Repository navigation
ci: fix the Codex review findings on the template CI port - #16
Conversation
hyperpolymath/standards moved to metadatastician/standards. A reusable
`uses:` does not follow the rename, and a hyperpolymath repository cannot
call a reusable in metadatastician's repository (rsr-template-repo#253
measured it: every caller failed at startup). Governance, Rust CI,
Hypatia and Secret Scanner had stopped loading ("workflow was not found").
Ports rsr-template-repo's CI from 60cedf1 to 8034fc9, its last green main
commit, by a three-way apply of the template's own diff over .github,
scripts, tests, .machine_readable, verification, build/container and the
K9 records, then the mint's self-name pass, as a mint would:
- self-contained workflows checking out metadatastician/standards@8e48b1c;
- squabble, proven-tests and fork-governance workflows; deed and K9
validation move into Dogfood Gate;
- KYAML container config (data unchanged, rendered with this repo's
values and canonicalised by kyaml-format.sh), K9 contract v1.0.0
records, a JCS-canonical aibdp schema;
- CLAUDE.md regenerated by the arrival pack; the template's lock plus
proofs.yml.
Not ported: the generator tests (use-this-template mint, template-pin
resolver, e2e mint tests), which exercise repo-init.just. Known gap: the
self-contained governance runs one policy step where the reusable ran 19
jobs (UUID v8 conformance, licence consistency, lockfile verify, ratchets,
JS runtimes); they return when standards is callable again.
tests/workflows/actions_lock_sha_refs_test.sh now checks every SHA-keyed
record in the lock against an exact table, keeps all its negative
controls, and refuses any reusable call into the moved repository.
ffi_strings_test.sh and container_kyaml_test.sh join mint-verbatim.txt:
they are token fixtures the placeholder gate otherwise rejects.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LiQzWJdcPfRU6YMDGRG8Xi
The proven-tests workflow's bench lane needs benches/baseline.json, which the port left behind: it sits outside the paths ported in d8878e5. Ported from rsr-template-repo 60cedf1..8034fc9 with template_bench.sh, the same three-way apply. run-proven-suite.sh --bench now passes locally, both bench lanes included. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LiQzWJdcPfRU6YMDGRG8Xi
The proven suite's FFI lane failed: tests/ffi_strings_test.sh names the
template's functions by filling `{{project}}` with test_project, so it only
works while main.zig still carries the token. In a minted repository the
functions are resource_algebra_*, and the appended tests named nothing.
The test now reads the export prefix from `export fn <prefix>_init()` after
filling the tokens and maps it to test_project, failing loudly when no
prefix is found. Checked on this tree and on the template's tokenised
main.zig: all six functions the tests call resolve.
src/interface/ffi/src/main.zig takes the template's 8034fc9 version (the
ownership docs and the string tests the lane exercises), with the mint's
values filled in as before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LiQzWJdcPfRU6YMDGRG8Xi
- build/just/repo-init.just: the template's generator at 8034fc9, verbatim as mint-verbatim.txt lists it, so it matches the mint scripts the port brought (file-list strip-instruction-blocks, the verbatim manifest, gen-repo-map --worktree). - secret-scanner.yml: the estate gitleaks baseline always runs; a repository .gitleaks.toml adds a pass instead of replacing it. - check-required-contexts.sh: a mapped context also needs a job whose check-run name is that context; squabble_gate_test names its fixture jobs and adds renamed-job and no-job mutants. - main-estate-audit.yml: the SPDX step carries cicd-suite's warning, so it mirrors that gate at its pin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LiQzWJdcPfRU6YMDGRG8Xi
main's b11b3bc has the same tree as #15's head 2d5f150, so conflicts resolve to this branch. The CHANGELOG keeps #15's entry as merged and records the review fixes in their own entry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LiQzWJdcPfRU6YMDGRG8Xi
|
Caution Review failedThe pull request is closed. Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f43456afa1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| for _v in "${MINT_VERBATIM[@]}"; do | ||
| [ -f "$_v" ] || { echo "Error: $VERBATIM_LIST names $_v, which does not exist (stale entry)."; exit 1; } |
There was a problem hiding this comment.
Every repo-init invocation from this commit exits here before reaching its prompts because the existing manifest names five files absent from the committed tree: scripts/resolve-template-pin.sh, tests/e2e/use_template_mint_test.sh, tests/workflows/self_name_pass_test.sh, tests/workflows/julia_library_test.sh, and tests/workflows/resolve_template_pin_test.sh. Port the required files or tailor the manifest to this repository; merely relaxing this validation is insufficient because the new provenance code later invokes the missing resolver directly.
Useful? React with 👍 / 👎.
| PACKAGE_UUID=$(python3 -c ' | ||
| import hashlib, sys | ||
| pre = ("julia-package-identity:github.com/%s/%s" % (sys.argv[1], sys.argv[2])).encode() | ||
| b = bytearray(hashlib.sha256(pre).digest()[:16]) | ||
| b[6] = (b[6] & 0x0F) | 0x80 # version 8 | ||
| b[8] = (b[8] & 0x3F) | 0x80 # variant 10 | ||
| h = b.hex() | ||
| print(f"{h[0:8]}-{h[8:12]}-{h[12:16]}-{h[16:20]}-{h[20:32]}")' "${OWNER_LC}" "${REPO}") |
There was a problem hiding this comment.
When the Julia mint path is exercised, the checked-in acceptance test does not test this new derivation: tests/e2e/julia_mint_test.sh lines 48-52 still generates a UUIDv5, while lines 114-120 explicitly assert version 5. Because that test independently simulates the recipe, it can remain green while repo-init emits a UUIDv8 and provides no regression coverage for the new preimage/version-bit logic; update it to derive and assert the same profile-C UUIDv8.
Useful? React with 👍 / 👎.
| case "$file" in | ||
| docs/decisions/*|CHANGELOG.md|*/CHANGELOG.md) continue ;; |
There was a problem hiding this comment.
When this carried generator mints a child from resource-algebra, CHANGELOG.adoc is included in mint_files but this exclusion recognizes only Markdown changelogs. The subsequent dynamic self-name substitution therefore rewrites historical entries such as resource-algebra_chora.deed and resource-algebra.agda-lib to the child's name, while protected issue references remain unchanged, leaving the inherited history both corrupted and internally inconsistent. Include CHANGELOG.adoc (and nested AsciiDoc changelogs) in the wholesale changelog exclusion described by the preceding comment.
Useful? React with 👍 / 👎.
| if command -v bun >/dev/null 2>&1 && [ -f "${STANDARDS_UUID_V8_JS:-}" ]; then | ||
| PACKAGE_UUID=$(bun "${STANDARDS_UUID_V8_JS}" c julia-package-identity "github.com/${OWNER_LC}/${REPO}") | ||
| elif command -v python3 >/dev/null 2>&1; then | ||
| PACKAGE_UUID=$(python3 -c "import uuid; print(uuid.uuid5(uuid.UUID('${REPO_UUID}'), 'julia:${REPO}'))") | ||
| PACKAGE_UUID=$(python3 -c ' | ||
| import hashlib, sys | ||
| pre = ("julia-package-identity:github.com/%s/%s" % (sys.argv[1], sys.argv[2])).encode() |
There was a problem hiding this comment.
For a Julia mint where the operator selects a non-default forge such as GitLab or Codeberg, the repository UUID, website, deed, and push URL all use FORGE, but both new UUIDv8 implementations still hash a hard-coded github.com/<owner>/<repo> identity. Identically named repositories on different forges consequently receive the same package UUID, contrary to the recipe's identity rule that a repository hosted elsewhere derives a different UUID; construct the profile-C name from the selected forge in both the Bun and Python paths.
Useful? React with 👍 / 👎.
Summary
Follow-up to #15, which merged while its Codex review was still being answered. This PR fixes the five findings that were real defects. The other two are answered below.
Changes
build/just/repo-init.just. Codex threads: thestrip-instruction-blocksP1, the mint-verbatim P1 and thegen-repo-mapP2.0afa6c9copy.strip-instruction-blocks ., which the new tool rejects with exit 2. It also ignoredmint-verbatim.txtand mapped the index instead of the worktree.8034fc9, verbatim, which is howmint-verbatim.txtsays a child carries it. It feeds the tool a file list, honours the manifest and passesgen-repo-map.sh --worktree.secret-scanner.yml. Codex thread: P1, security..gitleaks.tomlreplaced the estate baseline in all three passes, so a pull request could add a permissive local config and pass.scripts/check-required-contexts.sh. Codex thread: P2.name:, or the job id) is exactly that context.squabble_gate_test.shnames its fixture jobs after the context, so each mutant still fails only for its own defect. Two mutants are new: a renamed job and a workflow with no jobs.main-estate-audit.yml. Codex thread: P2.bf7dd95, cicd-suite'sspdx-license-checkenforces only a root licence file. When the repository has no SPDX line at all, it emits a::warning::; its exit is commented out "until adoption".Not changed:
container.justdeploy rendering (Codex P2).container-initis a one-shot: it fills tokens, then renamesdeploy.k9.ncl.in.deploy.k9.nclincluded, which takes the recipe's "already exists, not overwritten" branch..inhere would only reintroduce a token file into a minted child.RSR Quality Checklist
Required
just testor equivalent). Not run in full:just testandjust qualitystop locally at the idris2 and zig steps, because neither toolchain is installed here. CI provisions both. Every suite this PR touches passes; see Testing.just fmtor equivalent)unsafeblocks without// SAFETY:commentsbelieve_me,unsafeCoerce,Obj.magic,Admitted,sorry).envfiles includedAs Applicable
CHANGELOGor release notes updatedTesting
.gitleaks.tomlthat allowlists every path: the new step exits 1. The old selection, which used only the local config, exits 0.squabble_gate_test.shreports 81 passed and 0 failed.mint_cleanup_test.sh,archetype_lock_merge_test.sh,repo_map_determinism_test.sh,run_proven_suite_test.sh,validate_workflows_test.shandactions_lock_sha_refs_test.shpass, the last with yq 4.53.3.check-no-placeholders.shpasses,just --listparses with the new generator, andgen-repo-map.sh --worktreeleaves the map unchanged.Generated by Claude Code