Repository navigation
fix(ci): close the governance gate — SPDX, permissions, SHA pins, reusable bump - #24
Merged
Merged
Conversation
…sable bump The governance gate is all-jobs-must-pass, so these ship as one commit; individually none of them turns the repo green. * SPDX line-1 header and a top-level `permissions:` block on every workflow file (the two `Workflow security linter` checks). * Every `uses:` tag reference resolved to a full 40-hex commit SHA. This satisfies the linter and also the repository's own `sha_pinning_required` Actions policy, which refuses `@v4` at parse time — a refusal that produces no check run at all. * `hypatia-scan.yml` now grants `security-events: write`. This is not cosmetic and is not separable from the pin bump below: at HEAD the reusable declares `security-events: write` where the old pin declared `read`, and a called workflow cannot escalate beyond its caller's grant. Bumping the pin without this would fail at parse time. * The three reusables watched by the staleness gate (governance, hypatia-scan, scorecard) advanced to standards HEAD, which is 62 commits ahead of the false-green cache fix and includes the deny-list-negative fix from standards#524. `mirror-reusable` and `secret-scanner-reusable` are deliberately left on their current pins: the staleness gate does not watch them, so they are not holding anything red, and bumping them carries unrelated risk. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This was referenced Jul 27, 2026
hyperpolymath
added a commit
that referenced
this pull request
Jul 27, 2026
## Problem Three workflows on `main` fail with `startup_failure` — rejected by Actions at parse time, so **zero steps run**. They are identifiable because GitHub names the run after the *file path* rather than the workflow's `name:`: ``` failure .github/workflows/rsr-antipattern.yml failure .github/workflows/boj-build.yml failure .github/workflows/e2e.yml ``` Note `gh pr checks` does **not** surface these — a parse-rejected workflow produces no check run at all. Measure with `gh run list --json name,conclusion`. ## Three independent causes | Workflow | Root cause | |---|---| | `e2e.yml` | `jobs:` present but **every job is commented out** → zero live jobs → invalid | | `rsr-antipattern.yml` | calls `hyperpolymath/standards/.github/workflows/rsr-antipattern-reusable.yml@main` — the reusable **does not exist** (HTTP 404) | | `boj-build.yml` | job-level `if:` reads `secrets.BOJ_SERVER_URL`; the **`secrets` context is unavailable in a job-level `if:`** | ## Why deletion is safe - `e2e.yml` had **no live jobs**, so no coverage is lost. - `boj-build.yml` and `rsr-antipattern.yml` **never ran a step**. No currently-passing gate is affected. All `🔴 Gate:` checks stay green. ## Provenance Extracted from `fix/consolidate-dogfood-gate` (which also deletes these three) so it can land on its own — that branch additionally consolidates the dogfood gate and rewrites the Zig/Idris FFI validation, and currently conflicts with #22–#24 on six files. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Jul 27, 2026
Resolves ten conflicts. This branch predates #19-#25, so several of its deletions had gone stale and would have silently removed working CI. Restored from origin/main (branch's deletion was stale — each backs a currently-green check, three of them hard gates): npm-bun-blocker.yml 🔴 Gate: No-npm/bun policy quality.yml 🔴 Gate: Code quality (fmt/lint/test) security-policy.yml 🔴 Gate: Security policy present hypatia-scan.yml 🟡 Check: Hypatia baseline security scan rust-ci.yml 🟡 Check: Rust CI (build/test) pages.yml GitHub Pages (Ddraig SSG) — added by #19, newer mirror.yml ⚙ Auto: Mirror to forges dependabot-automerge.yml Deletion kept: push-email-notify.yml — matches the estate ruling that push-email is removed except for three named dual-use repos. Content conflicts — kept this branch's structure (the point of the PR), then adopted origin/main's newer action pins so #24/#25 are not regressed: governance.yml, trope-check.yml pin-only conflicts -> took origin/main release.yml, dogfood-gate.yml structural -> kept branch, re-pinned Verified: every workflow parses as YAML and declares at least one live job, so no new startup_failure is introduced. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Jul 27, 2026
## What this is Previously-unpushed work that existed **only** in a local worktree whose `.git` pointer was broken (it referenced a stale duplicate clone at `hyper-repos/haec` that has since been deleted). Repaired with `git worktree repair` and pushed here so it is no longer a single local copy. 36 files, ~610 insertions / ~1265 deletions, in two commits: - **`5c25f99`** — consolidates `dogfood-gate.yml` (453 lines → net −310) and repairs the K9 contract envelopes (`coordination.k9`, `session/custom-checks.k9`, `methodology-guard.k9.ncl`, six `template-*`/example `.k9.ncl` files). - **`e5c86e8`** — consolidates gate workflows into `ci.yml`; removes `dependabot-automerge.yml`, `quality.yml`, `pages.yml`, `security-policy.yml`, `npm-bun-blocker.yml`, `hypatia-scan.yml`, `push-email-notify.yml`; trims `dependabot.yml`; and reworks the **Zig/Idris FFI validation** (`src/interface/Abi/Foreign.idr`, `ffi/build.zig`, `ffi/src/main.zig`, `ffi/test/integration_test.zig`), plus `Justfile` and test-script updates. ##⚠️ Not mergeable as-is Conflicts with #22–#24 on six files, because those PRs added SPDX headers to workflows this branch deletes: ``` CONFLICT (content) .github/workflows/governance.yml CONFLICT (modify/delete) .github/workflows/hypatia-scan.yml CONFLICT (modify/delete) .github/workflows/pages.yml CONFLICT (content) .github/workflows/release.yml CONFLICT (modify/delete) .github/workflows/rsr-antipattern.yml CONFLICT (content) .github/workflows/trope-check.yml ``` The modify/delete cases resolve trivially (keep the delete); the three content conflicts need review. ## Relationship to #26 The three `startup_failure` deletions have been **split out into #26**, which merges cleanly and fixes the red CI on its own. Rebase this branch on top of #26 once that lands; the deletions will then already be in the base. Left as **draft** pending conflict resolution and review of the FFI rewrite. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The governance gate is all-jobs-must-pass, so these ship as one commit;
individually none of them turns the repo green.
permissions:block on everyworkflow file (the two
Workflow security linterchecks).uses:tag reference resolved to a full 40-hex commit SHA. Thissatisfies the linter and also the repository's own
sha_pinning_requiredActions policy, which refuses@v4at parsetime — a refusal that produces no check run at all.
hypatia-scan.ymlnow grantssecurity-events: write. This is notcosmetic and is not separable from the pin bump below: at HEAD the
reusable declares
security-events: writewhere the old pin declaredread, and a called workflow cannot escalate beyond its caller'sgrant. Bumping the pin without this would fail at parse time.
hypatia-scan, scorecard) advanced to standards HEAD, which is 62
commits ahead of the false-green cache fix and includes the
deny-list-negative fix from standards#524.
mirror-reusableandsecret-scanner-reusableare deliberately left ontheir current pins: the staleness gate does not watch them, so they are
not holding anything red, and bumping them carries unrelated risk.
Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com