Repository navigation
fix(ci): pin standards reusables to default-branch HEAD - #86
Conversation
This repo's standards reusable pins are re-pointed at the standards default-branch HEAD, resolved live at sweep time. The prior refs are recorded in the verification line below. Three kinds of drift are repaired together and the body does not claim which one this repo had: an UNREACHABLE sha kills the run at workflow STARTUP, so GitHub reports no check at all rather than a failing one and the gate disappears instead of going red; a FLOATING ref (@main) is unpinned supply chain; a merely STALE but reachable sha silently reintroduces every bug fixed since it. files=6 pins=6 perms=0 permlines=0 from=571cc734cd69fb846032ec77a662aa8ee4fc32cd,81dbf2dd854b1444fd6236fa2352474383b2c2b9,c65436ee3351cd6b0fa14b142938b195efc77586,fad242d35291de1898242d6737ba02b74a59a2f2 target=8f2ee508 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (6)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (39)
🔇 Additional comments (6)
📝 SummarySummary by CodeRabbit
WalkthroughSix GitHub Actions workflows now reference updated pinned commits of reusable workflows from ChangesReusable workflow pin updates
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to The workflows now run updated pinned shared governance, CI, scanning, mirroring, and scorecard workflows without changing their local configuration. No current merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Description checkExplanation The description explains the workflow pin updates, the reason for the change, the previous references, the target commit, and verification results. However, it omits the required template headings and checklist, and it does not provide explicit testing, formatting, lint, or applicability assessments. Resolution Add the required Summary, Changes, RSR Quality Checklist, Testing, and Screenshots sections. Complete the checklist and state which tests and checks were run, or explain why they were not applicable. Keep the existing rationale and verification details as supporting information. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks each workflow line Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
1 participant
Re-points this repo's
hyperpolymath/standardsreusable-workflow pins at the standards default-branch HEAD,8f2ee50841e216cd8c192eeb68953118190f105c.Why this is not a routine version bump.
uses: org/repo/.github/workflows/x.yml@<ref>is resolved at workflow startup, so a bad ref is not a failing job — it is no job at all. This campaign repairs three kinds of drift and does not assume which one this repo had:gh pr checkssimply lists fewer rows. A repo in this state looks greener than one with working gates;@mainruns, but unpinned — the supply-chain property the estate pins for is absent;The refs this repo was actually pinned to, before this PR:
571cc734cd69fb846032ec77a662aa8ee4fc32cd 81dbf2dd854b1444fd6236fa2352474383b2c2b9 c65436ee3351cd6b0fa14b142938b195efc77586 fad242d35291de1898242d6737ba02b74a59a2f2.Expect this PR to surface failures that main does not show. Those failures are revealed, not introduced — they are the gates resuming work after being silently absent. The honest comparison is the set of check names emitted here versus on
main, not pass/fail counts. On the canary (hyperpolymath/empty-linter#79) the governance suite was absent on main and emitted 25 checks once repaired.The target is default-branch HEAD resolved at sweep time, never a sha copied from a plan: a reachable but non-HEAD sha silently reintroduces every bug fixed since it.
Engine:
.git-private-farm/scripts/smtp-notify-sweep.sh --campaign campaigns/pin-repair.sh. Verification for this repo:files=6 pins=6 perms=0 permlines=0 from=571cc734cd69fb846032ec77a662aa8ee4fc32cd,81dbf2dd854b1444fd6236fa2352474383b2c2b9,c65436ee3351cd6b0fa14b142938b195efc77586,fad242d35291de1898242d6737ba02b74a59a2f2 target=8f2ee508 sig=G d3e7c0f canon=a7325fbdc356 base=main🤖 Generated with Claude Code
https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB