Repository navigation
ci: estate workflow set — fix the always-red checks, retire folded workflows, add cicd-squabbler - #156
Merged
Conversation
… actions.lock Brings januskey's CI in line with the standards CI regularisation spec (docs/superpowers/specs/2026-09-02-cicd-regularisation-design.adoc) and fixes the checks that were red or never started on main. Re-pin (standards main 7d2041a, 2026-10-13): governance, hypatia-scan, mirror, rust-ci, scorecard, secret-scanner. The old pin (8435558) carried the Allowlist Preflight that called the live Actions API without a token (the GH_TOKEN failure on every run); the current bundle splits that into a tokenless preflight plus a credentialed advisory, which gets HYPATIA_SCAN_PAT and passes with a notice when it is unset. The current mirror reusable runs a forge only when vars.<FORGE>_MIRROR_ENABLED is 'true', so the four forges with no key stop failing. CodeQL: thin caller of codeql-reusable (actions + rust). The inline workflow named codeql-action v4.38.2 while the lock held v4.38.0, so every run ended in startup_failure; the reusable pins the estate's v4.38.0 commit. Retired, per the spec: workflow-linter.yml (FOLD into governance, whose "Workflow security linter" already runs), cargo-audit.yml (fold into rust-ci via enable_audit, with a weekly schedule kept), instant-sync.yml (DROP; disabled), pages.yml (the disabled Ddraig duplicate of casket-pages.yml, which stays the one Pages deployer), push-email-notify.yml (disabled, and its action had drifted from the lock). main-estate-audit.yml: SPDX header and top-level permissions (the governance linter's only finding on main), timeout, and the PERIODIC tier the signal discipline gives it: push to main, weekly, dispatch; never pull_request. dogfood-gate.yml: the DEED validator now skips audits/assail-classifications.a2ml, which is panic-attack's suppression registry, not a repo manifest. squabble.yml (new): hyperpolymath/cicd-squabbler's action pinned by commit. `squabble chains` on push, PR and weekly, failing only on a blocking finding (cycle or dead upstream); `squabble fight` on dispatch for a PR, propose-only, with exit 3 (no required_status_checks rule) reported as a notice. actions.lock: rebuilt transitively closed. Every workflow ref and every nested ref has its own record; the standards reusables are listed as hyperpolymath/standards@7d2041a with their transitive actions. Drift fixed: haskell-actions/setup v2.12.1 (casket-pages startup_failure), codeql. The Agda and Idris workflows use the locked actions/checkout@v7.0.1 tag like every other workflow here. UUID literals in two p2p tests, the attestation benchmark and KEY_LIFECYCLE.adoc are now version 8, for the governance bundle's UUID job (ADR-008, strict). They are opaque fixture strings; nothing parses their version. Verified locally: standards check-actions-lock-gate.sh (valid; one advisory, sha-as-ref on the squabbler pin its README requires), check-lock-sync.sh (in sync), every governance-reusable job at 7d2041a run against this tree, the locked DEED validator, actionlint. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Kjdf4Mf4Z41bNQh2TrsEp9
The eleven TODO(product) markers in ffi/zig/src/main.zig become TODO(#155), the issue that now tracks the stubbed crypto/CNO internals (#61 was closed by #63 with the lifecycle scaffold in place). The estate code-hygiene gate (cicd-suite code-hygiene-check, run by main-estate-audit.yml) accepts a debt marker only in MARKER(#issue) form; it failed on main on exactly these lines. Comments only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Kjdf4Mf4Z41bNQh2TrsEp9
The estate formatting gate (cicd-suite formatting-check, run by
main-estate-audit.yml) keeps .adoc for documentation but requires wiki
content to be .md ("wikis are the one .md home"). It failed on main on these
14 pages.
Mechanical conversion with asciidoctor (DocBook 5) then pandoc (GFM). The
text is unchanged; only the markup is converted.
- Headings: the document title becomes `#`, the rest shift down one level.
- Tables (38) and code blocks (140) are carried across: one language-less
listing became an indented block, the rest are fenced with their language.
- stem:[…] latexmath becomes $…$ / $$…$$, which GitHub renders.
- Wiki cross-links point at the .md files.
- The SPDX and copyright lines become HTML comments.
- One "GOVERNANCE +" that AsciiDoc read as a forced line break reads as a
literal "+" again.
Links that were already dead before this change (reversibility-theory,
metadata-store, content-store, formal-proofs/reversibility) stay dead, now
with .md extensions; no target page exists for them in either format.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kjdf4Mf4Z41bNQh2TrsEp9
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 32 seconds. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Hypatia's code scanning raised six SD022 "stale path after rename" warnings on #156: the wiki's example sessions (reorganising a project, a risky refactor) run `jk` against a user's own project, written as `src/components/` and the like. SD022 reads a bare `src/<dir>/` as this repository's tree. `./src/...` is the same relative path to the shell, and SD022 leaves it alone because a path segment precedes `src/` (lib/rules/structural_drift.ex at hypatia 4be38c8). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Kjdf4Mf4Z41bNQh2TrsEp9
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
hyperpolymath
marked this pull request as ready for review
October 14, 2026 00:53
hyperpolymath
added a commit
that referenced
this pull request
Oct 14, 2026
#157) Follow-up to #156, from main's first push run after the merge (4b50367). ### The fix `casket-pages.yml` now starts; before #156 its lock drift ended every run in startup_failure. But its first real run was cancelled at the job's 15-minute limit, 13 minutes into `cabal build` of casket-ssg ([run 38492666537](https://github.com/hyperpolymath/januskey/actions/runs/38492666537)). `actions/cache` saves `~/.cabal/store` only when the job succeeds. With the limit below the cold build time, every run would start cold and be cancelled the same way. Raising the build job's limit to 60 minutes lets one run finish and seed the cache; after that, builds are warm. The workflow runs on push to main or on dispatch, not on pull requests, so this PR cannot show it passing. The first push to main after merge will. ### Still red on main, and not fixable from this repository's code - **Central Estate CI/CD Audit.** cicd-suite's `manifest-check` runs the deed validator on the whole tree with no ignore list. The validator rejects `audits/assail-classifications.a2ml`, which is panic-attack's suppression registry, not a manifest. - `dogfood-gate.yml` skips this file since #156, but `manifest-check` cannot be told to. - The validator already exempts everything under `.machine_readable/`, but panic-attack reads the registry only from `audits/` or a repo-root dotfile. - Options for the owner, none taken here: - cicd-suite `manifest-check` forwards a `paths-ignore` input; - panic-attack also reads `.machine_readable/audits/…`, and the file moves there; - drop the step from the periodic audit, since dogfood-gate runs the same validators. - Editing the A2ML file or narrowing the scan would be a bypass, so I did not. - **Mirror: gitea, sourcehut, disroot and bitbucket.** These forges are switched on (`*_MIRROR_ENABLED`) but not configured: - no `GITEA_HOST` or `GITEA_SSH_FINGERPRINT`; - no `SOURCEHUT_SSH_FINGERPRINT`; - no `DISROOT_SSH_FINGERPRINT`; - Bitbucket's target `hyperpolymath-dev/januskey` does not exist or the key cannot reach it. Either configure them or set those forges' `*_MIRROR_ENABLED` to `false` on this repository. gitlab, codeberg and radicle mirrored successfully. Every other workflow on main is green: governance, CodeQL, Rust CI, Dogfood, Squabble, Agda, Idris, dashboard-check and E2E. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Kjdf4Mf4Z41bNQh2TrsEp9 --- _Generated by [Claude Code](https://claude.ai/code/session_01Kjdf4Mf4Z41bNQh2TrsEp9)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the checks that were red or never started on
main(9c20604). The workflow set now follows the standards CI regularisation spec (docs/superpowers/specs/2026-09-02-cicd-regularisation-design.adoc,config/rulesets/gates.json). It also brings in hyperpolymath/cicd-squabbler.The PR has three commits, each reviewable on its own.
What was red on main, and why
GH_TOKENerror)HYPATIA_SCAN_PATand passes with a notice when it is unsetmain-estate-audit.ymlhad no SPDX header and no top-levelpermissions:actions.lockheld v4.38.0codeql-reusable(actions + rust)haskell-actions/setup@v2.12.1in the workflow, v2.12.0 in the lockvars.<FORGE>_MIRROR_ENABLED == 'true'(see the action needed below)audits/assail-classifications.a2mlhas no manifest identity field. It is panic-attack's suppression registry, not a manifestpaths-ignoreTODO(product)markers with no issue. Formatting gate: 14 wiki pages in.adoc.mdWorkflows removed (spec verdicts)
workflow-linter.yml: FOLD into governance. Governance's "Workflow security linter" already runs it.cargo-audit.yml: folded into rust-ci withenable_audit: true. A weekly schedule on rust-ci keeps the scheduled audit.instant-sync.yml: DROP. It was already disabled.pages.yml: the disabled Ddraig duplicate.casket-pages.ymlstays the one Pages deployer.push-email-notify.yml: it was disabled, and its action had drifted from the lock (aref-changederror in the governance lock gate).Workflows changed or added
7d2041a(main, 2026-10-13): governance, hypatia-scan, mirror, rust-ci, scorecard, secret-scanner and codeql.main-estate-audit.yml: now in the PERIODIC tier the signal discipline assigns it. It runs on push to main, weekly and on dispatch; never onpull_request, and it is never a required check.actions/checkout@v7.0.1tag like every other workflow here. Governance: "Do not also rewrite direct refs to raw SHAs" in lock repositories.squabble.yml(new): the cicd-squabbler action, pinned by commit (b34cd53, squabble v0.1.0). The binary is checked by sha256 and build attestation before it runs.chainsruns on push, PR and weekly. It fails only on a blocking finding: a dependency cycle, or a dead upstream that would read green.fightruns on dispatch with a PR number. It is propose-only, with no--apply. Exit 3 (norequired_status_checksrule) is reported as a notice.actions.lock: rebuilt transitively closed. Every workflow ref and nested ref has its own record. The standards reusables are recorded ashyperpolymath/standards@7d2041awith their transitive actions, the form cicd-squabbler's own green lock uses.Content changes the new gates need
KEY_LIFECYCLE.adoc, and are opaque fixture strings.Uuid::new_v4(); moving it to v8 is a product change and is not part of this PR.docs/wiki/**: mechanical asciidoctor → pandoc (GFM) conversion. Tables, code blocks and LaTeX math are carried across; the text is unchanged.Verified locally before push
check-actions-lock-gate.sh, usinggh actions-lockv0.1.6 built from source, reportsvalid: true. Its one advisory issha-as-refon the squabbler pin, which that action's README requires.check-lock-sync.shreports in sync.governance-reusable.ymljob at 7d2041a, run against this tree, passes. On main, the same pin fails UUID and workflow-lint.cargo test --test p2p_test: 6 passed.Needs the owner
GITLAB_MIRROR_ENABLED,CODEBERG_MIRROR_ENABLEDandRADICLE_MIRROR_ENABLEDare set totrue(Settings → Secrets and variables → Actions → Variables). I cannot set repository variables from here..machine_readable/bot_directives/git-private-farm.a2mlstill namesinstant-sync.yml. A2ML is retired, so I left it untouched.🤖 Generated with Claude Code
https://claude.ai/code/session_01Kjdf4Mf4Z41bNQh2TrsEp9
Generated by Claude Code