Repository navigation
ci(haskell): build every package detect counted, not just root - #1181
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012kgrMQRhSmZMBbF9Ui1zBw
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 56 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configuration
📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/37529448444 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012kgrMQRhSmZMBbF9Ui1zBw
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/37529708989 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
Contributor
|
Add Carrot credits or activate Agent usage billing to use Autopilot |
hyperpolymath
enabled auto-merge (squash)
October 6, 2026 20:54
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/37530033685 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
|
7 of 13 tasks
hyperpolymath
added a commit
that referenced
this pull request
Oct 6, 2026
…#1185) ## Summary This resyncs the vendored `sanctify-php` copy (`rhodium-standard-repositories/satellites/cccp/satellites/sanctify-php/`) from upstream `hyperpolymath/sanctify-php` main **`fa9bd386`**. Since #1181 the shared Haskell job builds every package that `detect` counts, so this copy now gets compiled. It cannot even resolve. It held 37 of upstream's 182 files, and its `.cabal` pins `base ^>=4.17` (GHC 9.4) while the job's GHC ships `base-4.22`. Upstream has since relaxed that bound to `base >=4.17`. Owner ruling (2026-10-06, in session): resync from upstream, rather than excluding the package or leaving it red. The resync is scoped; nothing upstream was copied wholesale: - **In:** every path the copy already tracked, made identical to upstream. Paths upstream deleted are deleted here too: 5 ISSUE_TEMPLATEs, `comprehensive-quality.yml`, and `LICENSE.txt` (upstream ships `LICENSE`). Also added is what the `.cabal` needs to build: `src/`, `app/`, `bench/`, `test/*.hs` and `LICENSE`. - **Kept at the old vendored version.** Upstream's copy fails one of this repo's own gates, and editing vendored content to pass it is not ours to do. Neither file plays any part in the build. - `.github/dependabot.yml`: no SPDX header upstream (validate-spdx). - `.claude/CLAUDE.md`: upstream still names the retired `6a2/` path (check-canonical-names). - **Out:** - `.machine_readable/`: it holds a retired `6a2/` dir, plus K9 contractiles that would enter this repo's K9 gates. - Upstream's 13 newer workflows and `.github/hooks`. - `test/fixtures` and `test-plugins`: deliberately vulnerable PHP. - `www/` and `docs/`. The vendored `.hs` and `.cabal` files are upstream code, not written here. So any docstring-coverage score on them describes upstream. ## Type of change - [x] 🐛 Bug fix (non-breaking change that fixes an issue): it unblocks `Call CI Pipeline / Haskell` on main. - [ ] ✨ New feature: no - [ ] 💥 Breaking change: no; the vendored copy has no consumers in this repo. - [ ] 🕳️ Soundness fix: no checker or proof changes. - [ ] 📖 Documentation: no - [ ] 🧹 Refactor: no - [ ] ⚡ Performance: no - [x] 🔧 Build / CI / tooling ## 📌 New pins - Head SHA: **`092806946ca6e87875b032968e0cc3295977cc11`** - No changes to this repo's own workflow `uses:` refs, its `actions.lock`, lockfiles or container digests. - The nested (non-running) vendored workflows now carry upstream's SHA pins, and every `uses:` in them is a 40-hex SHA. Debtfile `vendored-mirror-unpinned-actions` falls from 42 to 40. ## How has this been verified? - **Pre-commit suite:** passed, including gitleaks, SPDX, SHA pins, actions-lock coverage, K9 ("no K9 files to check") and canonical names. The Haskell lint gate *skipped*, because neither fourmolu nor hlint is installed. - **`scripts/run-debtfile.sh`:** - `todo-fixme-markers` holds at 84; - `vendored-mirror-unpinned-actions` is paid down from 42 to 40; - `gate-scripts-without-tests` (33 > 32) and the expired `shell-scripts-missing-spdx` acceptance are red identically on `origin/main` `ebfcd98b`, measured in a detached worktree, so they are not introduced here. - **`scripts/check-lock-sync.sh` and `scripts/check-allowed-actions.sh`:** rc=0, both on this tree and on main. - **Build:** there is no local cabal, so this PR's own `Call CI Pipeline / Haskell` run is the build test. Upstream's own Haskell CI is no predictor: its last 30 runs were 25 failures, 3 cancellations and 2 startup failures. Its last run that actually built (564bcde3) failed on a module-name mismatch, which is fixed at `fa9bd386`; upstream main itself has never been built in CI. ## Checklist - [x] My commits are **signed** (`git commit -S`). - [x] I ran the project's own checks locally and they pass. The listed Debtfile reds are pre-existing on main. - [x] New files carry the correct SPDX. Every added `.hs` file carries upstream's own header, unchanged; no licence text or header was edited. - [x] Docs are updated, and no public claim now overstates what the code does. This PR changes no docs. - [x] I have not introduced a soundness hole. ## Notes for reviewers - If this PR's Haskell run is still red, the cause will be upstream package code or third-party bounds against the unpinned latest GHC. I will defer it below with an issue rather than patch sanctify-php inside standards; code fixes belong upstream. - Whether standards should vendor this package at all is a separate question. It is recorded in `dev-notes/inbox/findings.md`, not decided here. ## Deferred red checks Filled in once this PR's own run completes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_012kgrMQRhSmZMBbF9Ui1zBw Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
6 of 13 tasks
hyperpolymath
added a commit
that referenced
this pull request
Oct 6, 2026
## Summary Corrects the Haskell build step's comment, and its guard's error text, in `.github/workflows/ci-pipeline.yml`. Since #1184 both describe a detect probe that no longer exists. #1181 and #1184 merged opposite answers to #1161: - #1181 made the build step generate a `cabal.project` for every tracked package, because detect counted `*.cabal` at any depth. - #1184, merged after it, narrowed detect to a root `cabal.project` or a root `*.cabal`. It reports nested-only Haskell as **unsupported**. On 2026-10-06 the owner ruled that #1184's root-only detect stands. This PR brings the build step's text into line with that ruling. Two pieces of text were false on `main`: - **The comment.** It said the probe "counts `*.cabal` at ANY depth" and that narrowing it "would have hidden nested Haskell instead". - **The `::error::` text.** It said "detected (*.hs or stack.yaml)". Detect no longer counts either. Closes # (none. This follows up #1161, #1181 and #1184.) ## Type of change - [ ] 🐛 Bug fix: no behaviour changes. - [ ] ✨ New feature: none. - [ ] 💥 Breaking change: no. Comment and message text only. - [ ] 🕳️ Soundness fix: no checker logic changes. The text it corrects did misdescribe a gate. - [x] 📖 Documentation (in-workflow comment and error text) - [ ] 🧹 Refactor: nothing is restructured. - [ ] ⚡ Performance: not affected. - [x] 🔧 Build / CI / tooling (the file is the shared CI pipeline) ## 📌 New pins Head SHA: **`949302ecfb4568295c36e6a7dfe9317f0a821ba1`**. No pins are added or changed: no `uses:`, `actions.lock`, lockfile or digest edits. ## How has this been verified? - `git diff --stat origin/main` → 1 file, comment and `::error::` text only. The second commit (`949302ec`) takes CodeRabbit's point: a root `cabal.project` listing only nested packages also turns the job on, so the step does not always have a root package. Every changed line is a `#` comment or the quoted `::error::` string. - `ruby -e 'YAML.load_file(...)'` on the edited workflow parses with rc 0. - `bash scripts/check-lock-sync.sh` → `actions.lock is in sync`. `bash scripts/check-allowed-actions.sh` → rc 0. - I read the new text against `main`'s detect step: - L159 is `N_HASKELL=$(count 'cabal.project' ':(glob)*.cabal')`. - L232–238 probe nested Haskell as unsupported only when `N_HASKELL` is 0. - So the `else` branch runs only with a root `*.cabal`. It then lists `.` plus each nested package directory, which is what the new comment says. ## Checklist - [x] My commits are **signed** (`git commit -S`). `git log --format=%G?` → `G`. - [x] I ran the project's own checks/tests locally and they pass: lock-sync and allowed-actions. The commit-msg hook accepted the message with one length warning. - [ ] New files carry the correct `SPDX-License-Identifier`: no new files. The existing header is unchanged. - [x] Docs are updated, and no public claim now overstates what the code does. That is the whole point of this PR. - [x] I have not introduced a soundness hole: the logic is untouched. ## Deferred red checks Both reds already fail on `main` (`7d51f30f`). This PR does not touch either one: - `Registry + topology in sync`: deferred to #1161 (registry drift on main). - `Repo self-tests`: deferred to #1161. The failing suite is `build-registry-test.sh`, which reports `FAIL: repository ledger drifted`. That is the same drift. ## Notes for reviewers - On `main`, standards' own Haskell is now skipped and listed as unsupported. So the vendored sanctify-php (#1185) is not built here. - Upstream sanctify-php `main` also does not compile: `src/Sanctify/Parser.hs` line 6 is `//! verified alternatives.`. A separate one-line upstream fix PR is being opened. Re-syncing this copy afterwards is a later step. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_012kgrMQRhSmZMBbF9Ui1zBw --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
Haskelljob in the sharedci-pipeline.ymlnow builds every package thatdetectcounted, not just the repo root.detectcounts*.cabalat any depth: a git pathspec*crosses/. But the job rancabal build allonly at the root. In standards, the only Haskell package is nested atrhodium-standard-repositories/satellites/cccp/satellites/sanctify-php/. SoCall CI Pipeline / Haskellturned on, found no package at the root, and failed on every push to main. The probe and its consumer were answering different questions.Owner ruling (2026-10-06, in session): fix it if it is valuable. I took "make the consumer build what the probe counted" over "narrow the probe to the root". Narrowing would have turned main green while silently leaving nested Haskell uncompiled in this repo and in every caller.
New behaviour:
cabal.projectpresent: used as-is. This is unchanged for every repo that has one.cabal.project: the job writes an untracked one listing each directory holding a tracked*.cabal. It uses the same pathspec as the probe. A repo with only a root.cabalgetspackages: ./, which builds what it built before.*.hs/stack.yamlbut no*.cabal: a named::error::saying there is nothing cabal can build. Before, the job died with cabal's own message.Refs #1161. That issue's Haskell half; its registry-drift half is separate.
Type of change
cabal.projectand nested.cabalfiles will now compile those packages under-Wall -Werror. A new red there is real code failing, not this change.📌 New pins
49d50162cc58b479ec8bdbe55e239ed8dd5def4buses:refs added or changed, noactions.lockchange, no lockfile or container digest changes.How has this been verified?
set -euo pipefailin four throwaway git repos:packages: a/b/pkg/, rc=0;.cabal→packages: ./, rc=0;.hsonly → the named::error::, rc=1;cabal.project→ used as-is, rc=0.origin/main's file, 4 on this branch's, all at lines this PR does not touch, so none added.self-ci.ymlcalls./.github/workflows/ci-pipeline.yml, so this PR's ownCall CI Pipeline / Haskellrun exercises the change against the real nestedsanctify-phppackage. Read that check for the result; I have not run cabal locally because no cabal binary is installed here.Checklist
git commit -S).cabal.projectis an untracked CI-runtime file.cabal.projectwas used..cabalis a deliberate fixture that must not build would now see it built. The fix for that caller is a rootcabal.projectlisting what it means to build.Notes for reviewers
sanctify-phpitself fails-Wall -Werror,Call CI Pipeline / Haskellon this PR stays red. That would be an honest red about that package's code, not this workflow. In that case I'll list it under deferred checks with an issue, rather than weaken the gate.Deferred red checks
Filled in from this PR's own run.
🤖 Generated with Claude Code
https://claude.ai/code/session_012kgrMQRhSmZMBbF9Ui1zBw