gh actions-lock --version - # Full estate regen (gh actions-lock first, which also migrates the - # format to v0.0.3, then the repair chain). - export GH_BIN=gh REGEN_TOOLS="$PWD/std-regen/scripts" - # Start from no lock: main's pins v1 at a commit the tag no longer - # names, which gh actions-lock rejects as a conflicting target. - rm -f pb/.github/workflows/actions.lock - (cd pb && { gh actions-lock >&2 || echo "seed gh actions-lock RC=$?"; }) - test -f pb/.github/workflows/actions.lock && echo SEEDED - source std-regen/scripts/regen-dependabot-locks.sh - outcome="$(regen_lock "$PWD/pb" || true)" - echo "OUTCOME=$outcome" - (cd pb && { bash ../std-regen/scripts/check-lock-sync.sh .github/workflows && echo "SYNC RC=0" || echo "SYNC RC=$?"; }) - head -5 pb/.github/workflows/actions.lock - git -C pb status --porcelain - echo "== the governance gate, as pinned by the repair branch ($STANDARDS_GATE_SHA)" - (cd pb && ACTIONS_LOCK_VERIFIER="$PWD/../std-gate/scripts/update-actions-lock.sh" \ - bash ../std-gate/scripts/check-actions-lock-gate.sh .github/workflows); echo "GATE_RC=$?" - echo "LOCK-SHA256 $(sha256sum < pb/.github/workflows/actions.lock | cut -d' ' -f1)" - echo "LOCK-BEGIN" - cat pb/.github/workflows/actions.lock - echo "LOCK-END" From 3947b038de0e3a30db4fc0359dc7d3e13fff19cf Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2026 22:25:08 +0000 Subject: [PATCH 2/5] fix(ci): exclude standalone JS runtime checker from Cargo workspace --- Cargo.toml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Cargo.toml b/Cargo.toml index 36417740..d32abb40 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -156,5 +156,7 @@ members = [ "src/interfaces/rest", ] exclude = [ + # Governance builds this standalone checker from a sparse Standards checkout. + ".standards-js/tools/js-runtimes", "fuzz", ] From 4bcd32837550954f1239b6c777778cdd3a712252 Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2026 22:26:10 +0000 Subject: [PATCH 3/5] fix(build): exclude the standards js-runtimes tool from the Cargo workspace --- Cargo.toml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Cargo.toml b/Cargo.toml index d32abb40..8a934c82 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -159,4 +159,6 @@ exclude = [ # Governance builds this standalone checker from a sparse Standards checkout. ".standards-js/tools/js-runtimes", "fuzz", + # Governance builds this tool from a sparse standards checkout inside our tree. + ".standards-js/tools/js-runtimes", ] From 2f5153400cec99ee4f2b0575d947ff587663778c Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 22:33:27 +0000 Subject: [PATCH 4/5] chore(build): fold the duplicated js-runtimes workspace exclude into one entry The two CI-fix commits each added the same `.standards-js/tools/js-runtimes` line with its own comment. One entry, with a note on why it exists and when it can go (the governance pin reaching hyperpolymath/standards#1299, which makes that crate its own workspace root). Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- Cargo.toml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 8a934c82..1095411a 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -156,9 +156,10 @@ members = [ "src/interfaces/rest", ] exclude = [ - # Governance builds this standalone checker from a sparse Standards checkout. - ".standards-js/tools/js-runtimes", "fuzz", - # Governance builds this tool from a sparse standards checkout inside our tree. + # The governance reusable checks hyperpolymath/standards out at .standards-js + # and builds tools/js-runtimes from there; at the pinned standards commit that + # crate is not its own workspace root, so this keeps it out of ours. Remove + # once the governance pin reaches hyperpolymath/standards#1299. ".standards-js/tools/js-runtimes", ] From b9357068f2ba5da102fb1a10eb891591485fdf23 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 22:47:21 +0000 Subject: [PATCH 5/5] chore(build): spell the js-runtimes workspace exclude as #440 does #440 carries the same exclude (its CI-fix commit 78a70c2) and merges first; byte-identical text here means the two land without a conflict. It can go once the governance pin reaches hyperpolymath/standards#1299, which makes that crate its own workspace root. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- Cargo.toml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 1095411a..228eba6d 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -157,9 +157,6 @@ members = [ ] exclude = [ "fuzz", - # The governance reusable checks hyperpolymath/standards out at .standards-js - # and builds tools/js-runtimes from there; at the pinned standards commit that - # crate is not its own workspace root, so this keeps it out of ours. Remove - # once the governance pin reaches hyperpolymath/standards#1299. + # The governance workflow builds this external checker in a nested checkout. ".standards-js/tools/js-runtimes", ]