Repository navigation
fix(ci): re-pin standards reusables past the lockfile boundary - #48
Conversation
…n caller perms The five standards-reusable callers were the last startup_failures: enforcement demands a lockfile in the CALLED repo at the pinned ref, and d135b05 predates standards' actions.lock (#570). Re-pin all five to 5a597720 (standards main, lockfile present). The 186-commit jump also raised the reusables' permission demands — governance/hypatia/mirror/scorecard now declare `actions: read`, and a reusable requesting more than its caller grants is itself a startup_failure. Callers now grant the exact union each reusable requests (job-level blocks replace, not merge, so scorecard's job block carries the full set). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedRe-pins standards reusables past the lockfile boundary and aligns caller permissions to satisfy current workflow demands. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 7 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
…etes #48) (#50) #48 was merged before this branch's final two commits, so main still lacks the pieces that actually revive the five reusable callers: 1. **Hand-added lockfile entries** for the reusable-caller workflows (`governance`/`hypatia-scan`/`mirror`/`scorecard`/`secret-scanner`: `[]`) — `gh actions-lock` v0.1.6 skips reusable-only workflows but enforcement still rejects them by name ("The following workflows are missing a lockfile: … hypatia-scan.yml"). 2. **Re-pin `5a59772` → `fcb8669`** — standards #571/#572 landed after the first re-pin, restoring its gates; `fcb8669` verified via the commits API. This PR's own wave is the decisive consumer-half test. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Completes the revival begun in #46: the five standards-reusable callers (Governance, Hypatia scan, Secret scan, Mirror, Scorecard) were still
startup_failurebecause enforcement requires a lockfile in the called repo at the pinned ref, andd135b05predates standards'actions.lock(standards#570). This re-pins all five to5a597720and aligns caller permission grants with the reusables' current demands (actions: readadded; scorecard's job-level block carries the full union since job blocks replace top-level).If these five execute on this PR (or on main post-merge for the push-only ones), haec is the first estate repo fully through both lockfile stages — proving the consumer half of the template.
🤖 Generated with Claude Code