Skip to content

Commit 5ca67f1

Browse files
author
Arena Agent
committed
Merge branch main and security improvements into fix/restore-fixer-and-clear-path-scars
2 parents c189b2a + b13d0e0 commit 5ca67f1

62 files changed

Lines changed: 884 additions & 974 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/dependabot.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ updates:
99
actions:
1010
patterns:
1111
- "*"
12+
open-pull-requests-limit: 2
1213

1314
# Rust dependencies. Keep every Cargo project in one update entry so the
1415
# open-PR limit applies to the fleet as a whole, rather than once per bot.

‎.github/workflows/actions.lock‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,13 @@ workflows:
1212
- 'actions/deploy-pages@v5.0.0'
1313
- 'actions/download-artifact@v8.0.1'
1414
- 'actions/upload-pages-artifact@v5.0.0'
15+
- 'haskell-actions/setup@v2.12.0'
1516
'.github/workflows/codeql.yml':
1617
- 'actions/checkout@v7.0.1'
1718
- 'github/codeql-action@v4.37.8'
1819
'.github/workflows/dogfood-gate.yml':
1920
- 'actions/checkout@v7.0.1'
20-
- 'hyperpolymath/a2ml-ecosystem@main'
21+
- 'hyperpolymath/deed-ecosystem@main'
2122
- 'hyperpolymath/k9-ecosystem@main'
2223
'.github/workflows/e2e.yml':
2324
- 'actions/checkout@v7.0.1'
@@ -50,7 +51,11 @@ workflows:
5051
- 'actions/checkout@v7.0.1'
5152
'.github/workflows/rust.yml':
5253
- 'actions/checkout@v7.0.1'
53-
'.github/workflows/scorecard.yml': []
54+
'.github/workflows/scorecard.yml':
55+
- 'actions/checkout@v7.0.1'
56+
- 'actions/upload-artifact@v7.0.1'
57+
- 'github/codeql-action@v4.37.8'
58+
- 'ossf/scorecard-action@v2.4.4'
5459
'.github/workflows/secret-scanner.yml': []
5560
'.github/workflows/supervised-fleet-scan.yml':
5661
- 'actions/checkout@v7.0.1'
@@ -107,21 +112,31 @@ dependencies:
107112
commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
108113
owner_id: 9919
109114
repo_id: 259445878
110-
'hyperpolymath/a2ml-ecosystem@main':
115+
'haskell-actions/setup@v2.12.0':
116+
ref: 'v2.12.0'
117+
commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d'
118+
owner_id: 75048950
119+
repo_id: 623796603
120+
'hyperpolymath/deed-ecosystem@main':
111121
ref: 'main'
112-
commit: 'sha1-aa4b836bd969df2bc58128cb8e3d20bbc88d5e79'
122+
commit: 'sha1-f7a40a4d5cc82b2e73f861119baa6818d77a448d'
113123
owner_id: 6759885
114124
repo_id: 1275649586
115125
'hyperpolymath/k9-ecosystem@main':
116126
ref: 'main'
117-
commit: 'sha1-89f3c2702f4f650a92aa7411502f38da06abd562'
127+
commit: 'sha1-2155aa26a21758f2ba119f61bc7e0e1981c106fb'
118128
owner_id: 6759885
119129
repo_id: 1275650185
120130
'hyperpolymath/smtp-notify-action@v0.2.0':
121131
ref: 'v0.2.0'
122132
commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7'
123133
owner_id: 6759885
124134
repo_id: 1352485172
135+
'ossf/scorecard-action@v2.4.4':
136+
ref: 'v2.4.4'
137+
commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
138+
owner_id: 67707773
139+
repo_id: 421101922
125140
'peter-evans/repository-dispatch@v4.0.1':
126141
ref: 'v4.0.1'
127142
commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'

‎.github/workflows/boj-build.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.

‎.github/workflows/casket-pages.yml‎

Lines changed: 19 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
name: GitHub Pages
@@ -32,7 +33,7 @@ jobs:
3233
uses: actions/checkout@v7.0.1
3334
with:
3435
repository: hyperpolymath/casket-ssg
35-
ref: 4abfd39c78c2eee9de62d658646607877b3ee157 # main 2026-09-03
36+
ref: cec3c20d80ea1dc93660b69a4e7b38aa49f2a56b # standalone build; optional liblol bridge
3637
path: .casket-ssg
3738
persist-credentials: false
3839

@@ -45,6 +46,13 @@ jobs:
4546
.casket-ssg/dist-newstyle
4647
key: ${{ runner.os }}-casket-${{ hashFiles('.casket-ssg/casket-ssg.cabal') }}
4748

49+
# Explicitly allowed by repository policy; actions.lock pins its commit.
50+
- name: Select tested Haskell toolchain
51+
uses: haskell-actions/setup@v2.12.0
52+
with:
53+
ghc-version: '9.6.6'
54+
cabal-version: '3.10.3.0'
55+
4856
- name: Prepare runner Haskell toolchain
4957
run: |
5058
set -euo pipefail
@@ -54,10 +62,12 @@ jobs:
5462
5563
- name: Build casket-ssg
5664
working-directory: .casket-ssg
57-
run: cabal build
65+
run: cabal build --index-state=2026-09-06T00:00:00Z
5866

5967
- name: Prepare site source
6068
shell: bash
69+
env:
70+
CONTENT_REF: ${{ github.event_name == 'pull_request' && github.sha || github.ref_name }}
6171
run: |
6272
set -euo pipefail
6373
rm -rf .site-src _site
@@ -72,9 +82,9 @@ jobs:
7282
README_URL=""
7383
7484
if [ -f README.md ]; then
75-
README_URL="${REPO_URL}/blob/${{ github.ref_name }}/README.md"
85+
README_URL="${REPO_URL}/blob/${CONTENT_REF}/README.md"
7686
elif [ -f README.adoc ]; then
77-
README_URL="${REPO_URL}/blob/${{ github.ref_name }}/README.adoc"
87+
README_URL="${REPO_URL}/blob/${CONTENT_REF}/README.adoc"
7888
fi
7989
8090
{
@@ -92,7 +102,7 @@ jobs:
92102
echo "- README: [project README](${README_URL})"
93103
fi
94104
if [ -d docs ]; then
95-
echo "- Docs directory: [docs/](${REPO_URL}/tree/${{ github.ref_name }}/docs)"
105+
echo "- Docs directory: [docs/](${REPO_URL}/tree/${CONTENT_REF}/docs)"
96106
fi
97107
echo
98108
echo "Project-specific site content can be added later under site/."
@@ -102,7 +112,7 @@ jobs:
102112
- name: Build site
103113
run: |
104114
mkdir -p _site
105-
cd .casket-ssg && cabal run casket-ssg -- build ../.site-src ../_site
115+
cd .casket-ssg && cabal run --index-state=2026-09-06T00:00:00Z casket-ssg -- build ../.site-src ../_site
106116
touch ../_site/.nojekyll
107117
108118
- name: Setup Pages
@@ -114,10 +124,8 @@ jobs:
114124
path: '_site'
115125

116126
preview:
117-
name: Validate deployable Pages preview
127+
name: Validate Pages artifact
118128
if: github.event_name == 'pull_request'
119-
environment:
120-
name: pages-preview
121129
runs-on: ubuntu-24.04
122130
needs: build
123131
timeout-minutes: 10
@@ -155,7 +163,7 @@ jobs:
155163
echo "::error::Pages artifact contains an unsafe path: ${entry}"
156164
exit 1
157165
;;
158-
index.html|*/index.html)
166+
index.html|./index.html)
159167
has_index=1
160168
;;
161169
esac
@@ -195,4 +203,4 @@ jobs:
195203
steps:
196204
- name: Deploy to GitHub Pages
197205
id: deployment
198-
uses: actions/deploy-pages@v5.0.0
206+
uses: actions/deploy-pages@v5.0.1

‎.github/workflows/codeql.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -47,12 +48,12 @@ jobs:
4748
uses: actions/checkout@v7.0.1
4849

4950
- name: Initialize CodeQL
50-
uses: github/codeql-action/init@v4.37.8
51+
uses: github/codeql-action/init@v4.38.0
5152
with:
5253
languages: ${{ matrix.language }}
5354
build-mode: ${{ matrix.build-mode }}
5455

5556
- name: Perform CodeQL Analysis
56-
uses: github/codeql-action/analyze@v4.37.8
57+
uses: github/codeql-action/analyze@v4.38.0
5758
with:
5859
category: "/language:${{ matrix.language }}"

‎.github/workflows/dogfood-gate.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -46,7 +47,7 @@ jobs:
4647
4748
- name: Validate A2ML manifests
4849
if: steps.detect.outputs.count > 0
49-
uses: hyperpolymath/a2ml-ecosystem/validate-action@main
50+
uses: hyperpolymath/deed-ecosystem/validate-action@main
5051
with:
5152
path: '.'
5253
strict: 'false'
@@ -150,7 +151,7 @@ jobs:
150151
# Checks for: zero-width spaces, zero-width joiners, BOM, soft hyphens,
151152
# non-breaking spaces, null bytes, and other invisible Unicode in source files.
152153
set +e
153-
PATTERNS='\xc2\xa0|\xe2\x80\x8b|\xe2\x80\x8c|\xe2\x80\x8d|\xef\xbb\xbf|\xc2\xad|\xe2\x80\x8e|\xe2\x80\x8f|\xe2\x80\xaa|\xe2\x80\xab|\xe2\x80\xac|\xe2\x80\xad|\xe2\x80\xae|\x00'
154+
PATTERNS='(*UTF)[\x00-\x08\x0B\x0C\x0E-\x1F\x{a0}\x{ad}\x{200b}-\x{200f}\x{202a}-\x{202f}\x{2060}\x{2066}-\x{2069}\x{feff}]'
154155
find "$GITHUB_WORKSPACE" \
155156
-not -path '*/.git/*' -not -path '*/node_modules/*' \
156157
-not -path '*/.deno/*' -not -path '*/target/*' \
@@ -161,7 +162,7 @@ jobs:
161162
-o -name '*.yml' -o -name '*.yaml' -o -name '*.md' -o -name '*.adoc' \
162163
-o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \
163164
-o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \
164-
-exec grep -Prl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null
165+
-exec grep -aPl "$PATTERNS" {} + > /tmp/empty-lint-results.txt 2>/dev/null
165166
EL_EXIT=$?
166167
set -e
167168

‎.github/workflows/e2e.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -21,3 +22,5 @@ jobs:
2122
run: pip install pyyaml --quiet
2223
- name: Run E2E tests
2324
run: bash tests/e2e.sh
25+
- name: Verify canonical descriptile policy repair
26+
run: bash tests/retired-descriptile-policy-test.sh

‎.github/workflows/governance.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -34,4 +35,4 @@ permissions:
3435

3536
jobs:
3637
governance:
37-
uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 # main 2026-09-04
38+
uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540

‎.github/workflows/hypatia-dispatch-intake.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.

‎.github/workflows/hypatia-scan.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# This workflow is managed by gh actions-lock.
12
# SPDX-License-Identifier: MPL-2.0
23
# This workflow is managed by gh actions-lock.
34
# This workflow is managed by gh actions-lock.
@@ -30,7 +31,7 @@ permissions:
3031

3132
jobs:
3233
hypatia:
33-
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
34+
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540
3435
secrets: inherit
3536
# Total caller-side wall-clock cap for the reusable. Matches
3637
# Hypatia's `missing_timeout_minutes` rule expectation. The scan is

0 commit comments

Comments
 (0)