Repository navigation
Ci/workflow contract foundation 20261018 - #1301
Conversation
…Codex #1283 follow-ups URGENT — main is startup-failing: #1283 narrowed hypatia-scan.yml to pass HYPATIA_SCAN_PAT explicitly, but the matching workflow_call declaration in hypatia-scan-reusable.yml did not land in that commit (several file edits silently failed to apply; the merge then carried the partial tree). Passing an undeclared secret is a validation error, so every hypatia-scan run on e16a231 is `startup_failure`. This adds the declaration (required: false; built-in-token fallback unchanged). Also completes the parts of #1283 that did not land, and addresses all six Codex review findings on that PR: - secret-scanner-reusable.yml + mirror-reusable.yml: caller EXAMPLES no longer show `secrets: inherit` (examples are what generators copy); Radicle comment corrected. - Packaged scorecard templates (3): grant the callee's declared calling-job set (actions: read, id-token: write added) — at the re-pinned @8ff9ce65 the old grant would startup-fail. - Packaged mirror templates (2): narrowed to the 7 named secrets (verified declared ⊇ referenced at their @210f14e7 pin); their test exemptions deleted. The 2 packaged hypatia exemptions stay: their pin predates the declaration added here. - CICD-WORKFLOW-CATALOG.md: governance example now includes the callee's declared actions: read. - tests/test_secret_scanner_no_inherit.sh: asserts (a) caller-example comment blocks contain no inherit, (b) a narrowed caller passes only secrets its callee declares (the exact guard that would have caught the hypatia break pre-merge), (c) the checkout pin is keyed in the scanner's OWN actions.lock section, not merely anywhere in the file. Mutation-checked: removing the declaration or re-adding inherit to the example both fail the test. Ref: #1108 §6b, #1283 Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
…YPATIA_SCAN_PAT - .github/workflows/actions.lock: replace self-SHA ref: values on the four remaining leaf action entries with their upstream release tags: * github/codeql-action@b96794f -> ref: 'v4.38.0' * goto-bus-stop/setup-zig@abea47f -> ref: 'v2.2.1' * Swatinem/rust-cache@6323deb -> ref: 'v2.9.2' * webfactory/ssh-agent@e838748 -> ref: 'v0.10.0' - .github/workflows/hypatia-scan-reusable.yml: declare optional workflow_call secret HYPATIA_SCAN_PAT (required: false) to match hypatia-scan.yml (#1283) and prevent startup_failure (0 jobs). - scripts/relock-sha-keys.sh: prefer symbolic (tag/branch) ref: over self-SHA ref: when deduplicating merged SHA-keyed records in Step 4, and avoid gawk-only {40} interval syntax. - scripts/close-lock.sh: resolve upstream release tags when synthesizing leaf action records for 40-hex SHA pins instead of emitting self-SHA ref: values. - scripts/lock-selfcheck.sh, .githooks/validate-actions-lock.sh, tests/test_secret_scanner_no_inherit.sh: reject self-SHA ref: values on leaf action entries and verify HYPATIA_SCAN_PAT declaration. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
… tags Combine both workflow repairs without losing the scoped secret checks. Paginate tag lookup and reject missing, malformed or failed tag responses instead of emitting invalid self-SHA leaf records. Cover failures and pagination in the offline fixture suite.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 47 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 427eb35c40
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (is_sym && !chosen_sym[p1_k]) { | ||
| chosen[p1_k] = p1_i | ||
| chosen_sym[p1_k] = 1 |
There was a problem hiding this comment.
When one repository/commit supplies both a reusable workflow and an action, the SHA-keyed record can contain the reusable workflow's required transitive uses: list while the re-keyed tag record is a leaf. Unconditionally choosing the symbolic record here drops the entire SHA-keyed body, including those nested dependencies, so relock-sha-keys.sh produces an incomplete lock that causes callers of the reusable workflow to fail runner lock validation. Keep or merge the nested uses: entries while replacing only the self-SHA ref:.
Useful? React with 👍 / 👎.
| tag_ref="" | ||
| if "$GH_BIN" api "repos/$owner/$name/tags?per_page=100" --paginate \ | ||
| --jq '.[] | select(.commit.sha == "'"$sha"'") | .name' > "$SC/tags" 2>/dev/null; then | ||
| tag_ref=$(awk '/^[A-Za-z0-9._\/-]+$/ && !(length($0) == 40 && $0 ~ /^[0-9a-f]+$/) { if (!first) first = $0; if (!preferred && $0 ~ /^v?[0-9]+\.[0-9]+\.[0-9]+/) preferred = $0 } END { if (preferred) print preferred; else if (first) print first }' "$SC/tags") |
There was a problem hiding this comment.
+ and @ characters in tag names
When the only tag pointing at the pinned commit contains SemVer build metadata such as v1.2.3+linux, or another valid name such as release@2026, this whitelist discards the tag returned by GitHub. tag_ref then remains empty, so close-lock.sh skips the dependency and exits 3 even though a usable symbolic tag was resolved, preventing the lock from being closed for actions using these valid tag names.
Useful? React with 👍 / 👎.
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
|
Add Carrot credits or activate Agent usage billing to use Autofix |
1 participant
Summary
Closes #
Type of change
How has this been verified?
Checklist
git commit -S).SPDX-License-Identifier(code/configMPL-2.0,prose
CC-BY-SA-4.0); I did not relicense existing files.Notes for reviewers