Address Sonar findings in Logtalk guard by hyperpolymath · Pull Request #997 · hyperpolymath/hypatia

hyperpolymath · 2026-11-01T17:07:36Z

Follow-up to #996 (merged at 4428672 before these post-merge check findings were addressed).

Refactor scripts/check-no-active-logtalk.sh to use Bash [[ ... ]] conditional expressions, assign positional parameters to locals, and give each case an explicit default branch (SonarCloud annotations on Complete Logtalk to Elixir rule migration #996).
Force HTTPS (including redirects) for the pinned official Agda release download in verify-proofs.yml.
No semantic change to the guard: bash -n, scripts/check-no-active-logtalk.sh --all (1,100 files, 14 allowlisted, 0 violations), and git diff --check pass locally.

This also supplies the standards exemption-ratchet declaration for the two SD022 entries added in #996:

Ratchet-exception: .hypatia-ignore — two exact SD022 entries remove a foreign-tree false positive in sibling migration packets that quote epistemic-types' own src paths; delete each entry when its packet is removed after sibling landing.

Known unrelated failure: Governance "Allowlist Preflight" rejects the pre-existing ClusterFuzzLite action refs because they are not covered by the standards allowlist at the pinned standards revision; that needs the standards allowlist/pin process and is not changed here.

Use Bash conditional expressions and explicit default cases in the new guard, and force HTTPS for the pinned Agda download and its redirects. Ratchet-exception: .hypatia-ignore — two exact SD022 entries remove a foreign-tree false positive in sibling migration packets that quote epistemic-types' own src paths; delete each entry when its packet is removed after sibling landing. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

coderabbitai · 2026-11-01T17:07:54Z

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 0d524db5-39de-40e8-9849-eb3ad62c1dc3

Commits

Reviewing files that changed from the base of the PR and between 90781d8 and a86fbb8.

Files selected for processing: 2

.github/workflows/verify-proofs.yml
scripts/check-no-active-logtalk.sh

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Context from checks skipped due to timeout: 7

GitHub Check: Rust Coverage
GitHub Check: Integration Tests
GitHub Check: CodeRabbit
GitHub Check: Container Security (Trivy) (deploy/Containerfile)
GitHub Check: Rust Dependency Audit
GitHub Check: Build AsciiDoc
GitHub Check: stress-test

CI failures not shown inline: 17

GitHub Actions: Governance / 0_governance _ Validate Hypatia Baseline.txt: Address Sonar findings in Logtalk guard

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1mif [ ! -d "$HOME/hypatia" ]; then�[0m
 �[36;1m  git init "$HOME/hypatia"�[0m
 �[36;1m  git -C "$HOME/hypatia" remote add origin https://github.com/hyperpolymath/hypatia.git�[0m
 �[36;1m  git -C "$HOME/hypatia" fetch --depth 1 origin "$HYPATIA_SHA"�[0m
 �[36;1m  git -C "$HOME/hypatia" checkout --detach FETCH_HEAD�[0m
 �[36;1mfi�[0m
 �[36;1mACTUAL_SHA=$(git -C "$HOME/hypatia" rev-parse HEAD)�[0m
 �[36;1mif [ "$ACTUAL_SHA" != "$HYPATIA_SHA" ]; then�[0m
 �[36;1m  echo "::error::Hypatia cached source does not match the resolved commit"�[0m
...
 ##[group]Run cd "$HOME/hypatia"
 �[36;1mcd "$HOME/hypatia"�[0m
 �[36;1mif [ ! -x hypatia ]; then�[0m
 �[36;1m  if ! (mix deps.get && mix escript.build); then�[0m
 �[36;1m    echo "::error::Hypatia scanner build failed at commit $(git rev-parse HEAD) — see upstream hyperpolymath/hypatia"�[0m
 �[36;1m    exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -x hypatia ]; then�[0m
 �[36;1m  echo "::error::Hypatia scanner binary is missing after build"�[0m
...
 ##[group]Run echo "Scanning repository: hyperpolymath/hypatia (checking baseline)"
...
 �[36;1m# scan's own exit code…�[0m
 �[36;1mHYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . > hypatia-findings.raw.json || true�[0m
 �[36;1m# …but never swallow a genuine scanner crash into a false pass: require a�[0m
 �[36;1m# valid JSON array before trusting the output as "the findings".�[0m
 �[36;1mif ! jq -e 'type == "array"' hypatia-findings.raw.json >/dev/null 2>&1; then�[0m
 �[36;1m  echo "::error::hypatia scan did not produce a valid JSON findings array (scanner error, not a baseline result)"�[0m

GitHub Actions: Governance / governance _ Validate Hypatia Baseline: Address Sonar findings in Logtalk guard

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1mif [ ! -d "$HOME/hypatia" ]; then�[0m
 �[36;1m  git init "$HOME/hypatia"�[0m
 �[36;1m  git -C "$HOME/hypatia" remote add origin https://github.com/hyperpolymath/hypatia.git�[0m
 �[36;1m  git -C "$HOME/hypatia" fetch --depth 1 origin "$HYPATIA_SHA"�[0m
 �[36;1m  git -C "$HOME/hypatia" checkout --detach FETCH_HEAD�[0m
 �[36;1mfi�[0m
 �[36;1mACTUAL_SHA=$(git -C "$HOME/hypatia" rev-parse HEAD)�[0m
 �[36;1mif [ "$ACTUAL_SHA" != "$HYPATIA_SHA" ]; then�[0m
 �[36;1m  echo "::error::Hypatia cached source does not match the resolved commit"�[0m

GitHub Actions: Governance / governance _ Validate Hypatia Baseline: Address Sonar findings in Logtalk guard

Conclusion: failure

View job details

##[group]Run cd "$HOME/hypatia"
 �[36;1mcd "$HOME/hypatia"�[0m
 �[36;1mif [ ! -x hypatia ]; then�[0m
 �[36;1m  if ! (mix deps.get && mix escript.build); then�[0m
 �[36;1m    echo "::error::Hypatia scanner build failed at commit $(git rev-parse HEAD) — see upstream hyperpolymath/hypatia"�[0m
 �[36;1m    exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -x hypatia ]; then�[0m
 �[36;1m  echo "::error::Hypatia scanner binary is missing after build"�[0m

GitHub Actions: Governance / governance _ Validate Hypatia Baseline: Address Sonar findings in Logtalk guard

Conclusion: failure

View job details

##[group]Run echo "Scanning repository: hyperpolymath/hypatia (checking baseline)"
 �[36;1mecho "Scanning repository: hyperpolymath/hypatia (checking baseline)"�[0m
 �[36;1m# Move the baseline filter OUT of the scanned tree, then delete the�[0m
 �[36;1m# standards checkout, so `hypatia scan .` only ever sees the CALLER's�[0m
 �[36;1m# own files. Without this, `.standards-checkout/` (the tooling we�[0m
 �[36;1m# checked out to get apply-baseline.sh) is itself scanned, and�[0m
 �[36;1m# standards' own files get reported as the caller's findings (a banned�[0m
 �[36;1m# `.ts`, `shell_download` bootstrap.sh scripts, etc.).�[0m
 �[36;1m# Prefer the CALLER's own scripts/apply-baseline.sh when present�[0m
 �[36;1m# (self-lint: standards validating itself must run the tree under�[0m
 �[36;1m# test, not main's copy — a new baseline severity the main-pinned�[0m
 �[36;1m# script doesn't know would fail closed here while passing�[0m
 �[36;1m# everywhere else). Consumers without the script keep the�[0m
 �[36;1m# main-pinned fallback.�[0m
 �[36;1mif [ -f scripts/apply-baseline.sh ]; then�[0m
 �[36;1m  cp scripts/apply-baseline.sh "$RUNNER_TEMP/apply-baseline.sh"�[0m
 �[36;1melse�[0m
 �[36;1m  cp .standards-checkout/scripts/apply-baseline.sh "$RUNNER_TEMP/apply-baseline.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1m# hypatia's `scan` exits non-zero whenever it finds anything — that is�[0m
 �[36;1m# by design, and under `bash -e` it would abort this step at this line,�[0m
 �[36;1m# before the baseline filter (the real gate) ever runs. Tolerate the�[0m
 �[36;1m# scan's own exit code…�[0m
 �[36;1mHYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . > hypatia-findings.raw.json || true�[0m
 �[36;1m# …but never swallow a genuine scanner crash into a false pass: require a�[0m
 �[36;1m# valid JSON array before trusting the output as "the findings".�[0m
 �[36;1mif ! jq -e 'type == "array"' hypatia-findings.raw.json >/dev/null 2>&1; then�[0m
 �[36;1m  echo "::...

GitHub Actions: Governance / 5_governance _ Actions lockfile verify.txt: Address Sonar findings in Logtalk guard

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1m# Stage the gate, the verifier and the exemption ledger. When THIS�[0m
 �[36;1m# repository is standards, its own working tree already holds all�[0m
 �[36;1m# three (self-lint); every other caller uses the pinned checkout.�[0m
 �[36;1mif [ "${GITHUB_REPOSITORY_ID:-}" = "1116521501" ] || [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ] || [ "$GITHUB_REPOSITORY" = metadatastician/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  LEDGERSRC=.machine_readable�[0m
 �[36;1m  echo "Using this repository's own gate + verifier + ledger (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1m  LEDGERSRC=.standards-lock/.machine_readable�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (pinned standards checkout failed?)"�[0m

GitHub Actions: Governance / governance _ Actions lockfile verify: Address Sonar findings in Logtalk guard

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1m# Stage the gate, the verifier and the exemption ledger. When THIS�[0m
 �[36;1m# repository is standards, its own working tree already holds all�[0m
 �[36;1m# three (self-lint); every other caller uses the pinned checkout.�[0m
 �[36;1mif [ "${GITHUB_REPOSITORY_ID:-}" = "1116521501" ] || [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ] || [ "$GITHUB_REPOSITORY" = metadatastician/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  LEDGERSRC=.machine_readable�[0m
 �[36;1m  echo "Using this repository's own gate + verifier + ledger (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1m  LEDGERSRC=.standards-lock/.machine_readable�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (pinned standards checkout failed?)"�[0m

GitHub Actions: Governance / 8_governance _ Well-Known (RFC 9116 + RSR).txt: Address Sonar findings in Logtalk guard

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m
 �[36;1mif ! grep -q "^Expires:" "$SECTXT"; then�[0m
 �[36;1m  echo "::error::Missing Expires field"�[0m
...
 �[36;1mfi�[0m
 �[36;1mEXPIRES=$(grep "^Expires:" "$SECTXT" | cut -d: -f2- | tr -d ' ' | head -2)�[0m
 �[36;1mif date -d "$EXPIRES" > /dev/null 2>&1; then�[0m
 �[36;1m  DAYS=$(( ($(date -d "$EXPIRES" +%s) - $(date +%s)) / 86400 ))�[0m
 �[36;1m  if [ $DAYS -lt 0 ]; then�[0m
 �[36;1m    echo "::error::security.txt EXPIRED"�[0m
...
 ##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): Address Sonar findings in Logtalk guard

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m
 �[36;1mif ! grep -q "^Expires:" "$SECTXT"; then�[0m
 �[36;1m  echo "::error::Missing Expires field"�[0m
...
 �[36;1mfi�[0m
 �[36;1mEXPIRES=$(grep "^Expires:" "$SECTXT" | cut -d: -f2- | tr -d ' ' | head -2)�[0m
 �[36;1mif date -d "$EXPIRES" > /dev/null 2>&1; then�[0m
 �[36;1m  DAYS=$(( ($(date -d "$EXPIRES" +%s) - $(date +%s)) / 86400 ))�[0m
 �[36;1m  if [ $DAYS -lt 0 ]; then�[0m
 �[36;1m    echo "::error::security.txt EXPIRED"�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): Address Sonar findings in Logtalk guard

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m

GitHub Actions: Governance / 11_governance _ Code quality + docs.txt: Address Sonar findings in Logtalk guard

Conclusion: failure

View job details

##[group]Run set -eo pipefail
 �[36;1mset -eo pipefail�[0m
 �[36;1m# Arming policy, and the evidence it rests on: standards#991.�[0m
 �[36;1m#�[0m
 �[36;1m#   retired-filename -> BLOCKS. A STABLE predicate:�[0m
 �[36;1m#   the retired `.a2ml` spelling of the launcher standard was�[0m
 �[36;1m#   deleted upstream on 2026-09-22�[0m
 �[36;1m#   (standards#952) and stays deleted, so a caller that is clean�[0m
 �[36;1m#   today cannot become defective without editing the citation�[0m
 �[36;1m#   itself. Measured 2026-09-22 over EVERY clone in the estate --�[0m
 �[36;1m#   595 scanned, 553 carrying an origin/main. 432 reference this�[0m
 �[36;1m#   reusable workflow, but only 12 do so at a MUTABLE ref (@main),�[0m
 �[36;1m#   and a new step reaches ONLY those 12: a caller pinned at a SHA�[0m
 �[36;1m#   freezes this whole file, this step included, so it can never�[0m
 �[36;1m#   receive the step at all. The real gate was run against all 12:�[0m
 �[36;1m#   12/12 rc=0, retired=0. Five slugs do carry the retired literal�[0m
 �[36;1m#   (tma-mark2, canonical-ums, the-nash-equilibrium,�[0m
 �[36;1m#   launch-scaffolder, trigger) and their overlap with the armed 12�[0m
 �[36;1m#   is ZERO -- so arming this tier reds ZERO live callers. A�[0m
 �[36;1m#   known-answer positive control fired (rc=1) on three of those�[0m
 �[36;1m#   defective repos through the identical harness, so the twelve�[0m
 �[36;1m#   zeros are a real measurement and not a broken probe.�[0m
 �[36;1m#�[0m
 �[36;1m#   stale-version -> WARNS, and does not block. A TIME-DEPENDENT�[0m
 �[36;1m#   predicate: the gate compares against its own CURRENT_VERSION, so�[0m
 �[36;1m#   every correctly-citing caller flips to defect the moment the�[0m
 �[36;1m#   standard bumps, having done nothing. A baked-in cutoff DATE does�[0m
 �[36;1m#   not cure that -- the #505 split above can use one because its�[0m
 �[36;1m#   missing-CONTRIBUTING population is static, while this population�[0m
 �[36;1m#   is regenerated at every...

GitHub Actions: Governance / governance _ Code quality + docs: Address Sonar findings in Logtalk guard

Conclusion: failure

View job details

##[group]Run set -eo pipefail
 �[36;1mset -eo pipefail�[0m
 �[36;1m# Arming policy, and the evidence it rests on: standards#991.�[0m
 �[36;1m#�[0m
 �[36;1m#   retired-filename -> BLOCKS. A STABLE predicate:�[0m
 �[36;1m#   the retired `.a2ml` spelling of the launcher standard was�[0m
 �[36;1m#   deleted upstream on 2026-09-22�[0m
 �[36;1m#   (standards#952) and stays deleted, so a caller that is clean�[0m
 �[36;1m#   today cannot become defective without editing the citation�[0m
 �[36;1m#   itself. Measured 2026-09-22 over EVERY clone in the estate --�[0m
 �[36;1m#   595 scanned, 553 carrying an origin/main. 432 reference this�[0m
 �[36;1m#   reusable workflow, but only 12 do so at a MUTABLE ref (@main),�[0m
 �[36;1m#   and a new step reaches ONLY those 12: a caller pinned at a SHA�[0m
 �[36;1m#   freezes this whole file, this step included, so it can never�[0m
 �[36;1m#   receive the step at all. The real gate was run against all 12:�[0m
 �[36;1m#   12/12 rc=0, retired=0. Five slugs do carry the retired literal�[0m
 �[36;1m#   (tma-mark2, canonical-ums, the-nash-equilibrium,�[0m
 �[36;1m#   launch-scaffolder, trigger) and their overlap with the armed 12�[0m
 �[36;1m#   is ZERO -- so arming this tier reds ZERO live callers. A�[0m
 �[36;1m#   known-answer positive control fired (rc=1) on three of those�[0m
 �[36;1m#   defective repos through the identical harness, so the twelve�[0m
 �[36;1m#   zeros are a real measurement and not a broken probe.�[0m
 �[36;1m#�[0m
 �[36;1m#   stale-version -> WARNS, and does not block. A TIME-DEPENDENT�[0m
 �[36;1m#   predicate: the gate compares against its own CURRENT_VERSION, so�[0m
 �[36;1m#   every correctly-citing caller flips to defect the moment the�[0m
 �[36;1m#   standard bumps, having done nothing. A baked-in cutoff DATE does�[0m
 �[36;1m#   not cure that -- the #505 split above can use one because its�[0m
 �[36;1m#   missing-CONTRIBUTING population is static, while this population�[0m
 �[36;1m#   is regenerated at every...

GitHub Actions: Governance / 13_governance _ Security policy checks.txt: Address Sonar findings in Logtalk guard

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m# Rule files are read with yq, never a hand parser (YAML-POLICY Y-1); this�[0m
 �[36;1m# gate previously parsed them with Python, which the estate bans.�[0m
 �[36;1mif ! command -v yq >/dev/null 2>&1 || ! command -v jq >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] yq and jq are required on the runner for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mmapfile -t files < <(find "$DIR" -maxdepth 1 -type f \( -name '*.yml' -o -name '*.yaml' \) ! -name '.*' | LC_ALL=C sort)�[0m
 �[36;1mif [ "${#files[@]}" -eq 0 ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] $DIR/ has no .yml/.yaml rules — skipped"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1merr=$(mktemp)�[0m
 �[36;1mtrap 'rm -f "$err"' EXIT�[0m
 �[36;1mtotal=0�[0m
 �[36;1mfor rf in "${files[@]}"; do�[0m
 �[36;1m  if ! cfg=$(yq -o json '.' "$rf" 2>&1); then�[0m
 �[36;1m    echo "❌ [R5] $rf: not parseable YAML: $cfg"; total=$((total + 1)); continue�[0m
 �[36;1m  fi�[0m
 �[36;1m  if [ "$(jq -r 'type' <<<"$cfg")" != object ]; then�[0m
 �[36;1m    echo "❌ [R5] $rf: top-level must be a mapping"; total=$((total + 1)); continue�[0m
 �[36;1m  fi�[0m
 �[36;1m  rid=$(jq -r --arg b "$(basename "$rf")" 'if has("id") then .id | tostring else $b end' <<<"$cfg")�[0m
 �[36;1m  desc=$(jq -r '.description // ""' <<<"$cfg")�[0m
 �[36;1m  canon=$(jq -r '.canonical_pointer // ""' <<<"$cfg")�[0m
 �[36;1m  mapfile -t pats < <(jq -r '(.patterns // [])[]' <<<"$cfg")�[0m
 �[36;1m  mapfile -t includes < <(jq -r '((.scope // {}).include // [])[]' <<<"$cfg")�[0m
 �[36;1m  if [ "${#pats[@]}" -eq 0 ] || [ "${#includes[@]}" -eq 0 ]; then�[0m
 �[36;1m    echo "❌ [R5:$rid] missing patterns or scope.include in $rf"�[0m
 �[36;1m    total=$((total + 1)); continue�[0m
 �[36...

GitHub Actions: Governance / governance _ Security policy checks: Address Sonar findings in Logtalk guard

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m# Rule files are read with yq, never a hand parser (YAML-POLICY Y-1); this�[0m
 �[36;1m# gate previously parsed them with Python, which the estate bans.�[0m
 �[36;1mif ! command -v yq >/dev/null 2>&1 || ! command -v jq >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] yq and jq are required on the runner for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mmapfile -t files < <(find "$DIR" -maxdepth 1 -type f \( -name '*.yml' -o -name '*.yaml' \) ! -name '.*' | LC_ALL=C sort)�[0m
 �[36;1mif [ "${#files[@]}" -eq 0 ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] $DIR/ has no .yml/.yaml rules — skipped"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1merr=$(mktemp)�[0m
 �[36;1mtrap 'rm -f "$err"' EXIT�[0m
 �[36;1mtotal=0�[0m
 �[36;1mfor rf in "${files[@]}"; do�[0m
 �[36;1m  if ! cfg=$(yq -o json '.' "$rf" 2>&1); then�[0m
 �[36;1m    echo "❌ [R5] $rf: not parseable YAML: $cfg"; total=$((total + 1)); continue�[0m
 �[36;1m  fi�[0m
 �[36;1m  if [ "$(jq -r 'type' <<<"$cfg")" != object ]; then�[0m
 �[36;1m    echo "❌ [R5] $rf: top-level must be a mapping"; total=$((total + 1)); continue�[0m
 �[36;1m  fi�[0m
 �[36;1m  rid=$(jq -r --arg b "$(basename "$rf")" 'if has("id") then .id | tostring else $b end' <<<"$cfg")�[0m
 �[36;1m  desc=$(jq -r '.description // ""' <<<"$cfg")�[0m
 �[36;1m  canon=$(jq -r '.canonical_pointer // ""' <<<"$cfg")�[0m
 �[36;1m  mapfile -t pats < <(jq -r '(.patterns // [])[]' <<<"$cfg")�[0m
 �[36;1m  mapfile -t includes < <(jq -r '((.scope // {}).include // [])[]' <<<"$cfg")�[0m
 �[36;1m  if [ "${#pats[@]}" -eq 0 ] || [ "${#includes[@]}" -eq 0 ]; then�[0m
 �[36;1m    echo "❌ [R5:$rid] missing patterns or scope.include in $rf"�[0m
 �[36;1m    total=$((total + 1)); continue�[0m
 �[36...

GitHub Actions: Governance / 17_governance _ Allowlist Preflight.txt: Address Sonar findings in Logtalk guard

Conclusion: failure

View job details

##[group]Run # Bootstrap rule: standards must test the scripts from its PR tree;
 �[36;1m# Bootstrap rule: standards must test the scripts from its PR tree;�[0m
 �[36;1m# consumers use the canonical copies checked out from standards.�[0m
 �[36;1mif [ "${GITHUB_REPOSITORY_ID:-}" = "1116521501" ] || [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ] || [ "$GITHUB_REPOSITORY" = metadatastician/standards ]; then�[0m
 �[36;1m  cp scripts/check-actions-policy.sh scripts/check-allowed-actions.sh "$RUNNER_TEMP/"�[0m
 �[36;1m  cp rhodium-standard-repositories/actions-allowlist/allowed-actions.json \�[0m
 �[36;1m     "$RUNNER_TEMP/allowed-actions.json"�[0m
 �[36;1melse�[0m
 �[36;1m  cp .standards-checkout/scripts/check-actions-policy.sh \�[0m
 �[36;1m     .standards-checkout/scripts/check-allowed-actions.sh "$RUNNER_TEMP/"�[0m
 �[36;1m  cp .standards-checkout/rhodium-standard-repositories/actions-allowlist/allowed-actions.json \�[0m
 �[36;1m     "$RUNNER_TEMP/allowed-actions.json"�[0m
 �[36;1mfi�[0m
 �[36;1mbash "$RUNNER_TEMP/check-allowed-actions.sh" \�[0m
 �[36;1m  "$RUNNER_TEMP/allowed-actions.json" .github/workflows�[0m
 �[36;1mrm -rf .standards-checkout�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 GAP  google/clusterfuzzlite/actions/build_fuzzers@v1   (review a narrow path/ref pattern and the effective live policy)
 GAP  google/clusterfuzzlite/actions/run_fuzzers@v1   (review a narrow path/ref pattern and the effective live policy)
 checked 45 `uses:` refs across .github/workflows — 2 not covered by the allowlist
 ##[error]Process completed with exit code 1.

GitHub Actions: Governance / governance _ Allowlist Preflight: Address Sonar findings in Logtalk guard

Conclusion: failure

View job details

##[group]Run # Bootstrap rule: standards must test the scripts from its PR tree;
 �[36;1m# Bootstrap rule: standards must test the scripts from its PR tree;�[0m
 �[36;1m# consumers use the canonical copies checked out from standards.�[0m
 �[36;1mif [ "${GITHUB_REPOSITORY_ID:-}" = "1116521501" ] || [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ] || [ "$GITHUB_REPOSITORY" = metadatastician/standards ]; then�[0m
 �[36;1m  cp scripts/check-actions-policy.sh scripts/check-allowed-actions.sh "$RUNNER_TEMP/"�[0m
 �[36;1m  cp rhodium-standard-repositories/actions-allowlist/allowed-actions.json \�[0m
 �[36;1m     "$RUNNER_TEMP/allowed-actions.json"�[0m
 �[36;1melse�[0m
 �[36;1m  cp .standards-checkout/scripts/check-actions-policy.sh \�[0m
 �[36;1m     .standards-checkout/scripts/check-allowed-actions.sh "$RUNNER_TEMP/"�[0m
 �[36;1m  cp .standards-checkout/rhodium-standard-repositories/actions-allowlist/allowed-actions.json \�[0m
 �[36;1m     "$RUNNER_TEMP/allowed-actions.json"�[0m
 �[36;1mfi�[0m
 �[36;1mbash "$RUNNER_TEMP/check-allowed-actions.sh" \�[0m
 �[36;1m  "$RUNNER_TEMP/allowed-actions.json" .github/workflows�[0m
 �[36;1mrm -rf .standards-checkout�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 GAP  google/clusterfuzzlite/actions/build_fuzzers@v1   (review a narrow path/ref pattern and the effective live policy)
 GAP  google/clusterfuzzlite/actions/run_fuzzers@v1   (review a narrow path/ref pattern and the effective live policy)
 checked 45 `uses:` refs across .github/workflows — 2 not covered by the allowlist
 ##[error]Process completed with exit code 1.

GitHub Actions: Governance / 19_governance _ Workflow security linter.txt: Address Sonar findings in Logtalk guard

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1mSCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m# Self-hosting fallback: when THIS repository is standards, its own�[0m
 �[36;1m# working tree already holds the script, and during a rename that copy�[0m
 �[36;1m# is the only correct one — the pinned main checkout still has the old�[0m
 �[36;1m# name. Preferring the fetched copy keeps every other caller on the�[0m
 �[36;1m# canonical version.�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f scripts/check-workflow-duplicate-keys.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / governance _ Workflow security linter: Address Sonar findings in Logtalk guard

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1mSCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m# Self-hosting fallback: when THIS repository is standards, its own�[0m
 �[36;1m# working tree already holds the script, and during a rename that copy�[0m
 �[36;1m# is the only correct one — the pinned main checkout still has the old�[0m
 �[36;1m# name. Preferring the fetched copy keeps every other caller on the�[0m
 �[36;1m# canonical version.�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f scripts/check-workflow-duplicate-keys.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

Additional comments: 2

.github/workflows/verify-proofs.yml: 1

317-317: LGTM!

scripts/check-no-active-logtalk.sh: 1

50-50: LGTM!

Also applies to: 55-55, 67-68, 75-75, 80-81, 85-85, 92-95, 106-106, 110-110, 116-116, 124-124, 126-126, 131-131, 148-148, 156-157, 163-163, 168-168, 171-172, 180-180, 190-190

Summary

Summary by CodeRabbit

Security
- Agda release downloads now require HTTPS for both the initial request and any redirects, ensuring these connections are encrypted. Retry behavior and output-file handling remain unchanged.
Maintenance
- Updated checks for active Logtalk logs. Their existing conditions and outcomes are unchanged.

The Agda proof workflow now requires HTTPS for downloads and redirects. The Logtalk guard script uses Bash arithmetic and conditional syntax for its existing checks.

Changes: Agda download transport

Layer / File(s)	Summary
Require HTTPS for Agda download `.github/workflows/verify-proofs.yml`	The Agda download now requires HTTPS for the initial request and redirects. Retry and output-file handling remain unchanged.

Logtalk guard conditionals

Layer / File(s)	Summary
Update guard checks `scripts/check-no-active-logtalk.sh`	Argument checks, comment and file detection, allowlist validation, scanning and final failure checks now use Bash arithmetic, `[[ ... ]]` conditions and case fallbacks. Existing conditions and outcomes remain unchanged.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Refactor

Possibly related PRs

hyperpolymath/hypatia#996: This PR follows up on the Agda download workflow and the Logtalk guard introduced in PR #996.
hyperpolymath/hypatia#994: This PR defines the Agda proof-checking policy used by the workflow that downloads Agda.

Merge Risk: Minimal · previous review a86fb

No actionable risk introduced by this PR remains; it is mergeable after normal checks.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title names the Sonar findings and the Logtalk guard. The changeset refactors scripts/check-no-active-logtalk.sh to use [[ ... ]] conditionals, locals for positional parameters, and explicit case …
Description check		The description is directly related to the changeset. It lists the guard refactor in check-no-active-logtalk.sh, the HTTPS enforcement for the Agda download in verify-proofs.yml, the local validation …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the Sonar findings and the Logtalk guard. The changeset refactors scripts/check-no-active-logtalk.sh to use [[ ... ]] conditionals, locals for positional parameters, and explicit case defaults, which are Sonar-style fixes. The title does not mention the HTTPS change to verify-proofs.yml or the .hypatia-ignore declaration, but those are secondary to the main change. The title is specific and related to the main change, so it passes.

Full details: Description check

Explanation

The description is directly related to the changeset. It lists the guard refactor in check-no-active-logtalk.sh, the HTTPS enforcement for the Agda download in verify-proofs.yml, the local validation results, and the .hypatia-ignore ratchet-exception. It also notes an unrelated Governance check failure. The description matches the changes in the raw summary and objectives, so it passes.

Full details: Docstring Coverage

Explanation

Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 3 functions across 1 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

Generate docstrings

Coding Agent task started for docstring generation.
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

chatgpt-codex-connector · 2026-11-01T17:11:18Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-01T17:11:57.547969Z	`a86fbb8`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

coderabbitai · 2026-11-01T17:17:32Z

⚠️ Coding task changes are ready, but delivery needs attention

Open the task to resolve the delivery issue or retry.

sonarqubecloud · 2026-11-01T17:18:15Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

hyperpolymath mentioned this pull request Nov 1, 2026

Complete Logtalk to Elixir rule migration #996

Merged

coderabbitai Bot approved these changes Nov 1, 2026

View reviewed changes

linear-code Bot marked this pull request as ready for review November 1, 2026 17:11

Merge branch 'main' into arena/82ed8898-hypatia

5f3cb25

hyperpolymath assigned Copilot Nov 1, 2026

hyperpolymath enabled auto-merge November 1, 2026 17:17

hyperpolymath merged commit 204b4c3 into main Nov 1, 2026
92 of 93 checks passed

hyperpolymath deleted the arena/82ed8898-hypatia branch November 1, 2026 17:18

Navigation Menu

Repository navigation

Address Sonar findings in Logtalk guard - #997

Address Sonar findings in Logtalk guard#997
hyperpolymath merged 2 commits into
mainfrom
arena/82ed8898-hypatia

hyperpolymath commented Nov 1, 2026

Uh oh!

coderabbitai Bot commented Nov 1, 2026 •

edited

Loading

Summary by CodeRabbit

Uh oh!

chatgpt-codex-connector Bot commented Nov 1, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Nov 1, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Nov 1, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

hyperpolymath commented Nov 1, 2026

Uh oh!

coderabbitai Bot commented Nov 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

chatgpt-codex-connector Bot commented Nov 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

coderabbitai Bot commented Nov 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud Bot commented Nov 1, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Nov 1, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Nov 1, 2026 •

edited

Loading

coderabbitai Bot commented Nov 1, 2026 •

edited

Loading