Skip to content

ci: estate workflow set — fix the always-red checks, retire folded workflows, add cicd-squabbler #156

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 4 commits into from
Oct 14, 2026
Merged

ci: estate workflow set — fix the always-red checks, retire folded workflows, add cicd-squabbler #156

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
519a78a
ci: estate workflow set — current standards pins, thin CodeQL, closed…
claude Oct 14, 2026
2d053c6
chore(ffi): link the Zig FFI stub markers to #155
claude Oct 14, 2026
e417e40
docs(wiki): convert docs/wiki from AsciiDoc to Markdown
claude Oct 14, 2026
e4aaf1a
docs(wiki): mark example shell paths as project-relative (Hypatia SD022)
claude Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
170 changes: 91 additions & 79 deletions .github/workflows/actions.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,20 +3,19 @@
# Docs: https://gh.io/actions-lockfile
version: 'v0.0.2'
workflows:
'.github/workflows/boj-build.yml':
'.github/workflows/agda-proofs.yml':
- 'actions/checkout@v7.0.1'
'.github/workflows/cargo-audit.yml':
'.github/workflows/boj-build.yml':
- 'actions/checkout@v7.0.1'
'.github/workflows/casket-pages.yml':
- 'actions/cache@v6.1.0'
- 'actions/checkout@v7.0.1'
- 'actions/configure-pages@v6.0.0'
- 'actions/deploy-pages@v5.0.1'
- 'actions/upload-pages-artifact@v5.0.0'
- 'haskell-actions/setup@v2.12.0'
- 'haskell-actions/setup@v2.12.1'
'.github/workflows/codeql.yml':
- 'actions/checkout@v7.0.1'
- 'github/codeql-action@v4.38.0'
- 'hyperpolymath/standards@7d2041a2315572d8257341449257e6cfddc9aebc'
'.github/workflows/dashboard-check.yml':
- 'actions/checkout@v7.0.1'
- 'dtolnay/rust-toolchain@v1'
Expand All @@ -30,33 +29,44 @@ workflows:
- 'actions/checkout@v7.0.1'
- 'dtolnay/rust-toolchain@v1'
- 'swatinem/rust-cache@v2.9.2'
'.github/workflows/governance.yml': []
'.github/workflows/hypatia-scan.yml': []
'.github/workflows/instant-sync.yml':
- 'peter-evans/repository-dispatch@v4.0.1'
'.github/workflows/governance.yml':
- 'hyperpolymath/standards@7d2041a2315572d8257341449257e6cfddc9aebc'
'.github/workflows/hypatia-scan.yml':
- 'hyperpolymath/standards@7d2041a2315572d8257341449257e6cfddc9aebc'
'.github/workflows/idris-abi.yml':
- 'actions/checkout@v7.0.1'
'.github/workflows/label-triage.yml': []
'.github/workflows/labels.yml': []
'.github/workflows/main-estate-audit.yml':
- 'actions/checkout@v7.0.1'
- 'hyperpolymath/cicd-suite@main'
'.github/workflows/mirror.yml': []
'.github/workflows/pages.yml':
- 'actions/checkout@v7.0.1'
- 'actions/deploy-pages@v5.0.1'
- 'actions/upload-pages-artifact@v5.0.0'
'.github/workflows/push-email-notify.yml':
- 'dawidd6/action-send-mail@v3.12.0'
'.github/workflows/rust-ci.yml': []
'.github/workflows/scorecard.yml': []
'.github/workflows/secret-scanner.yml': []
'.github/workflows/workflow-linter.yml':
'.github/workflows/mirror.yml':
- 'hyperpolymath/standards@7d2041a2315572d8257341449257e6cfddc9aebc'
'.github/workflows/rust-ci.yml':
- 'hyperpolymath/standards@7d2041a2315572d8257341449257e6cfddc9aebc'
'.github/workflows/scorecard.yml':
- 'hyperpolymath/standards@7d2041a2315572d8257341449257e6cfddc9aebc'
'.github/workflows/secret-scanner.yml':
- 'hyperpolymath/standards@7d2041a2315572d8257341449257e6cfddc9aebc'
'.github/workflows/squabble.yml':
- 'actions/checkout@v7.0.1'
- 'hyperpolymath/cicd-squabbler@b34cd53f9157d1b8a4f9c5c8d843846557f8622c'
dependencies:
'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
ref: 'v6.1.0'
commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
owner_id: 44036562
repo_id: 215566462
'actions/cache@v6.1.0':
ref: 'v6.1.0'
commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
owner_id: 44036562
repo_id: 215566462
'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
ref: 'v7.0.1'
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
owner_id: 44036562
repo_id: 197814629
'actions/checkout@v7.0.1':
ref: 'v7.0.1'
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
Expand All @@ -77,38 +87,63 @@ dependencies:
commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
owner_id: 44036562
repo_id: 192625955
'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9':
ref: 'cf430e030ddbb5b0abf93d22962f4752f3646cd9'
commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
owner_id: 44036562
repo_id: 192625955
'actions/upload-pages-artifact@v5.0.0':
ref: 'v5.0.0'
commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
owner_id: 44036562
repo_id: 496012378
uses:
- 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
'dawidd6/action-send-mail@v3.12.0':
ref: 'v3.12.0'
commit: 'sha1-2cea9617b09d79a095af21254fbcb7ae95903dde'
owner_id: 9713907
repo_id: 222439721
'dependabot/fetch-metadata@v3.1.0':
ref: 'v3.1.0'
commit: 'sha1-25dd0e34f4fe68f24cc83900b1fe3fe149efef98'
owner_id: 27347476
repo_id: 371068214
'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f':
ref: 'e2a55d2ffb04f378e9626c28d38b36d230d1e12f'
commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f'
owner_id: 1940490
repo_id: 260749683
'dtolnay/rust-toolchain@v1':
ref: 'v1'
commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de'
owner_id: 1940490
repo_id: 260749683
'github/codeql-action@v4.38.0':
ref: 'v4.38.0'
'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393':
ref: '51f63319f592f97930c73d9c46184d20bd206393'
commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393'
owner_id: 26415196
repo_id: 297874902
'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
ref: 'v1.24.1'
commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
owner_id: 47606891
repo_id: 331103973
'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63':
ref: 'b96794f015dfd88f77b49b1c93e0fa7110f94c63'
commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63'
owner_id: 9919
repo_id: 259445878
'haskell-actions/setup@v2.12.0':
ref: 'v2.12.0'
commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d'
'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406':
ref: 'abea47f85e598557f500fa1fd2ab7464fcb39406'
commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406'
owner_id: 1006268
repo_id: 212984112
'haskell-actions/setup@v2.12.1':
ref: 'v2.12.1'
commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d'
owner_id: 75048950
repo_id: 623796603
'hyperpolymath/cicd-squabbler@b34cd53f9157d1b8a4f9c5c8d843846557f8622c':
ref: 'b34cd53f9157d1b8a4f9c5c8d843846557f8622c'
commit: 'sha1-b34cd53f9157d1b8a4f9c5c8d843846557f8622c'
owner_id: 6759885
repo_id: 1284026967
'hyperpolymath/cicd-suite@main':
ref: 'main'
commit: 'sha1-5a10b72e574ef63855fafd4568a4c178657f3294'
Expand Down Expand Up @@ -137,61 +172,38 @@ dependencies:
commit: 'sha1-c1a34884054fabf0e9de81dbf68f4ba7874e85f1'
owner_id: 6759885
repo_id: 1275650185
'peter-evans/repository-dispatch@v4.0.1':
ref: 'v4.0.1'
commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
owner_id: 18365890
repo_id: 220359305
'swatinem/rust-cache@v2.9.2':
ref: 'v2.9.2'
'hyperpolymath/standards@7d2041a2315572d8257341449257e6cfddc9aebc':
ref: '7d2041a2315572d8257341449257e6cfddc9aebc'
commit: 'sha1-7d2041a2315572d8257341449257e6cfddc9aebc'
owner_id: 6759885
repo_id: 1116521501
uses:
- 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
- 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
- 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
- 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f'
- 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393'
- 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
- 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63'
- 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406'
- 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc'
- 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
- 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555'
'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc':
ref: 'v2.4.4'
commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
owner_id: 67707773
repo_id: 421101922
'Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6':
ref: 'v2'
commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
owner_id: 580492
repo_id: 298565987
'Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6':
ref: 'v2'
'swatinem/rust-cache@v2.9.2':
ref: 'v2.9.2'
commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
owner_id: 580492
repo_id: 298565987
'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
ref: 'v6.1.0'
commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
owner_id: 44036562
repo_id: 215566462
'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
ref: 'v7.0.1'
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
owner_id: 44036562
repo_id: 197814629
'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a':
ref: 'v7.0.1'
commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
owner_id: 44036562
repo_id: 192625955
'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
ref: 'v2.0.5'
commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
owner_id: 42048915
repo_id: 356423100
'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772':
ref: 'stable'
commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
owner_id: 1940490
repo_id: 260749683
'editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c':
ref: 'v2.2.0'
commit: 'sha1-840e866d93b8e032123c23bac69dece044d4d84c'
owner_id: 26415196
repo_id: 297874902
'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
ref: 'v1.24.1'
commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
owner_id: 47606891
repo_id: 331103973
'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc':
ref: 'v2.4.4'
commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
owner_id: 67707773
repo_id: 421101922
'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555':
ref: 'v0.10.0'
commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555'
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/agda-proofs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
apt-get update
apt-get install --no-install-recommends -y ca-certificates git agda-bin=2.6.4.3-1+b2
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- name: Verify the checked Agda version
Expand Down
62 changes: 0 additions & 62 deletions .github/workflows/cargo-audit.yml
View file
Open in desktop

This file was deleted.

59 changes: 21 additions & 38 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,11 @@
# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# CodeQL — thin caller of the estate reusable in hyperpolymath/standards
# (CI regularisation spec: "REMAKE · GATE: thin caller of codeql-reusable.yml").
# One call per language, per the reusable's design. januskey has no
# JavaScript/TypeScript, so the reusable's javascript-typescript default would
# fail with "no source code seen"; it analyses the workflow YAML (actions) and
# the Rust crates (rust, build-mode none).
name: CodeQL Security Analysis

on:
Expand All @@ -11,48 +16,26 @@ on:
schedule:
- cron: '0 6 1 * *' # monthly 1st 06:00 UTC

# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
# updates do not pile up queued runs against the shared account-wide
# Actions concurrency pool. Applied only to read-only check workflows
# (no publish/mutation), so cancelling a superseded run is always safe.
# Queue rather than cancel: a cancelled CodeQL run uploads nothing, and a
# ruleset that expects a code-scanning result for the head commit then waits
# on it indefinitely (same reasoning as standards' own codeql.yml).
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
cancel-in-progress: false

# Must cover everything the reusable's analyze job requests: a reusable cannot
# widen its caller's grant, and asking for more ends the run in startup_failure.
permissions:
actions: read
contents: read
security-events: write

jobs:
analyze:
runs-on: ubuntu-latest
timeout-minutes: 15
permissions:
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
include:
# januskey has no JavaScript/TypeScript source — the
# javascript-typescript extractor errors with "no source code seen"
# (exit 32, configuration error). CodeQL's GitHub Actions analysis
# scans the workflow YAML that does exist here, keeping this a
# meaningful security check (same fix as oblibeny + maa-framework).
- language: actions
build-mode: none

steps:
- name: Checkout
uses: actions/checkout@v7.0.1

- name: Initialize CodeQL
uses: github/codeql-action/init@v4.38.2
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4.38.2
with:
category: "/language:${{ matrix.language }}"
codeql-actions:
uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@7d2041a2315572d8257341449257e6cfddc9aebc # standards main, 2026-10-13
with:
language: actions
codeql-rust:
uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@7d2041a2315572d8257341449257e6cfddc9aebc # standards main, 2026-10-13
with:
language: rust
Loading
Loading