Skip to content

ci-health: report tracker credential failures once per scan #999

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 3 commits into from
Nov 3, 2026
Merged

ci-health: report tracker credential failures once per scan #999

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a8b7e56
ci-health: report tracker credential failures once per scan
hyperpolymath Nov 2, 2026
b154770
fix: include tracker credential findings in the estate sweep report
hyperpolymath Nov 2, 2026
a4f7222
docs: define tracker credential finding and operator response
hyperpolymath Nov 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions scripts/ci-health/README.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,10 @@ matches its ref. This is an exact diagnosis within that bounded run horizon.
| **Report only** — in a checkout, run `gh actions-lock --verify`, repair the
reported dependency with the authoritative tool, and commit `actions.lock`.

| `B-TRACKER-TOKEN`
| HIGH. The pin updater explicitly reports a missing write credential.
| **Report only** — compare pins read-only. If an update is needed, provision the repository-scoped updater credential.

| `B-STARTUPFAIL`
| One or more `startup_failure` conclusions among the latest API page of at
most 30 workflow runs. The report includes both numerator and denominator and
Expand Down
5 changes: 5 additions & 0 deletions scripts/ci-health/detect.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,13 +47,18 @@
# mechanism and supports a precise recommendation.
billing_seen=false
lockfile_seen=false
tracker_token_seen=false
mapfile -t fail_ids < <(api "repos/$O/$R/actions/runs?status=failure&per_page=5" --jq '.workflow_runs[].id' || true)
for fail_id in "${fail_ids[@]}"; do
[ -n "${fail_id:-}" ] || continue
mapfile -t job_ids < <(api "repos/$O/$R/actions/runs/$fail_id/jobs?per_page=100" --jq '.jobs[] | select(.id != null) | .id' || true)
for job_id in "${job_ids[@]}"; do
[ -n "${job_id:-}" ] || continue
msg=$(api "repos/$O/$R/check-runs/$job_id/annotations?per_page=100" --jq '.[].message // empty' || true)
if [ "$tracker_token_seen" = false ] && [[ "$msg" == *"Stale cicd-suite pins detected. AUTOMATION_TOKEN is required"* || "$msg" == *"AUTOMATION_TOKEN is not set. This job edits files under .github/workflows/"* ]]; then

Check failure on line 58 in scripts/ci-health/detect.sh

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use '[[' instead of '[' for conditional tests. The '[[' construct is safer and more feature-rich. 


See more on https://sonarcloud.io/project/issues?id=hyperpolymath_hypatia&issues=AaGbLq6iALOZc6cdtgW-&open=AaGbLq6iALOZc6cdtgW-&pullRequest=999
emit B-TRACKER-TOKEN HIGH "Pin updater reports missing write credential (run $fail_id) → compare pins read-only before provisioning repository-scoped write access"

@chatgpt-codex-connector chatgpt-codex-connector Bot Nov 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Include tracker-token findings in the sweep report

When this emits B-TRACKER-TOKEN, the scheduled entry point in scripts/ci-health/sweep.sh never includes it in the generated report: line 52 only selects B-(ALLOWLIST|LOCKFILE|STARTUPFAIL), while line 53 still sees the new B- row and suppresses the _none_ placeholder. Consequently, repositories with this credential failure disappear from both the workflow summary and rolling tracking issue, potentially leaving a blank B section; add the new class to the report filter.

Useful? React with 👍 / 👎.

@hyperpolymath hyperpolymath Nov 3, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pretty sure that's a placeholder

Comment thread
coderabbitai[bot] marked this conversation as resolved.
Resolved
tracker_token_seen=true
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Resolved
fi
if [ "$billing_seen" = false ] && printf '%s' "$msg" | grep -qiE 'payments have failed|spending limit'; then
emit A-BILLING CRITICAL "Actions billing/spending-limit wall blocks all billable jobs → OWNER: GitHub Settings -> Billing & plans"
billing_seen=true
Expand Down
4 changes: 2 additions & 2 deletions scripts/ci-health/sweep.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,14 +49,14 @@ rep=$(mktemp)
grep -qP '\tA-BILLING\t' "$findings" || echo "- _none_"
echo ""
echo "### 🟠 B — allow-list / lockfile / bounded startup_failure observations"
grep -P '\tB-(ALLOWLIST|LOCKFILE|STARTUPFAIL)\t' "$findings" | awk -F'\t' '{print "- "$1" ("$2"): "$4}' || true
grep -P '\tB-(ALLOWLIST|LOCKFILE|STARTUPFAIL|TRACKER-TOKEN)\t' "$findings" | awk -F'\t' '{print "- "$1" ("$2"): "$4}' || true
grep -qP '\tB-' "$findings" || echo "- _none_"
echo ""
echo "### 🟡 D-BURN — push/PR double-trigger"
grep -P '\tD-BURN\t' "$findings" | awk -F'\t' '{print "- "$1": "$4}' || true
grep -qP '\tD-BURN\t' "$findings" || echo "- _none_"
echo ""
echo "> Auto-remediation: B-ALLOWLIST is applied in place and verified; D-BURN opens PRs (cap $MAXPR/run). B-LOCKFILE and B-STARTUPFAIL are report-only; A-BILLING is owner-only. See \`scripts/ci-health/README.adoc\`."
echo "> Auto-remediation: B-ALLOWLIST is applied in place and verified; D-BURN opens PRs (cap $MAXPR/run). B-LOCKFILE, B-TRACKER-TOKEN and B-STARTUPFAIL are report-only; A-BILLING is owner-only. See \`scripts/ci-health/README.adoc\`."
} >"$rep"
[ -n "${GITHUB_STEP_SUMMARY:-}" ] && cat "$rep" >>"$GITHUB_STEP_SUMMARY"

Expand Down
Loading