Repository navigation
CI: Hypatia scan fails — reusable pins an unresolvable actions/cache SHA (fix lives in hyperpolymath/standards) #56
Description
Symptom
The scan / Hypatia Neurosymbolic Analysis check fails on every PR (seen on #53, #54, #55) within ~2–3s:
##[error]Unable to resolve action `actions/cache@d4373f267a887d77f9eb0683a479ec60b1fe5b2b`, unable to find version `d4373f267a887d77f9eb0683a479ec60b1fe5b2b`
It is not caused by any repo content — it fails identically on main, and PRs that touch only Lean/Rust/docs still trip it. It is a broken action pin.
Root cause (out of this repo)
This repo's .github/workflows/hypatia-scan.yml is a one-line wrapper that calls a reusable:
jobs:
scan:
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5a93d9d57cc04de4002d6d0ecd336fc7a8698910The unresolvable actions/cache@d4373f26… pin lives inside that reusable, in hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml. The wrapper here is otherwise correct.
Fix (apply in hyperpolymath/standards)
Re-pin actions/cache to the SHA already used consistently across the estate (echo-types, januskey, nextgen-languages all use it and pass CI):
- uses: actions/cache@d4373f267a887d77f9eb0683a479ec60b1fe5b2b
+ uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5Impact
Estate-wide: every repo that consumes the Hypatia reusable fails this check until the pin is fixed in standards. One re-pin clears them all.
Scope note
The fix cannot be made from a session scoped to this repo — hyperpolymath/standards must be in scope (or fixed directly there). This issue tracks the dependency so the JtV-side failure is explained and the remedy is one copy-paste away.
Activity
hyperpolymath commentedon Jun 21, 2026
Update (2026-06-21): the stale pin now also fails the governance Workflow Staleness gate
The same stale standards pin (
@5a93d9d57cc0) now trips a second gate —governance / Check Workflow Staleness— which was green on earlier PRs today and flipped oncestandardsadvanced:So this is now estate-wide and fails on
maintoo (not PR-specific). Two distinct gates (Hypatia + Staleness) share this one root cause.In-repo remediation (this repo, in scope)
Re-pin the three wrapper workflows from
@5a93d9d57cc04de4002d6d0ecd336fc7a8698910to a current standards commit. Per the check, standards HEAD is09e7023d24682621bea4e11965a1ef5e87d86c3b; notemirror.ymlalready pins a newere6b2884722350515934d443daf23442f2195796f:.github/workflows/hypatia-scan.yml.github/workflows/governance.yml.github/workflows/scorecard.yml(There is no
scorecard-enforcer.ymlin this repo, so that clause of the error is N/A here.)Re-pinning to current standards HEAD should clear the staleness gate, and may also clear the Hypatia
actions/cachefailure if the broken cache pin was fixed upstream between5a93d9dand09e7023— verifying that needs read access tohyperpolymath/standards(out of this session's scope). I can do the in-repo re-pin on request.Generated by Claude Code
hyperpolymath commentedon Jul 27, 2026
Verified resolved — closing as stale.
Evidence (measured 2026-07-27):
Hypatia Security Scanhas succeeded on every run since at least 2026-07-23: runs30045368756,30045372928,30185371592,30217140682,30217176731— five consecutive successes.The scan is doing real work, not passing vacuously:
scan / Hypatia Neurosymbolic Analysis: success, steps=17.The unresolvable
actions/cachepin is gone. The only remaining reference toactions/cacheanywhere in.github/workflows/is an explanatory comment inproof-regression.yml:i.e. the upstream fix landed and the local workflow was deliberately written to avoid re-introducing the same failure mode.
No action needed in
hyperpolymath/standardsfor this issue.