Repository navigation
fix(ci): post-triage gate repairs — duplicate permissions: block + shebangless planted control - #110
Merged
Merged
Conversation
….yml Two identical top-level `permissions: contents: read` blocks — one from #92, a second (with the reusable-caller rationale comment) added below the `on:` block, last touched by #100. Duplicate YAML keys are rejected by the Governance gate's 'Duplicate YAML keys in workflows' check; until #105 fixed the conflict markers in push-email-notify.yml, that gate died at the earlier 'Parse every tracked workflow' step and never reached the duplicate check, so this defect was invisible. Zero behaviour change: both blocks granted exactly `contents: read` (YAML last-key-wins meant the second was already the effective one). The rationale comment is preserved, hoisted above the single surviving block. Not touched here, escalated as an owner call: the same file's reusable call is branch-pinned (@feat/cicd-workflow-call) and trips the Workflow Security Linter's SHA-pin check. The owner is actively iterating that cicd-suite branch (Estate Rules runs fail there too); pinning a SHA mid-iteration would freeze work in flight. Pin + actions.lock entry once cicd-suite stabilises.
Contributor
|
Warning Review limit reachedNext included review available in 9 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
changed the title
|
hyperpolymath
added a commit
that referenced
this pull request
Sep 17, 2026
…2148) — the half of #110 that never landed (#111) Lands the half of #110 that didn't reach `main`. #110 carried two independent fixes; it was squash-merged at 19:29 UTC while its remote branch still held only commit 1 (the duplicate-`permissions:` fix, now on `main` at `9bcad0b`). Commit 2 — this one — was mid-force-push at the time and hit the auto-deleted branch. **Defect:** the stage-4 publication-boundary control `www/tests/controls/bad-deploy/tests/run-all.sh` (from #106) ships the one-word body `planted` with no shebang. The repo-wide ShellCheck gate runs at **error severity** and flags SC2148 on it, so **Code Quality has been red on `main` since #106 landed**. **Fix:** add `#!/usr/bin/env bash`. The control's violation is its **path** (a `tests/` subtree inside a staged deploy tree); `check-publication-boundary.sh:129` never reads its contents. Re-verified against current `main`: `www/tests/run-all.sh` → 6 checks, 0 failures, "planted bad stage rejected" still prints. With this merged, the only remaining red gates are the two deliberately escalated in #110's body: the branch-pinned reusable call in `main-estate-audit.yml:22` (`@feat/cicd-workflow-call`) tripping the Workflow Security Linter's SHA-pin check and failing the Central Estate CI/CD Audit run itself — owner's call once cicd-suite stabilises. Co-authored-by: hyperpolymath <hyperpolymath@users.noreply.github.com>
hyperpolymath
added a commit
that referenced
this pull request
Sep 17, 2026
…-suite#11 follow-up) (#116) Second half of the estate-audit startup fix — pairs with hyperpolymath/cicd-suite#11 (merged 19:58 UTC). **Why #113 wasn't enough:** the caller pin points at `dbe2b2a`, whose *content* still carries 26 `hyperpolymath/cicd-suite/actions/*-check@main` refs. With `sha_pinning_required: true` on both repos, GitHub rejects the whole job graph at startup — 0 jobs, instant failure — regardless of how correctly the caller itself is pinned. cicd-suite#11 pinned all 26 refs at the callee; this PR makes the caller actually reference that fixed content (`7689b04`, cicd-suite main head). **Built-in witness:** this workflow has `on: pull_request` — opening this PR fires the reusable. If the PR check creates a real job (instead of another 0-job `startup_failure`), the startup era is over; whatever the 26 checks then report is the audit's genuine signal (some step-level failures are expected — the suite has 22 in its history while it stabilises — but that's information replacing mystery). One line changed; YAML re-parsed; single `permissions:` block preserved (#110's fix untouched). Co-authored-by: hyperpolymath <hyperpolymath@users.noreply.github.com>
hyperpolymath
added a commit
that referenced
this pull request
Sep 17, 2026
…-up) — transitive graph fully pinned (#124) Third and final repin — completes the chain that ends the estate-audit `startup_failure` era (ongoing since **Sep 13**, commit `f28a32e`). **Why #116 wasn't the end:** the caller pin `7689b04` had the workflow-level refs pinned (cicd-suite#11), but the startup rejection was **transitive** — GitHub validates the full action graph at run creation once refs are remote-style, and `manifest-check`'s composite internals still carried two `@main` cross-repo refs (`deed-ecosystem/validate-action`, `k9-ecosystem/validate-action`). With `sha_pinning_required: true` on both repos, the whole run was rejected before a single job existed — the 0-job, 0-annotation signature. cicd-suite#12 (merged 20:38 UTC) pinned those two; this bump makes the caller reference a **fully pinned graph** (`53fd9e0`). **Built-in witness:** opening this PR fires the reusable via `on: pull_request`. If the check creates a real job, the audit's 26 gates report genuine signal for the first time in five days — whatever they then say (some step-level failures are plausible; the suite has 22 in its history while it stabilises) is information replacing mystery. One line changed; YAML re-parsed; single `permissions:` block intact (#110); pin comment records the full provenance (3/3). Co-authored-by: hyperpolymath <hyperpolymath@users.noreply.github.com>
hyperpolymath
added a commit
that referenced
this pull request
Sep 17, 2026
…tool-normalized lock order cicd-suite#14 merged (main 98f405a): the callee is native-lockfile- compliant ($/actions/* refs, checkout@v7.0.1 lock key, deed/k9@main internals) and its own main push runs are green (audit 35276576603, self-test 35276576597). The caller's @53fd9e0 pin points at PRE-fix content, so every rsr estate-audit run since #124 merged has died 0-job on the callee side. Switch the caller to @main: cross-repo reusable-workflow calls are not lockfile-pinnable deps (gh actions-lock scoped run on this file: 'All 1 workflow valid', no entry added) — enforcement lives in the callee's own onboarded lockfile, and cicd-suite main is gated green on every push. This ends the manual repin treadmill (#110/#116/#124). Also includes gh actions-lock's normalization of the deed-validate lockfile key position (sorted order) from #125.
hyperpolymath
added a commit
that referenced
this pull request
Sep 17, 2026
…udit caller onto compliant cicd-suite@main (#126) Two repairs in one, both witnessed on this PR: **1. dogfood-gate hotfix (commit 1).** #125 was squash-merged at head `2484338` — seconds before the follow-up fix (`7b04399`) reached the PR. Main therefore carries a dangling `needs: [a2ml-validate, …]` (the job was renamed to `deed-validate`) → invalid job graph → main's dogfood-gate push run [`35276602266`](https://github.com/hyperpolymath/rsr-template-repo/actions/runs/35276602266) died **0-job**. This cherry-picks the fix: `needs: [deed-validate, …]` + scorecard DEED naming (`DEED_STATUS`, presence check scans `.a2ml` **and** `.deed`). **2. estate-audit caller → `@main` (commit 2).** cicd-suite#14 merged (main `98f405a`): the callee is native-lockfile-compliant and **green on its own main** (audit run [35276576603](https://github.com/hyperpolymath/cicd-suite/actions/runs/35276576603) — all 26 gates; self-test [35276576597](https://github.com/hyperpolymath/cicd-suite/actions/runs/35276576597)). The caller's `@53fd9e0` pin targets PRE-fix content → every rsr estate-audit run since #124 died 0-job callee-side. Cross-repo reusable-workflow calls are not lockfile-pinnable (`gh actions-lock` scoped run: *"All 1 workflow valid"*, no entry added — enforcement lives in the callee's own onboarded lockfile, and cicd-suite main is gated green on every push), so `@main` is both compliant and **the end of the manual repin treadmill** (#110 → #116 → #124 → done). Lock diff = the tool normalizing #125's key position into sorted order. **Witnesses on this PR:** caller run must finally spawn jobs cross-repo; dogfood-gate must spawn jobs and go green; governance's *Actions lockfile verify* must stay green. --------- Co-authored-by: hyperpolymath <hyperpolymath@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two small repairs for red gates on
mainleft in the wake of the 2026-09-17 triage batch (#105/#106). Independent commits; both verified locally against currentmain.1.
fix(ci): merge the duplicatedpermissions:block in main-estate-audit.yml — Governance gateFixing the conflict markers in
push-email-notify.yml(#105) let the Governance gate get past its first step ("Parse every tracked workflow") for the first time since #100 — and the next step immediately went red on a defect that had been hiding behind the parse failure:main-estate-audit.ymlcarried two identical top-levelpermissions: contents: readblocks — one from #92, a second (with the reusable-caller rationale comment) inserted below theon:block.Fix: merge into a single block, rationale comment preserved and hoisted above it. Zero behaviour change (YAML last-key-wins meant the second block was already the effective one). Verified: file parses; duplicate-key scan across all workflows repo-wide now reports none — the "Duplicate YAML keys in workflows" step should go green.
Not fixed here — escalated as an owner call: the Workflow Security Linter's "Check SHA-Pinned Actions" failure is also in this file:
The reusable call is branch-pinned. The owner is actively iterating that cicd-suite branch (Estate Rules failed there too before #108 fixed it), so pinning a SHA mid-iteration would freeze work in flight. Recommendation: once cicd-suite stabilises, pin to a SHA and add the
actions.lockentry like every other reusable. This is the one gate that stays red after this PR, deliberately.2.
fix(tests): shebang for the bad-deploy planted control — Code Quality gatewww/tests/controls/bad-deploy/tests/run-all.sh(stage 4 of #106) ships the one-word bodyplantedwith no shebang. The repo-wide ShellCheck gate runs at error severity and flags SC2148 ("Add a shebang or a 'shell' directive") — so Code Quality went red onmainthe moment #106 landed. That one is squarely mine.Fix: add
#!/usr/bin/env bash. The control's violation is its path (atests/subtree inside a staged deploy tree);check-publication-boundary.sh:129never reads its contents. Re-verified after the edit:www/tests/run-all.sh→ 6 checks, 0 failures, "planted bad stage rejected" still prints.Post-merge gate status (at
042d654, before this PR)No issue to close — documented here for the record, as with the conflict-marker defect in #105.