fix(js-runtimes): make the crate its own workspace root by hyperpolymath · Pull Request #1299 · hyperpolymath/standards

hyperpolymath · 2026-10-19T12:26:11Z

Why

governance-reusable.yml and js-runtimes-reusable.yml check tools/js-runtimes out at .standards-js/ inside the caller's checkout, then run cargo install --locked --path on it. When the caller's root Cargo.toml is a workspace, cargo walks up from the staged crate, finds that workspace, and refuses:

error: current package believes it's in a workspace when it's not:
current:   /home/runner/work/hypatia/hypatia/.standards-js/tools/js-runtimes/Cargo.toml
workspace: /home/runner/work/hypatia/hypatia/Cargo.toml

So governance / JS runtimes — environment provisions Bun first fails on every Rust-workspace consumer pinned at 75bd599. hyperpolymath/hypatia#929 hit it first. Callers without a root workspace pass, for example hyperpolymath/palimpsest-license#187.

What

tools/js-runtimes/Cargo.toml gains an empty [workspace] table, with a comment saying why. That makes the crate its own workspace root wherever it is staged.

Standards has no root Cargo.toml, so nothing changes in this repository: Cargo.lock is untouched.

Verified

In a probe repository with a root workspace and the crate staged at .standards-js/tools/js-runtimes:
- cargo metadata: exit 101 with the current manifest, 0 with this one;
- the job's own cargo install --quiet --locked --path …: builds.
In standards: cargo test --locked --manifest-path tools/js-runtimes/Cargo.toml passes (8 tests).

hypatia#929 carries a consumer-side exclude = [".standards-js"] so it can go green before this lands. That exclude is harmless afterwards. Other Rust-workspace repos need this fix before the estate-wide repin.

Generated by Claude Code

The governance and js-runtimes reusables check tools/js-runtimes out at .standards-js/ inside the caller's checkout, then run `cargo install --locked --path` on it. When the caller's root Cargo.toml is a workspace, cargo walks up from the staged crate, finds that workspace, and refuses: error: current package believes it's in a workspace when it's not So "JS runtimes — environment provisions Bun first" fails on any Rust-workspace consumer pinned at 75bd599; hyperpolymath/hypatia#929 hit it first. Callers without a root workspace, such as palimpsest-license, pass. An empty [workspace] table makes the crate its own root wherever it is staged. Standards has no root workspace, so nothing changes here: the lockfile is untouched, and `cargo test --locked` still passes (8 tests). Checked in a probe repository with a root workspace and the crate staged at .standards-js/tools/js-runtimes: `cargo metadata` fails (101) with the current manifest and passes with this one, and the job's `cargo install --locked` now builds. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LET2eHeDbN3b4WuxYjMUX9

coderabbitai · 2026-10-19T12:26:25Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 30 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: f39e4f75-bfbb-41fb-b7eb-92796310edce

📥 Commits

Reviewing files that changed from the base of the PR and between 75bd599 and 4a6e59f.

📒 Files selected for processing: 1

tools/js-runtimes/Cargo.toml

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-19T12:26:45Z

🟢 conformant · commit a805e66b5bb5 · run 39274479842

Category	Status	Pass	N/A	Since previous revision
DEED syntax	🟢 conformant	4	0	↔ unchanged
K9 contract typecheck	🟢 conformant	1	0	↔ unchanged
K9 validator self-test	🟢 conformant	34	0	↔ unchanged
K9 positive/negative controls	🟢 conformant	27	0	↔ unchanged
K9 live corpus (L0–L2)	🟢 conformant	12	2	↔ unchanged

K9 live corpus (L0–L2): 2 finding(s) / scope notes

2-protocols/k9-coordination/examples/minimal.k9 — not_applicable: Routed to another dialect; not validated as a K9 contract.
coordination.k9 — not_applicable: Routed to another dialect; not validated as a K9 contract.

Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run.

chatgpt-codex-connector · 2026-10-19T12:33:33Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T15:04:53.071496Z	`a805e66`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

sonarqubecloud · 2026-10-19T15:03:36Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

coderabbitai · 2026-10-19T15:06:08Z

Add Carrot credits or activate Agent usage billing to use Autofix

…one entry The two CI-fix commits each added the same `.standards-js/tools/js-runtimes` line with its own comment. One entry, with a note on why it exists and when it can go (the governance pin reaching hyperpolymath/standards#1299, which makes that crate its own workspace root). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3

#440 carries the same exclude (its CI-fix commit 78a70c2) and merges first; byte-identical text here means the two land without a conflict. It can go once the governance pin reaches hyperpolymath/standards#1299, which makes that crate its own workspace root. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3

…#929) ## Why GitHub started enforcing `actions.lock` when each job is set up (around 2026-10-15). Since then, every job in a workflow that calls a standards reusable has died at `Set up job` with `invalid lockfile pin`. That covers Governance, Hypatia Security Scan and Secret Scanner. GitHub checks a reusable workflow's actions against the **callee's** `actions.lock` at the called SHA. Standards' lock at the commits this repo pinned (`da2c748`, `571cc73`, `2479cf7`) gives leaf actions their own SHA as `ref:`, which the runner rejects; `lock-selfcheck` rates all three POISON. ## What 1. **Repin (e68277c).** All five standards callers now pin **`75bd599`**, standards `main`. It is green, and `lock-selfcheck` rates it SELF-CONSISTENT. The interfaces are compatible, and `actions.lock` needs no change. 2. **Placeholder UUIDs in the Bitbucket mock (366009f).** The strict `UUID v8/v7 conformance` jobs now run. They flagged four invented UUIDs in an unused fixture, which now get a version nibble of 8 and a variant nibble from 8 to b. 3. **`.gitleaksignore` (abbe382).** 75bd599 adds a gating full-history gitleaks pass. Its five historical false positives sit in files f2fe2df deleted: a k8s Secret *template*'s `CHANGE_ME_IN_PRODUCTION` placeholders, and a Prometheus recording-rule name. They are ignored by exact `commit:file:rule:line` fingerprint only. 4. **Merges #928 (114d015, unchanged).** It makes `ActionsLock` accept this repo's own v0.0.3 lock, which turns E2E/Integration green. The two PRs merge in either order. 5. **Explicit secrets (6162439).** `secrets: inherit` is replaced with exactly what each callee declares: `HYPATIA_SCAN_PAT` for hypatia-scan, the seven forge keys for mirror, and nothing for scorecard and secret-scanner (standards#1108 §6b). This clears four WH008 baseline findings. 6. **Cargo workspace exclude (c19c465).** The governance JS-runtimes job stages standards' crate at `.standards-js/`, and this repo's root workspace made cargo refuse to build it. The root fix is hyperpolymath/standards#1299; this exclude is harmless after it lands. ## Verified - Governance lock gate at `75bd599` (gh-actions-lock v0.2.0): exit 0. - `check-uuid-v8.sh --strict .`: exit 0. - Gitleaks 8.18.4 (the pinned binary) with the 75bd599 baseline: history pass 5 leaks, then 0; tree pass clean. A planted secret at the same path and line is still caught. - With the crate staged as CI does, `cargo metadata` fails before c19c465 and passes after. The job's `cargo install --locked` builds, and `js-runtimes provision .` exits 0. - **Same repin as hyperpolymath/palimpsest-license#187**, which passes all its checks. ## Open - **`Validate Hypatia Baseline` needs an owner decision.** The scanner pin moved from `0e91342` to `51ab649`, which surfaces 36 findings the baseline never covered: 2 `invalid_actions_lock` (cleared by the pending standards `hypatia-ref` bump past #928), and 34 from newer rules (WH013, RE001, RE004/5, `hardcoded_tmp`, `eval_in_shell`). Details and options are in the PR comments. - **Already red on `main`:** - `abi-codegen-drift`: stale Idris2 cache key; - `Rust License & Ban Check`: `deny.toml` schema; - `Rust Dependency Audit`: RustSec advisories; - Mirror: Bitbucket access. Proposed fixes for each are in the PR comments. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01LET2eHeDbN3b4WuxYjMUX9 --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: CodeRabbit <noreply@coderabbit.ai>

hyperpolymath mentioned this pull request Oct 19, 2026

ci: repin standards callers to 75bd599, whose own lock GitHub accepts hyperpolymath/hypatia#929

Merged

hyperpolymath marked this pull request as ready for review October 19, 2026 12:33

Merge branch 'main' into claude/js-runtimes-own-workspace

a805e66

hyperpolymath enabled auto-merge (squash) October 19, 2026 15:03

hyperpolymath merged commit 1fed802 into main Oct 19, 2026
65 of 67 checks passed

hyperpolymath deleted the claude/js-runtimes-own-workspace branch October 19, 2026 15:04

hyperpolymath mentioned this pull request Oct 19, 2026

chore(ci): remove the one-off lock-regeneration workflow merged by #441 hyperpolymath/echidna#442

Merged

8 of 9 tasks

hyperpolymath mentioned this pull request Oct 19, 2026

fix(rest): serve API docs with ReDoc so zip leaves the tree hyperpolymath/echidna#440

Merged

11 tasks done

Navigation Menu

Repository navigation

fix(js-runtimes): make the crate its own workspace root - #1299

fix(js-runtimes): make the crate its own workspace root#1299
hyperpolymath merged 2 commits into
mainfrom
claude/js-runtimes-own-workspace

hyperpolymath commented Oct 19, 2026

Uh oh!

coderabbitai Bot commented Oct 19, 2026 •

edited by hyperpolymath

Loading

Review limit reached

Uh oh!

github-actions Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Oct 19, 2026

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

hyperpolymath commented Oct 19, 2026

Why

What

Verified

Uh oh!

coderabbitai Bot commented Oct 19, 2026 • edited by hyperpolymath Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

github-actions Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

sonarqubecloud Bot commented Oct 19, 2026

Quality Gate passed

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Oct 19, 2026 •

edited by hyperpolymath

Loading

github-actions Bot commented Oct 19, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading