Repository navigation
chore(ci): final repin of estate-audit reusable (cicd-suite#12 follow-up) — transitive graph fully pinned - #124
Conversation
Third and last repin. #116 pointed the caller at 7689b04 (workflow-level refs pinned), but the startup rejection was transitive: manifest-check's composite internals still carried two @main cross-repo refs, which sha_pinning_required rejects at run creation — zero jobs, zero annotations, since f28a32e on Sep 13. cicd-suite#12 pinned those two; this bump makes the caller reference a fully pinned graph. Opening this PR is the witness: on:pull_request fires the reusable, and if a real job finally spawns, the 0-job era is over and the audit's 26 gates report genuine signal for the first time in five days.
|
Warning Review limit reachedNext included review available in 3 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
|
Superseded — root cause of the 0-job estate-audit era found: GitHub's native Actions lockfile enforcement ( |
…tool-normalized lock order cicd-suite#14 merged (main 98f405a): the callee is native-lockfile- compliant ($/actions/* refs, checkout@v7.0.1 lock key, deed/k9@main internals) and its own main push runs are green (audit 35276576603, self-test 35276576597). The caller's @53fd9e0 pin points at PRE-fix content, so every rsr estate-audit run since #124 merged has died 0-job on the callee side. Switch the caller to @main: cross-repo reusable-workflow calls are not lockfile-pinnable deps (gh actions-lock scoped run on this file: 'All 1 workflow valid', no entry added) — enforcement lives in the callee's own onboarded lockfile, and cicd-suite main is gated green on every push. This ends the manual repin treadmill (#110/#116/#124). Also includes gh actions-lock's normalization of the deed-validate lockfile key position (sorted order) from #125.
…udit caller onto compliant cicd-suite@main (#126) Two repairs in one, both witnessed on this PR: **1. dogfood-gate hotfix (commit 1).** #125 was squash-merged at head `2484338` — seconds before the follow-up fix (`7b04399`) reached the PR. Main therefore carries a dangling `needs: [a2ml-validate, …]` (the job was renamed to `deed-validate`) → invalid job graph → main's dogfood-gate push run [`35276602266`](https://github.com/hyperpolymath/rsr-template-repo/actions/runs/35276602266) died **0-job**. This cherry-picks the fix: `needs: [deed-validate, …]` + scorecard DEED naming (`DEED_STATUS`, presence check scans `.a2ml` **and** `.deed`). **2. estate-audit caller → `@main` (commit 2).** cicd-suite#14 merged (main `98f405a`): the callee is native-lockfile-compliant and **green on its own main** (audit run [35276576603](https://github.com/hyperpolymath/cicd-suite/actions/runs/35276576603) — all 26 gates; self-test [35276576597](https://github.com/hyperpolymath/cicd-suite/actions/runs/35276576597)). The caller's `@53fd9e0` pin targets PRE-fix content → every rsr estate-audit run since #124 died 0-job callee-side. Cross-repo reusable-workflow calls are not lockfile-pinnable (`gh actions-lock` scoped run: *"All 1 workflow valid"*, no entry added — enforcement lives in the callee's own onboarded lockfile, and cicd-suite main is gated green on every push), so `@main` is both compliant and **the end of the manual repin treadmill** (#110 → #116 → #124 → done). Lock diff = the tool normalizing #125's key position into sorted order. **Witnesses on this PR:** caller run must finally spawn jobs cross-repo; dogfood-gate must spawn jobs and go green; governance's *Actions lockfile verify* must stay green. --------- Co-authored-by: hyperpolymath <hyperpolymath@users.noreply.github.com>
Third and final repin — completes the chain that ends the estate-audit
startup_failureera (ongoing since Sep 13, commitf28a32e).Why #116 wasn't the end: the caller pin
7689b04had the workflow-level refs pinned (cicd-suite#11), but the startup rejection was transitive — GitHub validates the full action graph at run creation once refs are remote-style, andmanifest-check's composite internals still carried two@maincross-repo refs (deed-ecosystem/validate-action,k9-ecosystem/validate-action). Withsha_pinning_required: trueon both repos, the whole run was rejected before a single job existed — the 0-job, 0-annotation signature. cicd-suite#12 (merged 20:38 UTC) pinned those two; this bump makes the caller reference a fully pinned graph (53fd9e0).Built-in witness: opening this PR fires the reusable via
on: pull_request. If the check creates a real job, the audit's 26 gates report genuine signal for the first time in five days — whatever they then say (some step-level failures are plausible; the suite has 22 in its history while it stabilises) is information replacing mystery.One line changed; YAML re-parsed; single
permissions:block intact (#110); pin comment records the full provenance (3/3).