Repository navigation
Chore/apply foundation ci fixes 20260911 - #70
Merged
Merged
Conversation
All three are rejected by Actions at parse time, so they produce a run named after the file path instead of the workflow's `name:` and execute zero steps. Three independent causes: * e2e.yml — `jobs:` is present but every job is commented out, leaving zero live jobs, which is not a valid workflow. * rsr-antipattern.yml — calls hyperpolymath/standards/.github/workflows/rsr-antipattern-reusable.yml@main, which does not exist (HTTP 404). * boj-build.yml — the job-level `if:` reads `secrets.BOJ_SERVER_URL`; the `secrets` context is not available in a job-level `if:`. Deleting them clears all three red runs. e2e.yml carried no live jobs, so no coverage is lost; boj-build.yml and rsr-antipattern.yml never ran a step. Extracted from fix/consolidate-dogfood-gate so this lands without the wider gate/FFI consolidation, which conflicts with #22-#24. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Resolves the modify/delete conflict on boj-build.yml introduced by #25, which bumped an action inside a workflow this branch deletes. Keeping the delete: the workflow never parsed (secrets context in a job-level if:), so the bumped pin was never used. # Conflicts: # .github/workflows/boj-build.yml
…I job
Two failures surfaced once this branch's changes ran for real.
1. .envrc — Hypatia critical "secret_detected"
This branch converts the Hypatia step in static-analysis-gate.yml from a
fake gate into a real one: on main the scanner build carries
`continue-on-error: true`, the scan is skipped unless `ready == 'true'`,
and unparseable output is overwritten with `[]` — so the gate passes
without ever scanning. Pinning the scanner and failing on critical
findings makes it genuine, and the first thing it caught was:
.envrc:24 # export API_KEY="..."
A commented-out placeholder, so a false positive — but the fix is to stop
writing assignment-shaped comments rather than to suppress the finding.
The guidance is preserved in prose, pointing at the gitignored .env.
The seven `high` findings do not gate and are left for separate triage.
2. ci.yml — Zig setup failed in the Idris2 container
The pinned idris2-pack image ships no xz binary, so setup-zig's .tar.xz
download died with "tar (child): xz: Cannot exec: No such file or
directory". Installs xz-utils first, guarded by a command -v check.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Each of these had been red on main on every push. Fixed at source rather
than suppressed.
1. 🟡 Estate rules — "Root shape allowlist" rejected flake.nix
flake.nix is debris from the 07-21 sweep and contradicts the 2026-05-18
ruling that the estate is Guix-primary with the Nix fallback retired. The
file even documents itself as "the Nix fallback tier". Removed; guix.scm
remains under build/, so the Guix-only policy gate is unaffected.
scripts/check-root-shape.sh now reports PASS (45 entries, 46 permitted).
2. 🟡 OpenSSF best-practices — unfilled {{PLACEHOLDER}} tokens
.github/SECURITY.md still carried its "delete this block before
publishing" template header and advertised a PGP key that does not exist
({{PGP_KEY_URL}}, {{PGP_FINGERPRINT}}). Removed the instruction block and
the PGP table/import snippet; reporting by email is stated plainly rather
than pointing at a key nobody can fetch.
STATE.a2ml and ECOSYSTEM.a2ml were verbatim copies of rsr-template-repo's
own manifests: they declared `project = "rsr-template-repo"`, the
template's purpose, and phase/maturity of maintenance/production. They now
describe Haec (design/experimental, 0.1.0) and its actual pipeline
position. This is the template self-name leak, which also misdirects
tooling that keys off these files.
3. 🟡 RSR self-use (dogfooding) — two actions that do not exist
hyperpolymath/a2ml-validate-action and hyperpolymath/k9-validate-action
both 404, so those steps failed at "Set up job" on every push and could
never have validated anything. An unresolvable action also breaks
Dependabot's github_actions updater, which is why that job failed too.
Replaced with inline checks of the envelope contract that genuinely
exists: non-empty, valid UTF-8, an SPDX header, and for K9 the magic
first line ('K9!' for .k9, '# K9!' for .k9.ncl so `nickel typecheck`
still parses). Scope is stated in the workflow: these do NOT parse the
A2ML grammar or typecheck Nickel. That still needs the real validators.
4. Six .a2ml manifests had no SPDX header
Added, both for REUSE compliance and so the new check in (3) is
meaningful rather than vacuous.
Verified locally: root-shape PASS, placeholder check PASS, A2ML and K9
envelope checks PASS, and every workflow parses with at least one live job.
Not changed: CLADE.a2ml still declares canonical-name "rsr-template-repo"
with the template's registry UUID and clade prefix. Those are assigned by
gv-clade-index; inventing replacements would corrupt that registry, so it
needs a real assignment.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`idris2 --version | grep -Fx 'Idris 2, version 0.7.0'` failed the job with no
output whatsoever: the pipeline swallowed the version, grep matched nothing,
and `set -o pipefail` ended the step before anything was printed. The log gave
no clue what version was actually installed.
Capture the version, echo it, then assert. The Idris2 check now matches on the
release ("0.7.0") rather than the whole string, since the digest-pinned
idris2-pack image reports a build suffix. The Zig check keeps its exact
equality but now reports what it found when it fails.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`idris2 --version | grep -Fx 'Idris 2, version 0.7.0'` failed the job with no
output whatsoever: the pipeline swallowed the version, grep matched nothing,
and `set -o pipefail` ended the step before anything was printed. The log gave
no clue what version was actually installed.
Capture the version, echo it, then assert. The Idris2 check now matches on the
release ("0.7.0") rather than the whole string, since the digest-pinned
idris2-pack image reports a build suffix. The Zig check keeps its exact
equality but now reports what it found when it fails.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
With the assert made diagnosable, the actual mismatch is visible:
idris2 --version -> Idris 2, version 0.8.0-6ca00e72e
::error::expected Idris 2 0.7.0
The digest-pinned idris2-pack image ships 0.8.0, so the 0.7.0 assertion could
never have matched and this job has never passed on its own terms.
Nothing in the repository actually requires 0.7.0: abi.ipkg declares no version
constraint (it depends only on `base`), and the `idris2 0.7.0` line in
.tool-versions is commented out, so it pins nothing. The only 0.7.0 references
were the workflow asserts and their comments — stale documentation that drifted
from the digest.
The immutable digest is the authority, so the version notes are brought into
step with it rather than the other way round. The typecheck now actually runs.
Also fixes the identical brittle assert in release.yml, which piped
`idris2 --version` into `grep -Fx` under pipefail exactly as ci.yml did.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`CI / required` failed at "Validate repository contracts" with exit code 2 and
a single line of output:
jq is required
That comes from tests/check-examples.sh:15, which exits 2 when jq is absent.
The pinned idris2-pack image does not ship it, so the Trope IR conformance
test — the one that asserts every example lowers to valid Trope IR — has never
actually executed in CI. It bailed before testing anything.
This is the same class of problem as the missing xz fixed in #28, so the step
now handles both: it collects what is missing, installs in one apt-get pass,
and prints both versions so the log records what was used. Already-provisioned
images skip the install entirely.
Verified against origin/main (d29f89e) in a local checkout: all four contract
scripts exit 0, and `bash -n` parses every .sh under tests/ and scripts/.
tests/check-examples.sh ................. exit 0 (examples lower to valid Trope IR)
tests/aspect_tests.sh ................... exit 0 (PASS=3 FAIL=0 WARN=0)
scripts/check-root-shape.sh ............. exit 0 (45 entries, 46 permitted)
tests/workflows/validate_workflows_test.sh exit 0
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
V (vlang.io) was banned from the estate long ago and check-no-vlang.sh enforced that. A prior global search-and-replace rewrote "V" -> "zig" throughout the script, so it now bans Zig -- the estate's primary systems/FFI language -- instead of V. Delete the script and the CI step that invoked it; V is long gone either way so there is nothing left to enforce. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- Update CodeQL workflow to SHA-pinned actions with persist-credentials: false - Update reusable workflow pins to current standards main SHAs Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
|
Warning Review limit reachedNext included review available in 59 minutes. View limit detailsLimit details: You’ve used the included review currently available. This review ran on the free tier because your account doesn't have an assigned seat on this organization's plan. Waiting won't change this — ask an organization admin to assign you a seat, then retry. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Free Run ID: 📒 Files selected for processing (17)
Note 🎁 Summarized by CodeRabbit FreeThe PR author is not assigned a seat. If you are a newly provisioned user and your organization has automatic seat assignment enabled, open a new pull request to trigger seat assignment. Otherwise, ask an organization administrator to assign a seat through the team management page at https://app.coderabbit.ai/settings/team-management. Comment |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes
RSR Quality Checklist
Required
just testor equivalent)just fmtor equivalent)unsafeblocks without// SAFETY:commentsbelieve_me,unsafeCoerce,Obj.magic,Admitted,sorry).envfiles includedAs Applicable
.machine_readable/6a2/STATE.a2mlupdated (if project state changed).machine_readable/6a2/ECOSYSTEM.a2mlupdated (if integrations changed).machine_readable/6a2/META.a2mlupdated (if architectural decisions changed)TOPOLOGY.mdupdated (if architecture changed)CHANGELOGor release notes updatedsrc/interface/abi/andsrc/interface/ffi/consistent)Testing
Screenshots