[hyperpolymath]

What this fixes

Merging #242 (df96e43) took the Pages deploy on main down. casket-pages
concluded failure in Set up job — no step ran — with a single annotation:

lockfile missing pin for actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f

Same workflow, same pins, same repository as the run that passed 12 hours earlier
on b5530834. The only difference was .github/workflows/actions.lock.

Why

scripts/ci/pin-workflow-uses.py rebuilt the lockfile's dependencies: section
from the uses: lines it could see in this repository's workflows. That deletes
two things the file legitimately contains and cannot be re-derived from a grep:

• actions that composite actions resolve internally —
  actions/upload-pages-artifact runs actions/upload-artifact@bbbca2dd…
  itself, and no file of ours mentions it;
• the tag-keyed alias blocks (actions/checkout@v7.0.1 → the SHA) that
  gh actions-lock writes alongside each SHA entry.

GitHub validates the lockfile at job setup, so the deletion surfaces as a job
that never starts and a name nothing in the tree contains.

The change

• Regeneration merges into the committed dependencies: blocks: existing
  entries are preserved verbatim (ref, commit, owner_id, repo_id,
  uses:), and only missing keys are added, inheriting identity from the blocks
  already present. --check — what CI runs — is idempotent over the merged form,
  so it detects drift without being the thing that destroys the file.
• The blocks the earlier regeneration removed are restored.
• docs/CI-CD.adoc records the rule, so the next person to "tidy" the lockfile
  finds it written down rather than by taking CI down.

One annotation was the whole failure. It is in this PR's description because the
next one of these will be too.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-25T20:31:54.557476Z We couldn’t complete this review. Comment @codex review to try again.	5eefde8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Caution

Review failed

The pull request is closed.

📝 Summary

Summary by CodeRabbit

• New Features

  • Added PHP source scanning, with findings for selected suspicious code patterns.
  • Reports now show scan coverage, including files analysed and any gaps. A strict option can fail scans with incomplete coverage.
  • SARIF reports include coverage details, and aggregation can ingest test-evidence reports and optionally fail on defects.
  • Added new CI checks and workflows for action pinning, security scanning, test evidence and repository analysis.

• Bug Fixes

  • Large ledger files are now limited to 64 MiB by default; oversized files are skipped rather than partially read.

• Documentation

  • Added guidance on CI checks and PHP coverage. Minimum supported Rust version is now 1.90.

This pull request adds PHP analysis and scan-coverage reporting, proven-test report aggregation, configurable limits for hexad reads, and CI workflows and tools for action pinning, repository checks, secret scanning, and scanner baselines.

Changes: Action pinning and integrity

Layer / File(s)	Summary
Pin data and lockfile generation .github/workflows/action-pins.json, scripts/ci/pin-workflow-uses.py, scripts/ci/resolve-action-shas.sh	The new tools resolve action references, apply commit pins, and generate a lockfile while preserving existing dependency blocks.
Pin, lockfile and allowlist checks .githooks/validate-*.sh, .github/actions-allowlist.json, scripts/ci/check-allowed-actions.sh, .github/workflows/ci-integrity.yml, Justfile	Validation checks workflow references, lockfile coverage, allowlist matches and workflow structure.
Startup triage and policy documentation scripts/ci/triage-startup-failure.sh, docs/CI-CD.adoc, docs/ci/PROMPT-actions-policy.md	The triage script checks action references against GitHub. The documentation describes startup findings, policy settings and CI checks.
Pinned workflow references .github/workflows/*.yml	Action references in existing workflows now use commit SHAs in place of tags, or include comments repeating their existing pins.

CI verification workflows

Layer / File(s)	Summary
Audit and coverage workflows .github/workflows/cargo-audit.yml, .github/workflows/coverage.yml	The workflows generate JSON reports and job summaries, and upload available reports as artefacts.
Repository verification and annotations .github/workflows/verify.yml, scripts/ci/annotate.sh, Justfile, Cargo.toml, .github/CONTRIBUTING.md	The verification workflow adds formatting, lint, test, MSRV, documentation and coverage-ledger jobs. The annotation script reports command failures in GitHub Actions. The declared MSRV changes to 1.90.
Scan the checked-out commit .github/workflows/scan-and-report.yml	The workflow builds the checked-out commit and runs the resulting release binary.

Vendored secret scanning

Layer / File(s)	Summary
Vendored scanner jobs and local workflow call .github/workflows/secret-scanner-vendored.yml, .github/workflows/secret-scanner.yml	The local reusable workflow scans working-tree and Git history content, plus Rust, shell and AsciiDoc files. The existing secret-scanner workflow now calls it locally.

Assail coverage and PHP analysis

Layer / File(s)	Summary
Coverage model and language detection src/assail/coverage.rs, src/types.rs, src/assail/mod.rs	Coverage records track scan inputs and status, with lossless storage of non-UTF-8 Unix paths. Language detection adds PHP support and path-based detection.
Discover and analyse scan inputs src/assail/analyzer.rs	Analysis uses shared discovery, records coverage gaps, dispatches PHP files and emits schema 2.6 reports.
PHP syntax heuristics src/assail/php.rs, Cargo.toml	A PHP parser reports the specified empty-callable, hash-substitution and unserialize patterns.
Coverage CLI, SARIF and tests src/main.rs, src/report/sarif.rs, tests/coverage_php_tests.rs, tests/sarif_tests.rs, docs/php-coverage.adoc, CHANGELOG.adoc, chapel/tests/expected_contract.json, src/*, tests/*	The CLI can return status 2 after writing output when coverage is incomplete. SARIF includes coverage data. Tests and documentation cover the new report contract, PHP analysis and path handling.

Proven-test inventory and aggregation

Layer / File(s)	Summary
Inventory and validate test evidence scripts/proven/*, proven/ledger.json	The scripts inventory tests and map them to ledger entries and evidence tiers.
Ingest proven-test reports src/aggregate/*, src/main.rs, tests/aggregate_proof_fixture.rs, Justfile	Aggregate accepts proven-tests reports, resolves cited proof files, records validation defects and can fail when defects are present.
Run the evidence checks in CI .github/workflows/proven-tests.yml	The workflow runs ledger validation and scheduled or manually dispatched framework tests, then publishes reports and summary metrics.

Reconnaissance and CI-chain gates

Layer / File(s)	Summary
Scan and compare findings scripts/recon/compare.py, .github/workflows/recon.yml, recon/baseline.json, Justfile, docs/CI-CD.adoc	The workflow runs Assail and Pons scans and compares their reports with a baseline. The comparison script counts findings and reports regressions.
Fetch and diagnose CI gates .github/workflows/squabble-gate.yml, Justfile, docs/CI-CD.adoc	The workflow fetches PR gate data, diagnoses successful fetches and reports dependency-chain results.

Bounded hexad file reads

Layer / File(s)	Summary
Configure and enforce the read limit src/storage/mod.rs, CHANGELOG.adoc	Hexad reads use a 64 MiB default or a valid environment override. The loader rejects oversized files rather than parsing truncated content.

Priority: Pending latest changes

Estimated code review effort: 5 (Critical) | ~120 minutes

Change: Feature

Possibly related issues

• hyperpolymath/reposystem issue 319 — It describes startup failures related to incomplete workflow lock data and transitively closed lock entries, which overlap with the lockfile generation and validation changes.

Possibly related PRs

• hyperpolymath/panic-attack#242 — It changes workflows and reusable-action references that use the action lockfile; this PR changes lockfile generation to preserve dependency blocks.

Suggested reviewers: metadatastician

Merge Risk: Moderate · up to 5eefd

Several new CI and tooling pieces have concrete defects: the Justfile will not parse, the ledger check can overstate coverage, the squabble gate can hide blocking findings, and the scan workflow passes an unquoted input to the shell. Fix these before merging. The other findings are small CI or documentation corrections.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}