Repository navigation
fix(ci): drop harden-runner until actions.lock records it - #948
Merged
Merged
Conversation
#945 added step-security/harden-runner@v2.22.2 to ci-health-sweep.yml, dependabot-automerge.yml and roadmap-sync.yml, but actions.lock has no record for it. GitHub therefore rejects the workflows at startup: Dependabot Auto-Merge ends in startup_failure on every PR since 13:34 (runs 39431585232, 39431759488 and 39432798311, the last on Dependabot #937). This restores the three files to their state before #945, which only removes the harden-runner step. To re-add it, put the steps back and run `gh actions-lock` in the same change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 8 minutes. View limit details
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Summary
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly identifies the CI fix: removing harden-runner until actions.lock records the action. |
| Description check | |
The description directly explains the CI regression, the affected workflows, the removal of harden-runner, and the verification performed. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
hyperpolymath
marked this pull request as ready for review
October 20, 2026 13:52
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
5 of 6 tasks
hyperpolymath
pushed a commit
that referenced
this pull request
Oct 20, 2026
`governance / Actions lockfile verify` fails on this PR, and on main since #945. Of the verifier's findings, only the three `step-security/harden-runner@v2.22.2` "not-pinned" records are not accepted by standards' wrapper. #948 removes those steps. This is the same three-file change; it no-ops once #948 (or a lock regeneration) lands on main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM
hyperpolymath
pushed a commit
that referenced
this pull request
Oct 20, 2026
`governance / Actions lockfile verify` fails on this PR, and on main since #945. Of the verifier's findings, only the three `step-security/harden-runner@v2.22.2` "not-pinned" records are not accepted by standards' wrapper. #948 removes those steps. This is the same three-file change; it no-ops once #948 (or a lock regeneration) lands on main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM
hyperpolymath
added a commit
that referenced
this pull request
Oct 20, 2026
## Summary This is the last step of the baseline-gate stack. `governance.yml` and `hypatia-scan.yml` pass `hypatia-ref: aa34a4c` (#940), which predates the rule fixes that clear this repo's own false positives. This PR moves both to **hypatia `main` at `23dc74d`**, which contains: - #938: ActionsLock accepts v0.0.3 locks (already in `aa34a4c`); - #942: WH013 judges writes per job and skips PAT/app-token writes. This clears `estate-rescan.yml`; `inbox-steward-intake.yml` was also repaired in #943; - #947: RE005 skips `trap` handlers, and job extraction survives comments between jobs. `uses:` refs are unchanged, so `actions.lock` is untouched. ## What this PR's governance run will show This PR's own `governance / Validate Hypatia Baseline` run is the measurement: it builds the scanner at `23dc74d`. The jump from `aa34a4c` also brings #931's new rules (WF026, WF027, PIN-003), which haven't been measured on this repo yet. hex.pm is blocked in my session, so I can't build the escript to pre-run them. **Expected remaining findings, by class:** - **RE001 (harden-runner):** most of the original 18 jobs, including the 2 dispatched label workflows, which must stay action-free. - These need an owner decision; the harden-runner steps were removed again in #948 because the lock has no record. - **WH013, RE004, RE005, `invalid_actions_lock`:** expected 0. I'll post the measured list here once the run completes. ## Type of change - [x] 🔧 Build / CI / tooling ## How has this been verified? - `actionlint` 1.7.7 is clean on both files. - `23dc74d` is `origin/main` at the time of writing. `git log aa34a4c..23dc74d` contains #942, #947, #945, #931, #941 and #936. ## Checklist - [ ] My commits are **signed**. The session's signing shim is platform-mediated. - [x] I ran the project's own checks/tests locally and they pass. - [x] New files carry the correct SPDX (none added). - [x] Docs are updated (the pin comment names what it carries). - [x] I have not introduced a soundness hole. --- _Generated by [Claude Code](https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Regression fix for main. #945 brought in
step-security/harden-runner@v2.22.2(from #946) in 3 workflows, butactions.lockhas no record for it. On main,grep -c harden-runner .github/workflows/actions.lockgives 0. GitHub rejects unlocked actions at startup, so:startup_failureon every PR since 13:34 UTC, including Dependabot's own chore(deps): bump the actions group across 1 directory with 2 updates #937 (runs 39431585232, 39431759488, 39432798311).ci-health-sweepandroadmap-syncwill fail the same way on their next scheduled or dispatched run.This PR restores
ci-health-sweep.yml,dependabot-automerge.ymlandroadmap-sync.ymlbyte-for-byte to their state before #945 (551b4c4), removing only the 8-line harden-runner step from each.Alternative: if you'd rather keep the hardening, close this PR and run
gh actions-lockon main. That adds the record (tagv2.22.2→dc2769ab…) and fixes the same failure. Either fixes main; this PR is the one I can push without aghcredential.The RE001 findings for these 3 jobs come back with this PR. Re-adding harden-runner and the lock regeneration should land in one change.
Type of change
How has this been verified?
git diff 551b4c4 -- <3 files>on this branch is empty: the files are identical to their pre-fix(ci): pin test service and job containers by digest (RE004) #945 state.actionlint1.7.7 gives 0, 1 and 3 messages, the same pre-existing counts as before fix(ci): pin test service and job containers by digest (RE004) #945.dependabot-automerge.ymlrunsstartup_failureon each of its last 3 runs (listed above). This PR's own Dependabot Auto-Merge run is the end-to-end check.Checklist
Generated by Claude Code