ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry by hyperpolymath · Pull Request #158 · hyperpolymath/januskey

hyperpolymath · 2026-10-19T16:25:57Z

Why

Central Estate CI/CD Audit has been red on main. There were two causes:

manifests fails on audits/assail-classifications.a2ml. That file is panic-attack's suppression registry, which panic-attack reads from that fixed path. It is not a DEED manifest, and the validator had no way to skip it. feat(manifest-check): per-validator ignore lists, forwarded by the reusable audit cicd-suite#51 added that way, and chore(ci): repin estate audit composites to #54 (follow-up to #51) cicd-suite#55 made it live.
The workflow was a 26-step copy that froze at cicd-suite@5a10b72 through actions.lock, so gate fixes made upstream never arrived here.

What

.github/workflows/main-estate-audit.yml
- Becomes a thin caller of hyperpolymath/cicd-suite/.github/workflows/main-estate-audit.yml@b17ec1a… (chore(governance): adopt estate-standardization wave + 2026-06-12 checkpoint #55's merge commit), from templates/estate-audit-caller.yml.
- Passes manifest-deed-paths-ignore: the DEED validator's seven defaults, then audits/assail-classifications.a2ml. A list replaces the defaults, so they have to be repeated.
- K9 keeps its defaults.
- Triggers stay PERIODIC: push to main, weekly, and on demand. It never runs on pull_request, so this PR's own checks don't run it.
.github/workflows/actions.lock
- The caller is de-onboarded with cicd-suite/scripts/deonboard-estate-audit.sh. An onboarded cross-repo reusable call startup-fails with zero jobs.
- The script removed the workflow entry and only the 3 dependencies just it reached: cicd-suite@main, deed-ecosystem@f9d999b and k9-ecosystem@2155aa2.
- The diff is removals only.

Verification

actionlint is clean on the new workflow.
The lock has no dangling edges: owner/repo is compared case-insensitively, and every workflows: ref and nested uses: resolves to a record.
The pin b17ec1af1bbf097d77a58ac3363c4cf5db4d7f4a is on cicd-suite main.
On 2026-10-14 I ran the pinned validators locally against januskey main with this ignore list:
- DEED: 28 files, 0 errors.
- K9, on its defaults: 7 files, 0 errors.
The first real run happens on push to main after merge. It can also be started by hand with workflow_dispatch.

Not in this PR

From 18 Oct, scheduled runs of Rust CI, Squabble, Scorecards and Hypatia fail before any step runs, with invalid lockfile pin. That is unrelated to this change and is being looked at separately.

Generated by Claude Code

…'s registry Replace the 26-step copy of the estate audit with a thin caller of hyperpolymath/cicd-suite's reusable workflow, pinned at b17ec1a (#55). The copy froze at cicd-suite@5a10b72 through actions.lock, so upstream gate fixes never arrived here. The caller passes manifest-deed-paths-ignore (cicd-suite #51): the DEED validator's defaults plus audits/assail-classifications.a2ml. panic-attack reads that suppression registry from the fixed path. It is not a DEED manifest, and it kept the manifests check red. Triggers stay PERIODIC (push to main, weekly, dispatch; never on pull_request). The caller is de-onboarded from actions.lock with cicd-suite/scripts/deonboard-estate-audit.sh. An onboarded cross-repo reusable call startup-fails with zero jobs. The script pruned only what the old copy reached: cicd-suite@main, deed-ecosystem@f9d999b and k9-ecosystem@2155aa2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Kjdf4Mf4Z41bNQh2TrsEp9

coderabbitai · 2026-10-19T16:28:12Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 24840e0d-2c60-40f5-8e1d-581b2f000473

📥 Commits

Reviewing files that changed from the base of the PR and between 69de917 and 6095d95.

⛔ Files ignored due to path filters: 1

.github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing: 1

.github/workflows/main-estate-audit.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout: 8

GitHub Check: governance / Exemption ratchet
GitHub Check: governance / Guix packaging policy (Nix retired)
GitHub Check: governance / Debt ratchet
GitHub Check: governance / Language / package anti-pattern policy
GitHub Check: scan / shell-secrets
GitHub Check: codeql-rust / analyze
GitHub Check: STATE vs dashboard reconciliation
GitHub Check: CI dependency chains

⚠️ CI failures not shown inline: 38

GitHub Actions: Hypatia Security Scan / 0_hypatia _ Hypatia Neurosymbolic Analysis.txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Actions: read
 Contents: read
 Metadata: read
 SecurityEvents: write
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]lockfile verification did not produce a result for this action. Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action. lockfile verification did not produce a result for this action. lockfile verification did not produce a result for this action

GitHub Actions: Hypatia Security Scan / hypatia _ Hypatia Neurosymbolic Analysis: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Actions: read
 Contents: read
 Metadata: read
 SecurityEvents: write
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]lockfile verification did not produce a result for this action. Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action. lockfile verification did not produce a result for this action. lockfile verification did not produce a result for this action

GitHub Actions: Secret Scanner / 0_scan _ shell-secrets.txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Secret Scanner / scan _ shell-secrets: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Secret Scanner / 1_scan _ rust-secrets.txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Secret Scanner / scan _ rust-secrets: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Secret Scanner / 2_scan _ gitleaks.txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Secret Scanner / scan _ gitleaks: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 1_governance _ Actions lockfile verify.txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Actions lockfile verify: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 2_governance _ Security policy checks.txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Security policy checks: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 3_governance _ Code quality + docs.txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action

GitHub Actions: Governance / governance _ Code quality + docs: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action

GitHub Actions: Governance / 4_governance _ UUID v7 conformance.txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Actions: read
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ UUID v7 conformance: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Actions: read
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 5_governance _ Exemption ratchet.txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Exemption ratchet: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 6_governance _ Guix packaging policy (Nix retired).txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Guix packaging policy (Nix retired): ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 7_governance _ Check Workflow Staleness.txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Actions: read
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Check Workflow Staleness: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Actions: read
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 8_governance _ Workflow security linter.txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Workflow security linter: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 9_governance _ Trusted-base reduction policy.txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Trusted-base reduction policy: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 10_governance _ Licence consistency.txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Licence consistency: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 11_governance _ Well-Known (RFC 9116 + RSR).txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 12_governance _ Allowlist Preflight.txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Allowlist Preflight: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 13_governance _ Debt ratchet.txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Debt ratchet: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 14_governance _ Language _ package anti-pattern policy.txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / 15_governance _ Live Actions policy (credentialed advisory).txt: ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

GitHub Actions: Governance / governance _ Live Actions policy (credentialed advisory): ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Using locked action versions from the workflow's lockfile
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile

🔇 Additional comments: 2

.github/workflows/main-estate-audit.yml: 2

4-20: LGTM!

32-46: 🩺 Stability & Availability

The pinned reusable workflow declares manifest-deed-paths-ignore as an optional string input, declares no required secrets, and requests only contents: read. The caller contract therefore does not show the startup failure described in this comment.

📝 Summary

Summary by CodeRabbit

Chores
- Updated the automated estate audit process to use a shared workflow and retain its existing audit exclusions.
- Existing run triggers and read-only access remain unchanged. These updates affect automated checks rather than the application’s user-facing features.

The estate audit workflow now calls a pinned reusable workflow instead of defining local audit steps. It retains its triggers and read-only contents permission, and passes a manifest ignore list.

Changes: Estate audit workflow

Layer / File(s)	Summary
Caller configuration and delegation `.github/workflows/main-estate-audit.yml`	The workflow documents its reported checks and exclusion from `actions.lock`. It calls the pinned reusable workflow and passes the documented manifest ignore paths, plus `audits/assail-classifications.a2ml`.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 6095d

The estate audit delegation is ready to merge after normal checks. The reported lock-pin failures appear unrelated to this change.

### Architecture Summary

Architecture risk: 🔵 Low · up to 6095d

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

observed — Modified behavior in .github/workflows/main-estate-audit.yml: The workflow header now identifies this file as a thin caller of the reusable estate audit, documents its five reported component checks, periodic triggers and deliberate actions.lock exclusion, and warns against re-onboarding it. This replaces the previous actions-lock management comment and shorter audit description.
observed — Modified behavior in .github/workflows/main-estate-audit.yml: The local estate-audit job, which ran individual checks directly on ubuntu-latest with a 20-minute timeout, is replaced by a call to the pinned cicd-suite reusable workflow. The caller supplies a manifest-ignore list containing the documented defaults plus audits/assail-classifications.a2ml.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly summarises the main change: it replaces the local estate audit with the cicd-suite reusable audit and excludes the panic-attack registry.
Description check		The description is directly related to the workflow and lockfile changes. It explains the reasons, implementation, verification, triggers, and known unrelated failures.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

❌ Error running CI fixer.

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector · 2026-10-19T16:29:01Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T16:31:14.734491Z	`6095d95`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

hyperpolymath · 2026-10-19T16:32:59Z

codeql-actions / analyze failed in job setup, before any step ran:

Unable to resolve action `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile. lockfile verification did not produce a result for this action

This failure isn't caused by this PR.

This PR doesn't touch codeql.yml, or the actions/checkout@3d3c42e… / hyperpolymath/standards@7d2041a… lock entries that it resolves through.
The same error has been failing januskey main at 69de917 since 18 Oct. The scheduled runs of Rust CI (run 39210840705), Scorecards (39200395181), Hypatia (39084234547) and Squabble (39204648070, on the cicd-squabbler@b34cd53 pin) all fail this way.
Any other check here that dies in "Set up job" with invalid lockfile pin is the same problem.

No fix exists yet. It looks like a change in how GitHub verifies lock entries at run time, possibly tied to gh-actions-lock v0.2.0 (released 2026-10-12). It is being investigated separately, and the fix most likely belongs in standards rather than in this PR.

Generated by Claude Code

coderabbitai · 2026-10-19T17:28:09Z

Add Carrot credits or activate Agent usage billing to use Autofix

coderabbitai · 2026-10-19T17:28:42Z

✅ Coding Agent task started: View task and status

The task will inspect the CI failures, validate its fix, and commit the fix to this branch automatically.

Note: Fixing CI failures is a beta feature and may encounter errors. Expect some limitations and changes as we gather feedback and continue to improve it.

⏭️ Checks skipped: 2 · already failing on `main` (not caused by this PR)

GitHub Actions: Hypatia Security Scan / 0_hypatia _ Hypatia Neurosymbolic Analysis.txt
GitHub Actions: Rust CI / 4_rust-ci _ Detect Cargo.toml.txt

hyperpolymath · 2026-10-19T17:29:47Z

@coderabbitai please don't push a CI fix to this branch. These 44 failures aren't caused by this PR.

Every one of them dies in "Set up job" before any step runs, with invalid lockfile pin on actions/checkout@3d3c42e… or on hyperpolymath/cicd-squabbler/.github/actions/squabble@b34cd53…. This PR changes neither entry, and none of the failing workflows.

Most of these checks don't show as red on main because they last ran there on push on 2026-10-14, before the failure started. Every workflow that has run on main since 2026-10-18 fails the same way at 69de917:

Rust CI, run 39210840705
Scorecards, run 39200395181
Hypatia, run 39084234547
Squabble, run 39204648070

The cause is upstream: a change in GitHub's runtime lockfile verification, probably related to gh-actions-lock v0.2.0. That's being investigated separately. Editing actions.lock by hand here would mask it rather than fix it, and auto-merge is enabled.

Generated by Claude Code

coderabbitai · 2026-10-19T17:52:00Z

Tip

For best results, initiate chat on the files or code changes.

@hyperpolymath Understood. I will not initiate another CI fix for this branch. Thanks for the clarification.

I cannot cancel the already-started coding task from this chat. That task is not confirmed stopped. Please check the task page for a cancellation control.

Your evidence distinguishes these setup failures from regressions in #158. The suspected runtime verification change remains under investigation. A hand-edited lockfile is not an established fix.

✏️ Learnings added

Learnt from: hyperpolymath
URL: https://github.com/hyperpolymath/januskey/pull/158

Timestamp: 2026-10-19T17:51:15.110Z
Learning: For hyperpolymath/januskey PR #158, the author reports that 44 CI failures occur during "Set up job" with "invalid lockfile pin", including workflows on main since 2026-10-18 at commit 69de917. Older green checks on main predate the failure and do not establish a PR regression. The cause is under separate investigation; a relationship to GitHub runtime lockfile verification or gh-actions-lock v0.2.0 is suspected, not confirmed. The author explicitly prohibits pushing a CI fix to this PR branch or hand-editing actions.lock to work around these failures, especially because auto-merge is enabled.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

You are interacting with an AI system.

coderabbitai · 2026-10-19T17:52:49Z

Rate Limit Exceeded

@hyperpolymath have exceeded the limit for the number of chat messages per hour. Please wait 0 minutes and 46 seconds before sending another message.

hyperpolymath marked this pull request as ready for review October 19, 2026 16:28

hyperpolymath enabled auto-merge (squash) October 19, 2026 17:12

hyperpolymath disabled auto-merge October 20, 2026 13:09

hyperpolymath merged commit d6d3d78 into main Oct 20, 2026
24 of 47 checks passed

hyperpolymath deleted the claude/new-session-lwzjw0 branch October 20, 2026 13:09

Navigation Menu

Repository navigation

ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry - #158

ci(estate-audit): call cicd-suite's reusable audit; skip panic-attack's registry#158
hyperpolymath merged 1 commit into
mainfrom
claude/new-session-lwzjw0

hyperpolymath commented Oct 19, 2026

Uh oh!

coderabbitai Bot commented Oct 19, 2026 •

edited

Loading

Summary by CodeRabbit

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

hyperpolymath commented Oct 19, 2026

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Uh oh!

coderabbitai Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

hyperpolymath commented Oct 19, 2026

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

hyperpolymath commented Oct 19, 2026

Why

What

Verification

Not in this PR

Uh oh!

coderabbitai Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

hyperpolymath commented Oct 19, 2026

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Uh oh!

coderabbitai Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hyperpolymath commented Oct 19, 2026

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Rate Limit Exceeded

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Oct 19, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading

coderabbitai Bot commented Oct 19, 2026 •

edited

Loading