chore(ci): remove the unused signed-push action and its smoke test

[hyperpolymath]

Summary

signed-push re-pushed a workflow's commits as GitHub "Verified" through a GitHub App. That App was never created: vars.APP_ID and secrets.APP_PRIVATE_KEY have never been set on this repo, so the action has never worked here. It also has no users:

• The 2026-10-14 workflow audit (docs/reorg/2026-10-14-tidy/workflow-audit.adoc) counts 0 external consumers.
• In this repo, only its own smoke test called it.

That smoke test has failed on every run since 2026-08-24. A manual run today, run 39333160936, failed for the same reason: an empty app-id. The owner asked for it to be removed, since it isn't attached to anything in use.

Removed

• .github/actions/signed-push/ (action.yml, push-verified.sh, README.md)
• .github/workflows/signed-push-smoke.yml
• scripts/tests/signed-push-test.sh
• the smoke workflow's actions.lock entry, removed with scripts/prune-stale.sh rather than by hand

References updated

• docs/SIGNING-POLICY.adoc: the bot-commit row and the "git push from a workflow" path now name createCommitOnBranch directly, which is what the action wrapped. scripts/regen-dependabot-locks.sh is given as the example. The policy itself is unchanged.
• config/README.adoc, tag-ruleset-canon.yml and dependabot-lock-regen.yml (comment only): the smoke test is gone from the lists of APP_ID readers.

Left as they are

• Historical notes in .githooks/ comments and docs/reorg/ records.
• The ./.github/actions/signed-push string in validate-sha-pins-test.sh. It is only a placeholder name for a local action in a temporary folder and never needed the real directory.

Testing

• Lock checks: check-lock-sync, validate-actions-lock and validate-sha-pins pass. The actions-lock gate passes with gh-actions-lock v0.2.0, the version CI pins. prune-stale makes no further change, and lock-selfcheck HEAD reports the commit self-consistent.

• Other checks: check-workflow-duplicate-keys, check-standards-map and link-rot-guard pass on the edited docs. actionlint is clean on the two edited workflows. The pre-commit and commit-msg hooks pass.

• Shell suite: 86 of 89 test files pass. The other 3 fail the same way on origin/main because tools are missing locally:

  Test	Missing tool
  js-runtimes-test	deno
  science-ci-security-test	ssh-keygen
  gh-actions-lock-contract-test	the pinned gh-actions-lock binary (19/19 when supplied)

• close-lock.sh: when run offline, it reports one ref it cannot read (hyperpolymath/standards@427eb35c). A clean origin/main reports exactly the same.

Note

The smoke run today left the branch ci/signed-push-smoke-39333160936 behind, because the workflow's cleanup step only runs after a successful push. That branch points at main's head and has no commits of its own. This session cannot delete branches (HTTP 403), so it needs deleting from the Branches page.

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 010127ee-eaef-47fb-ab6f-587259c24537

📥 Commits

Reviewing files that changed from the base of the PR and between b3ce78e and 28ac2e5.

⛔ Files ignored due to path filters: 1

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing: 9

• .github/actions/signed-push/README.md
• .github/actions/signed-push/action.yml
• .github/actions/signed-push/push-verified.sh
• .github/workflows/dependabot-lock-regen.yml
• .github/workflows/signed-push-smoke.yml
• .github/workflows/tag-ruleset-canon.yml
• config/README.adoc
• docs/SIGNING-POLICY.adoc
• scripts/tests/signed-push-test.sh

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🟢 conformant · commit 28ac2e57163e · run 39341812488

Category	Status	Pass	Fail	Indeterminate	N/A	Since previous revision
DEED syntax	🟢 conformant	4	0	0	0	— no comparable baseline
K9 contract typecheck	🟢 conformant	1	0	0	0	— no comparable baseline
K9 validator self-test	🟢 conformant	37	0	0	0	— no comparable baseline
K9 positive/negative controls	🟢 conformant	27	0	0	0	— no comparable baseline
K9 live corpus (L0–L2)	🟢 conformant	12	0	0	2	— no comparable baseline

K9 live corpus (L0–L2): 2 finding(s) / scope notes

• 2-protocols/k9-coordination/examples/minimal.k9 — not_applicable: Routed to another dialect; not validated as a K9 contract.
• coordination.k9 — not_applicable: Routed to another dialect; not validated as a K9 contract.

Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[hyperpolymath]

governance / Validate Hypatia Baseline is red, and so is scan / Hypatia Neurosymbolic Analysis if it fails. Neither failure is this PR's.

The gate keeps exactly two findings:

invalid_actions_lock  .github/workflows/actions.lock
reason: {:line, 4, {:unsupported_version, "v0.0.3"}}

#1300 moved actions.lock to lockfile format v0.0.3, and the pinned Hypatia scanner only reads v0.0.2. main has failed the same way on every push since #1300; see #1304 for the evidence. This PR's lock change only removes the signed-push-smoke.yml entry, and the line 4 version header stays as it was. With the gh-actions-lock version CI pins (v0.2.0), the lock verifies: "Immutable direct and transitive lockfile coverage verified".

No fix exists yet. apply-baseline-test.sh forbids an invalid_actions_lock ack, so this can't be baselined. The cure is a Hypatia scanner pin that reads v0.0.3, which is upstream work in hyperpolymath/hypatia. The scanner is pinned and the failure is deterministic, so I'm not re-running the check. Neither Hypatia check is required, which is why #1304 merged with the same two reds.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T00:14:53.279274Z	28ac2e5	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.