From f9e7fa7077493f8d64920a3821b8948ca2fa8c24 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 12:19:01 +0000 Subject: [PATCH 1/3] ci(e2e): key the Rust cache on the CPU model MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit gossamer-rs's build.rs compiles libgossamer with `zig build-lib … -OReleaseSafe` and no -target or -mcpu, so Zig targets the build host's CPU. The archive also bundles Zig's compiler_rt, which exports memcpy/memset, so every binary that links it runs that code, even the bin's empty test harness. e2e.yml cached target/, including that archive, under a key that ignores the CPU. ubuntu-latest mixes CPU models, so a cache saved on one runner and restored on another can die with SIGILL. That happened on hyperpolymath/panll#155: - run 114 missed the cache, built everything, passed and saved the cache; - run 116, on byte-identical Rust source, restored it on a full key match, rebuilt only `panll`, and the panll-gossamer test harness hit SIGILL at startup. The cache key now includes a hash of /proc/cpuinfo's model name, so target/ is reused only on the same CPU model. The durable fix is upstream: gossamer-rs's build.rs should pass a portable -mcpu. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01SJtjqoZaSQo7uBwvwVMA9G --- .github/workflows/e2e.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 4c9283cd..f4c74c49 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -54,8 +54,17 @@ jobs: with: toolchain: stable + # gossamer-rs builds libgossamer with Zig for the host CPU (no -mcpu), so + # a target/ cache restored on a runner with another CPU model can die + # with SIGILL. Key the cache on the CPU model. + - name: CPU model for the cache key + id: cpu + run: echo "model=$(grep -m1 'model name' /proc/cpuinfo | sha256sum | cut -c1-12)" >> "$GITHUB_OUTPUT" + - name: Rust cache uses: Swatinem/rust-cache@v2.9.2 + with: + key: cpu-${{ steps.cpu.outputs.model }} - name: Install GTK/WebKit dev headers run: sudo apt-get update && sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev From 5f40b38c13b62cad27d8bbfc9798ed5c693bde71 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 12:00:07 +0000 Subject: [PATCH 2/3] ci: repin the standards reusables past the lockfile fix (standards#1271) GitHub's runner now enforces actions.lock inside reusable workflows, and for a reusable it reads the defining repository's lock. standards@092deda records actions/checkout@3d3c42e5 with `ref:` set to the SHA itself, which the runner rejects as "invalid lockfile pin". Hypatia (scheduled 18 Oct) and Scorecards (19 Oct) on main failed at job setup with exactly that; the 14 Oct push runs, on an older runner build, passed on the same commit. standards fixed its lock in f335165a (#1271). - Governance, Hypatia, Scorecards, Secret Scanner and Mirror move from standards@092deda to standards@75bd599 (main, 2026-10-19). Every input and secret the reusables gained since is optional. - secrets: inherit is narrowed to what each callee declares, as standards did for its own callers (#1283/#1284): HYPATIA_SCAN_PAT for Governance and Hypatia, the seven named forge keys for Mirror, nothing for Secret Scanner and Scorecards. - actions.lock: the standards@75bd599 record lists the external uses: of the five called files (the shape close-lock.sh writes, #1247), and each of those has a leaf record copied from standards' own lock at 75bd599 (tag refs, re-checked against git ls-remote). The record I added in #150 for actions/checkout@3d3c42e5 had the same SHA-as-ref defect; it is now ref v7.0.1. Rust CI stays on standards@412a703, which has no lockfile to enforce. Verified locally with standards' check-actions-lock-gate.sh and update-actions-lock.sh --verify-local at 75bd599, gh-actions-lock v0.2.0. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3 (cherry picked from commit 689a79ef7ba4f91128ee27555987b41f48fedcfe) --- .github/workflows/actions.lock | 84 ++++++++++++++++++++++++---- .github/workflows/governance.yml | 4 +- .github/workflows/hypatia-scan.yml | 5 +- .github/workflows/mirror.yml | 11 +++- .github/workflows/scorecard.yml | 3 +- .github/workflows/secret-scanner.yml | 3 +- 6 files changed, 90 insertions(+), 20 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index c8117ccb..58daaa9c 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -28,9 +28,9 @@ workflows: - 'goto-bus-stop/setup-zig@v2.2.1' - 'swatinem/rust-cache@v2.9.2' '.github/workflows/governance.yml': - - 'hyperpolymath/standards@092dedada188f56c5915f74a5fd40aac093742c3' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/hypatia-scan.yml': - - 'hyperpolymath/standards@092dedada188f56c5915f74a5fd40aac093742c3' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/instant-sync.yml': - 'peter-evans/repository-dispatch@v4.0.1' '.github/workflows/label-triage.yml': [] @@ -38,23 +38,28 @@ workflows: '.github/workflows/main-estate-audit.yml': - 'hyperpolymath/cicd-suite@4f5404281dd7092fa77cc18daec7237c4f1ee4ac' '.github/workflows/mirror.yml': - - 'hyperpolymath/standards@092dedada188f56c5915f74a5fd40aac093742c3' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/push-email-notify.yml': - 'hyperpolymath/smtp-notify-action@v0.5.0' '.github/workflows/rust-ci.yml': - 'hyperpolymath/standards@412a7031577112b31ee287cc6060179d638d6500' '.github/workflows/scorecard.yml': - - 'hyperpolymath/standards@092dedada188f56c5915f74a5fd40aac093742c3' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/secret-scanner.yml': - - 'hyperpolymath/standards@092dedada188f56c5915f74a5fd40aac093742c3' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' dependencies: + 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9': + ref: 'v6.1.0' + commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' + owner_id: 44036562 + repo_id: 215566462 'actions/cache@v6.1.0': ref: 'v6.1.0' commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' owner_id: 44036562 repo_id: 215566462 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': - ref: '3d3c42e5aac5ba805825da76410c181273ba90b1' + ref: 'v7.0.1' commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' owner_id: 44036562 repo_id: 197814629 @@ -78,6 +83,11 @@ dependencies: commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' owner_id: 44036562 repo_id: 192625955 + 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9': + ref: 'v7.0.2' + commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' + owner_id: 44036562 + repo_id: 192625955 'actions/upload-pages-artifact@v5.0.0': ref: 'v5.0.0' commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9' @@ -85,11 +95,36 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed': + ref: 'v2.0.5' + commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' + owner_id: 42048915 + repo_id: 356423100 + 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f': + ref: 'v1' + commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + owner_id: 1940490 + repo_id: 260749683 'dtolnay/rust-toolchain@v1': ref: 'v1' commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f' owner_id: 1940490 repo_id: 260749683 + 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393': + ref: 'v3.0.0' + commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393' + owner_id: 26415196 + repo_id: 297874902 + 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124': + ref: 'v1.24.1' + commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' + owner_id: 47606891 + repo_id: 331103973 + 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63': + ref: 'v4.38.0' + commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' + owner_id: 9919 + repo_id: 259445878 'github/codeql-action@v4.38.3': ref: 'v4.38.3' commit: 'sha1-24c54180a607b1449ed407dd24f251e4e9147c8d' @@ -146,16 +181,38 @@ dependencies: commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef' owner_id: 6759885 repo_id: 1352485172 - 'hyperpolymath/standards@092dedada188f56c5915f74a5fd40aac093742c3': - ref: '092dedada188f56c5915f74a5fd40aac093742c3' - commit: 'sha1-092dedada188f56c5915f74a5fd40aac093742c3' - owner_id: 6759885 - repo_id: 1116521501 'hyperpolymath/standards@412a7031577112b31ee287cc6060179d638d6500': ref: '412a7031577112b31ee287cc6060179d638d6500' commit: 'sha1-412a7031577112b31ee287cc6060179d638d6500' owner_id: 6759885 repo_id: 1116521501 + 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': + ref: '75bd5994470661a099df562d6d5ad2fe744dbd66' + commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66' + owner_id: 6759885 + repo_id: 1116521501 + uses: + - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' + - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' + - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393' + - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' + - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' + - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' + - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6' + - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' + 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': + ref: 'v2.4.4' + commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' + owner_id: 67707773 + repo_id: 421101922 + 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6': + ref: 'v2.2.0' + commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6' + owner_id: 108928776 + repo_id: 512644635 'peter-evans/repository-dispatch@v4.0.1': ref: 'v4.0.1' commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697' @@ -166,3 +223,8 @@ dependencies: commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' owner_id: 580492 repo_id: 298565987 + 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555': + ref: 'v0.10.0' + commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555' + owner_id: 135788 + repo_id: 208510314 diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index c707088a..95eafe72 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -33,4 +33,6 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + secrets: + HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }} diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 25fe50d4..06edf194 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -27,5 +27,6 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 - secrets: inherit + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + secrets: + HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }} diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index af1d68f8..6182ddfd 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -13,5 +13,12 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 - secrets: inherit + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + secrets: + GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} + BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} + CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }} + SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }} + DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }} + GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }} + RADICLE_KEY: ${{ secrets.RADICLE_KEY }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 57473e9e..47ce57a7 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -16,5 +16,4 @@ jobs: contents: read security-events: write id-token: write - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 - secrets: inherit + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index ebe54aef..f5e9834a 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -21,5 +21,4 @@ jobs: contents: read pull-requests: write actions: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 - secrets: inherit + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 From eb6d0f0fbbf319fb216b3675365cfe1c6073c3b9 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 12:04:54 +0000 Subject: [PATCH 3/3] ci(secrets): ignore four historical gitleaks fingerprints MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit standards@75bd599's secret scanner adds a full-history gitleaks pass. On this PR it found four historical findings, none a credential, none in the current tree: - docs/api-reference.md at aff0781: the placeholder snapshot id in the API examples (replaced in #140); - tests/aspect/security_test.mjs at 9eed9ac: synthetic ABCDEFGHIJ… OpenAI/GitHub-shaped fixtures for the redaction tests (built at runtime by syntheticToken() since #122). .gitleaksignore lists exactly those commit:file:rule:line fingerprints, the format standards uses for its own history. Reproduced with the pinned gitleaks 8.18.4 and the estate baseline: 4 leaks before, none after. Canary: the same placeholder committed again is still caught. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3 (cherry picked from commit 926742f8f7df7ce1a3d2ac1289546cafca72d4e3) --- .gitleaksignore | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 .gitleaksignore diff --git a/.gitleaksignore b/.gitleaksignore new file mode 100644 index 00000000..05ef7fe1 --- /dev/null +++ b/.gitleaksignore @@ -0,0 +1,15 @@ +# SPDX-License-Identifier: MPL-2.0 +# +# Exact historical fingerprints only (commit:file:rule:line), for the +# full-history gitleaks pass in standards' secret-scanner-reusable. None is a +# real credential, and the current tree no longer carries any of them: +# - docs/api-reference.md: the placeholder snapshot id `abc123-def456` in the +# API examples, replaced by an obviously fake id in #140. +# - tests/aspect/security_test.mjs: synthetic OpenAI/GitHub-shaped tokens +# (ABCDEFGHIJ… fixtures) for the redaction tests, now built at runtime by +# syntheticToken() since #122. +# These entries suppress nothing in any other commit or location. +aff07811392d0b2a884f08284a0f4e8ab0e1cc68:docs/api-reference.md:generic-api-key:38 +aff07811392d0b2a884f08284a0f4e8ab0e1cc68:docs/api-reference.md:generic-api-key:72 +9eed9ac0fe21b99aed24be00d9c43007d8df3046:tests/aspect/security_test.mjs:generic-api-key:263 +9eed9ac0fe21b99aed24be00d9c43007d8df3046:tests/aspect/security_test.mjs:generic-api-key:269