Repository navigation
chore(ci): repin estate-audit reusable to the SHA-pinned callee (cicd-suite#11 follow-up) - #116
Merged
Merged
Conversation
…A-pinned callee (cicd-suite#11) The caller pin (rsr#113) points at dbe2b2a, whose content still carries 26 `actions/*-check@main` refs. With sha_pinning_required=true on both repos, any run whose job graph contains unpinned refs is rejected at startup with zero jobs — which is why the gate stayed red even after the dead-branch ref was fixed. cicd-suite#11 pinned all 26 refs; this bump makes the caller actually reference that fixed content. Opening this PR fires the reusable via on:pull_request — the PR check itself is the witness: it should create a real job for the first time since Sep 15.
Contributor
|
Warning Review limit reachedNext included review available in 38 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
hyperpolymath
enabled auto-merge (squash)
September 17, 2026 20:07
hyperpolymath
disabled auto-merge
September 17, 2026 20:07
hyperpolymath
added a commit
that referenced
this pull request
Sep 17, 2026
… replaces #118; doubles as estate-audit startup witness (#121) Replacement for #118, which was closed by accident: while trying to re-trigger its checks via a close/reopen cycle, the close fired this repo's auto-delete-head-branch setting and the reopen 422'd — my error, no content lost. This branch is exactly #118's head (`eb5f0f5`), which already includes the owner's "Update branch" merge of main. ## Content (unchanged from #118) Code-scanning alert burn-down: **8 of the 12 open Hypatia advisories**, each fix verified locally. | alerts | rule | fix | witness | |---|---|---|---| | #68 #69 | `workflow_audit/missing_timeout_minutes` | `timeout-minutes: 10` on `label-triage.yml:triage` + `labels.yml:sync` | YAML parses, banners intact | | #122 | `content_patterns/hardcoded_tmp` | scanner enumeration file → bare `mktemp` (TMPDIR-respecting) | `bash -n`; gate interface untouched | | #125 #126 | `content_patterns/hardcoded_tmp` | test fixture → bare `mktemp -d`; cleanup guard strengthened to "absolute path AND existing directory" | **test run before/after: byte-identical output, both rc=0, controls pass** | | #123 #124 | `content_patterns/hardcoded_tmp` | commented example in `tests/e2e.sh` teaches `WORKDIR=$(mktemp -d)` | `bash -n` | | #131 | `workflow_hardening/WH008` | `mirror.yml`: `secrets: inherit` → explicit seven-entry map = the callee's complete optional contract | YAML parses; contract read from pinned callee | Not touched (owner calls): `npx_in_workflow` #119 (copilot config), #120/#134 (Justfile + contractile — off-limits by standing instruction). The four Scorecard `TokenPermissionsID` highs (#7/#8/#10/#132) were **dismissed via API** with messages citing the owners' own in-file justifications — stripping those grants would break signed releases, SARIF uploads, and Dependabot automerge. ## Second purpose: witness run for the estate-audit startup fix Opening this PR fires `main-estate-audit.yml` via `on: pull_request`. Since #116 merged, the caller pins the fully-SHA-pinned callee (`7689b04`, cicd-suite#11) — yet runs still died 0-job, including cicd-suite's *local* runs. Root cause identified: this repo's Actions allowlist is `selected`, and while `hyperpolymath/*` covers reusable-workflow calls at repo level (proven by the green `Mirror to Git Forges` runs calling into `standards`), **subdirectory actions need explicit path patterns** — the same reason the existing list spells out `google/clusterfuzzlite/actions/build_fuzzers@*` and the slsa reusable by full path. The callee's 26 `hyperpolymath/cicd-suite/actions/*-check` refs matched nothing. Both repos' allowlists have now gained the 26 explicit action patterns + the reusable's full path + the repo-level entry (93 → 121 patterns, nothing removed). **If this PR's estate-audit check creates a real job, the 0-job era — ongoing since Sep 12/13 — is over**; whatever the 26 gates then report is genuine audit signal at last. Co-authored-by: hyperpolymath <hyperpolymath@users.noreply.github.com>
hyperpolymath
added a commit
that referenced
this pull request
Sep 17, 2026
…-up) — transitive graph fully pinned (#124) Third and final repin — completes the chain that ends the estate-audit `startup_failure` era (ongoing since **Sep 13**, commit `f28a32e`). **Why #116 wasn't the end:** the caller pin `7689b04` had the workflow-level refs pinned (cicd-suite#11), but the startup rejection was **transitive** — GitHub validates the full action graph at run creation once refs are remote-style, and `manifest-check`'s composite internals still carried two `@main` cross-repo refs (`deed-ecosystem/validate-action`, `k9-ecosystem/validate-action`). With `sha_pinning_required: true` on both repos, the whole run was rejected before a single job existed — the 0-job, 0-annotation signature. cicd-suite#12 (merged 20:38 UTC) pinned those two; this bump makes the caller reference a **fully pinned graph** (`53fd9e0`). **Built-in witness:** opening this PR fires the reusable via `on: pull_request`. If the check creates a real job, the audit's 26 gates report genuine signal for the first time in five days — whatever they then say (some step-level failures are plausible; the suite has 22 in its history while it stabilises) is information replacing mystery. One line changed; YAML re-parsed; single `permissions:` block intact (#110); pin comment records the full provenance (3/3). Co-authored-by: hyperpolymath <hyperpolymath@users.noreply.github.com>
hyperpolymath
added a commit
that referenced
this pull request
Sep 17, 2026
…tool-normalized lock order cicd-suite#14 merged (main 98f405a): the callee is native-lockfile- compliant ($/actions/* refs, checkout@v7.0.1 lock key, deed/k9@main internals) and its own main push runs are green (audit 35276576603, self-test 35276576597). The caller's @53fd9e0 pin points at PRE-fix content, so every rsr estate-audit run since #124 merged has died 0-job on the callee side. Switch the caller to @main: cross-repo reusable-workflow calls are not lockfile-pinnable deps (gh actions-lock scoped run on this file: 'All 1 workflow valid', no entry added) — enforcement lives in the callee's own onboarded lockfile, and cicd-suite main is gated green on every push. This ends the manual repin treadmill (#110/#116/#124). Also includes gh actions-lock's normalization of the deed-validate lockfile key position (sorted order) from #125.
hyperpolymath
added a commit
that referenced
this pull request
Sep 17, 2026
…udit caller onto compliant cicd-suite@main (#126) Two repairs in one, both witnessed on this PR: **1. dogfood-gate hotfix (commit 1).** #125 was squash-merged at head `2484338` — seconds before the follow-up fix (`7b04399`) reached the PR. Main therefore carries a dangling `needs: [a2ml-validate, …]` (the job was renamed to `deed-validate`) → invalid job graph → main's dogfood-gate push run [`35276602266`](https://github.com/hyperpolymath/rsr-template-repo/actions/runs/35276602266) died **0-job**. This cherry-picks the fix: `needs: [deed-validate, …]` + scorecard DEED naming (`DEED_STATUS`, presence check scans `.a2ml` **and** `.deed`). **2. estate-audit caller → `@main` (commit 2).** cicd-suite#14 merged (main `98f405a`): the callee is native-lockfile-compliant and **green on its own main** (audit run [35276576603](https://github.com/hyperpolymath/cicd-suite/actions/runs/35276576603) — all 26 gates; self-test [35276576597](https://github.com/hyperpolymath/cicd-suite/actions/runs/35276576597)). The caller's `@53fd9e0` pin targets PRE-fix content → every rsr estate-audit run since #124 died 0-job callee-side. Cross-repo reusable-workflow calls are not lockfile-pinnable (`gh actions-lock` scoped run: *"All 1 workflow valid"*, no entry added — enforcement lives in the callee's own onboarded lockfile, and cicd-suite main is gated green on every push), so `@main` is both compliant and **the end of the manual repin treadmill** (#110 → #116 → #124 → done). Lock diff = the tool normalizing #125's key position into sorted order. **Witnesses on this PR:** caller run must finally spawn jobs cross-repo; dogfood-gate must spawn jobs and go green; governance's *Actions lockfile verify* must stay green. --------- Co-authored-by: hyperpolymath <hyperpolymath@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second half of the estate-audit startup fix — pairs with hyperpolymath/cicd-suite#11 (merged 19:58 UTC).
Why #113 wasn't enough: the caller pin points at
dbe2b2a, whose content still carries 26hyperpolymath/cicd-suite/actions/*-check@mainrefs. Withsha_pinning_required: trueon both repos, GitHub rejects the whole job graph at startup — 0 jobs, instant failure — regardless of how correctly the caller itself is pinned. cicd-suite#11 pinned all 26 refs at the callee; this PR makes the caller actually reference that fixed content (7689b04, cicd-suite main head).Built-in witness: this workflow has
on: pull_request— opening this PR fires the reusable. If the PR check creates a real job (instead of another 0-jobstartup_failure), the startup era is over; whatever the 26 checks then report is the audit's genuine signal (some step-level failures are expected — the suite has 22 in its history while it stabilises — but that's information replacing mystery).One line changed; YAML re-parsed; single
permissions:block preserved (#110's fix untouched).