Repository navigation
feat(ci): list repos whose workflows run their own gh-actions-lock - #1251
Merged
Merged
Conversation
A sweep copied a "Verify immutable action lockfile" step into repos' workflow-linter.yml. The step downloads gh-actions-lock v0.1.6 and runs it raw beside governance's lockfile gate. v0.1.6 cannot read lockfile v0.0.3, so the step went red whenever a current tool refreshed the lock (proof-burrower#111/#112). Owner decision 2026-10-14: drop the step from copied linters (pilot: proof-burrower#113, echidna#437, echidnabot#181), and let the estate wave clear the rest. scripts/check-copied-lock-step.sh lists every workflow that installs or downloads gh-actions-lock itself, with the version it pins. It reports and never edits; standards is skipped because its installs are the estate pin. lockfile-drift-detect.yml runs it over the clones it already makes. It adds a copied-lock-step.tsv artifact, a summary section and an issue-table row; the workflow has no new `uses:`. Tests: 8/8 in scripts/tests/check-copied-lock-step-test.sh. They cover: - the raw download; - gh extension install, pinned and unpinned; - a KYAML run scalar; - comment-only mentions; - the standards skip; - usage errors. The "comments counted" and "standards not skipped" mutants each fail it. Run on the three pilot repos, it flags main (v0.1.6) and passes the fixed branches. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 41 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/38546909913 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
|
hyperpolymath
marked this pull request as ready for review
October 14, 2026 10:11
hyperpolymath
added a commit
that referenced
this pull request
Oct 14, 2026
…-binary contract test (#1250) ## Why gh-actions-lock v0.1.6 refuses to read a lockfile v0.0.3: ``` lockfile version v0.0.3 is newer than this binary supports (v0.0.2); upgrade the tool that reads this lockfile ``` Every current `gh actions-lock` writes v0.0.3, so a lock refreshed with an upgraded extension fails every v0.1.6 reader: - governance's **Actions lockfile verify** at this tree's HEAD; - the scorecard reconciler; - the lock regen; - the copied `workflow-linter.yml` in each repo. That is what turned proof-burrower#111/#112 red. rsr-template-repo's lock is already v0.0.3. Owner decision (selector, 2026-10-14): **move the estate to v0.2.0**. ## What 1. All four `gh extension install github/gh-actions-lock --pin` sites move from v0.1.6 to v0.2.0: governance-reusable, scorecard-reusable ×2, and dependabot-lock-regen. 2. `scripts/update-actions-lock.sh` (the one lock verifier) narrowly accepts the two new v0.2.0 finding classes. v0.1.6 never reported them, and both contradict measured behaviour: - **`not-pinned` with no dependency** ("workflow has no lockfile entry"). Accepted only when every `uses:` in the workflow is `./…` or `$/…`, or there is none. GitHub runs these workflows without an entry: lock-sync-gate (only `run:` steps), and scorecard, secret-scanner and self-ci (only `./` reusable calls), all green on main. - **`local-action`** ("local path actions are not supported, rewrite to `$/…`"). Accepted only when every `./` action the workflow uses exists in the checkout. The estate measured the reverse: `check-lock-sync.sh` fails the `$/` rewrite as invalid. - Still blocking: an unlisted workflow with a remote action, a `not-pinned` dependency, a missing `./` action, and every other category. 3. New `scripts/tests/gh-actions-lock-contract-test.sh` runs the **real** binary, offline. It checks: - one pin version everywhere, and that the binary is that version; - v0.0.2 and v0.0.3 both verify, and the lock is left byte-identical; - a too-new lockfile is refused loudly; - the JSON shape and the categories the verifier and `reconcile-scorecard-actions-lock.rb` key on; - the verifier, end to end, accepts the three false-positive classes and rejects the four blocking cases. 4. `self-test.yml` installs the pinned release (HTTPS-only redirects, SHA-256 checked) so the contract runs on every PR. ## Evidence | Check | Result | |---|---| | Contract test on v0.2.0 | **19/19** | | Negative control: v0.1.6 | fails 8, every v0.0.3- or v0.2.0-specific check | | Mutant: no dependency check | caught | | Mutant: no nothing-to-pin check | caught | | Mutant: no `./` existence check | caught | | Mutant: one pin left at v0.1.6 | caught | | No binary | exit 2 | | `update-actions-lock-test.sh` (fake gh) | 5 new cases pass | | gate, regen, complete-job-refs tests | pass | Verdicts of `update-actions-lock.sh --verify-local`: | Tree | v0.1.6 | v0.2.0 | |---|---|---| | echidna main | 0 | 0 | | echidnabot main | 0 | 0 | | standards main | 0 | 0 | | proof-burrower main (real #110 drift) | 1 | 1 | | proof-burrower#112 (lock v0.0.3) | **2** (cannot read) | 0 | | rsr-template-repo main (lock v0.0.3) | **2** (cannot read) | 0 | **Correction to the first version of this PR.** I first reported "identical verdicts on four repos" from exit codes alone. That hid the two new categories on standards, which made this PR's first self-lint red. Item 2 fixes that, and the table above now compares the categories as well as the exit codes. ## Notes - Pre-existing, not from this PR: - `check-lock-sync-test.sh` and `check-actions-lock-gate-test.sh` fail in an environment whose `awk` is mawk, or whose `yq` is the Python wrapper; they pass with mikefarah yq. - actionlint v1.7.7 doesn't know `job.workflow_sha`. - The remaining SonarCloud annotations are style smells (`[[` vs `[`, explicit `return`) matching the surrounding scripts. The security finding (unrestricted `curl -L` redirects) is fixed. - For S7 (KYAML workflows): under `--verify-local`, v0.1.6 and v0.2.0 gave identical findings on a KYAML fixture. YAML-POLICY.adoc's "v0.1.6 cannot see a `uses:` inside a KYAML workflow" needs a fix-mode measurement before it changes. Status: TESTED (real binary, offline). Companions: - the copied linter step is dropped in proof-burrower#113, echidna#437 and echidnabot#181; - #1251 (merged) lists the remaining repos for the estate wave. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A sweep copied a "Verify immutable action lockfile" step into repos'
workflow-linter.yml. The step downloads gh-actions-lock v0.1.6 and runs it raw, beside governance's lockfile gate. v0.1.6 cannot read lockfile v0.0.3, so the step goes red whenever a current tool refreshes a repo's lock. That is what failed "Workflow Security Linter / lint-workflows" on proof-burrower#111/#112.The step didn't come from rsr-template-repo; that template's linter never had it. So fixing the template wouldn't reach the repos that carry it, and the estate needs a list of them.
Owner decisions 2026-10-14 (selector):
What
scripts/check-copied-lock-step.sh REPO_DIR [SLUG]lists every workflow that downloads or installs gh-actions-lock itself, with the version it pins. Output is TSV:repo workflow pins.gh-actions-lock-contract-test.sh(fix(ci): move the estate's gh-actions-lock pin to v0.2.0, with a real-binary contract test #1250) holds to one version.lockfile-drift-detect.yml(weekly, report-only) runs the detector over the clones it already makes. It adds acopied-lock-step.tsvartifact, a step-summary section and a row in the tracking issue's table. There's no newuses:, soactions.lockis unchanged.Evidence
scripts/tests/check-copied-lock-step-test.sh: 8/8. Cases:gh extension install, pinned and unpinned, one row per workflow;run:scalar;mainof proof-burrower, echidna and echidnabot (v0.1.6), and finds nothing on their fixed branches.run:passesbash -n.Status: TESTED locally. It hasn't run live yet; the first scheduled or dispatched sweep after merge produces the wave's list.
🤖 Generated with Claude Code
https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
Generated by Claude Code