[hyperpolymath]

openssf-compliance.yml fails when any of the thirteen files it checks still contains a {{PLACEHOLDER}} token. This clears them, with no invention.

• Deleted the TEMPLATE INSTRUCTIONS (delete this block before publishing) comment — the template says to delete it, and it is where every legend line lived, so a large share of the reported tokens were the file documenting its own placeholders.
• Filled what the repository itself supplies: owner and repo from the git remote, project name, year, forge, main branch, contact email.
• Removed PGP and website lines. https://github.com/<user>.gpg returns HTTP 200 for every account; with no key uploaded the body is a stub reading "This user hasn't uploaded any GPG keys". No key is published for either account, and commit signing here is SSH — unrelated. The template sanctions this: "Optional: Remove sections that don't apply (e.g. PGP if you don't use it)."\n\nA security policy telling a researcher to encrypt to a key that does not exist is worse than one that does not mention encryption.\n\nWhere applicable, this also fixes a misrouted advisory URL. A previous just init copied already-filled templates out of squisher-corpus, so 51 repositories directed vulnerability reports to hyperpolymath/squisher-corpus — a repository unrelated to the code being reported, meaning the affected maintainer never saw them. Repointed from this repository's own git remote.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

CI failed: The CI build failed due to an unfilled placeholder token in .machine_readable/META.a2ml and a CodeQL configuration error attempting to analyze JavaScript/TypeScript in a non-JS repository.

Overview

Two distinct errors caused CI failures across jobs: an OpenSSF compliance check failure due to unfilled template placeholders in .machine_readable/META.a2ml, and a CodeQL analysis configuration error failing on JavaScript/TypeScript analysis in a repository without JS/TS source files.

Failures

OpenSSF Compliance Placeholder Check (confidence: high)

• Type: build
• Affected jobs: 90326303831
• Related to change: yes
• Root cause: The file .machine_readable/META.a2ml contains unfilled placeholder tokens ({{REPO}} and {{REPO_DESCRIPTION}}) which violate the RSR template compliance gate check.
• Suggested fix: Edit .machine_readable/META.a2ml to replace the {{REPO}} and {{REPO_DESCRIPTION}} placeholders with actual repository details, or run just init locally to populate them.

CodeQL Analysis Configuration Error (confidence: high)

• Type: configuration
• Affected jobs: 90326303199
• Related to change: yes
• Root cause: The CodeQL workflow is configured to analyze JavaScript/TypeScript, but the repository contains no valid JavaScript/TypeScript source files, causing CodeQL extraction to fail.
• Suggested fix: Remove javascript-typescript from the language matrix in .github/workflows/codeql.yml if the repository doesn't use JavaScript/TypeScript.

Summary

• Change-related failures: 2 (1 template compliance failure, 1 CodeQL workflow configuration error)
• Infrastructure/flaky failures: 0
• Recommended action: Populate the remaining placeholder in .machine_readable/META.a2ml and adjust the CodeQL workflow languages matrix to match the repository's actual contents.

Code Review ✅ Approved 1 resolved / 1 findings

Fills and removes RSR template placeholders to satisfy compliance checks, but leaves the README template note self-contradictory regarding token replacement instructions.

✅ 1 resolved

✅ Quality: README template note became self-contradictory after substitution

📄 README.md:7-10
The note previously explained that literal placeholder tokens ({{OWNER}}, {{REPO}}, {{PROJECT_NAME}}) exist and must be replaced before just init. The blind placeholder substitution replaced the examples with their filled values, so it now reads "Placeholder tokens like hyperpolymath, fraying-model-computational-testbed, and fraying-model-computational-testbed are expected" — which is nonsensical (they are not placeholders, and two entries are identical). Since this repo's placeholders are already filled, remove the note (or reword it) rather than leaving contradictory guidance.

Tip

Comment Gitar fix CI to trigger a fix.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}