Repository navigation
fix(ci): re-pin mirror and ci-pipeline off a commit that left main's reach - #1317
Merged
Merged
Conversation
…reach mirror.yml and ci-pipeline.yml called standards reusables at 427eb35. That commit is on #1301's branch only: #1301 merged as a squash with an empty diff and its branch was deleted at 2026-10-19T17:14:40Z. From the next push GitHub refused both callers at startup (failure, 0 jobs, run name == path): Mirror to Git Forges and Self CI on every main push since cd477f2, whose tree is identical to 333b06a, where Mirror still ran. Re-pin all three calls to d55304a (on main, lock-selfcheck SELF-CONSISTENT) and relock with relock-standards-pin.sh. The reusables' inputs and secrets are unchanged between the two commits. relock-standards-pin.sh refused this relock: its stale-pin and entry-match scans read every line, so commented caller examples (`# uses: …@571cc73`) in three reusables counted as pins. Both scans now read `uses:` lines only, through one helper. New test case; it fails without the fix. The older per-forge job failures (host verify, push) are WO-2's and are untouched here. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N6my4F3ohjwFReLW8cYYqC
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Summary
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly identifies the main change: re-pinning the mirror and CI workflows away from an unreachable commit. |
| Docstring Coverage | |
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (2 skipped: 2 … |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
| Description check | |
The pull request description directly explains the workflow pin updates, the relocking script change, the regression test, and the verification results. It matches the changeset and objectives. |
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (2 skipped: 2 unsupported.)
✨ Finishing Touches
-
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Contributor
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
hyperpolymath
marked this pull request as ready for review
October 20, 2026 12:32
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
hyperpolymath
enabled auto-merge (squash)
October 20, 2026 12:37
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 38e4d91a85
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…pin scan
The previous commit anchored the pin scan at `^\s*-?\s*uses:` to stop
counting commented caller examples. That also dropped one-line flow
(KYAML) calls such as `build: { uses: "hyperpolymath/standards/…@<sha>" }`,
which the old unanchored scan found: a relock of such a caller would
refuse with no full target pin. Skip full-line comments instead, and take
the pin wherever a `uses:` key holds it, block or flow style. New test
case; it fails on the anchored scan. (Codex review on #1317.)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N6my4F3ohjwFReLW8cYYqC
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b3862040a6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
hyperpolymath
pushed a commit
that referenced
this pull request
Oct 20, 2026
…ent lines Root-cause fix for two Codex findings on #1317. Each narrowing of the pin scan (`^\s*uses:`, then `uses:` after `{`, `,` or space) dropped a YAML form main's unanchored scan found: first one-line flow calls, then quoted keys (`"uses": …@<sha>`). The only line that needed excluding was a full-line comment, so standards_pins is now main's match with those lines removed, and nothing else changed. New test case for a quoted key; each earlier version fails the case it missed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N6my4F3ohjwFReLW8cYYqC
6 of 7 tasks
hyperpolymath
added a commit
that referenced
this pull request
Oct 20, 2026
…ent lines (#1319) ## Summary This follows up #1317, which merged at `b3862040` before this fix was pushed. It answers Codex's second finding on #1317 (quoted `uses` keys). #1317 changed `standards_pins` so that commented caller examples no longer count as pins. Each version it shipped matched pins more narrowly than main's original scan, and each one dropped a YAML form the original found: - `^\s*uses:` dropped one-line flow calls, `build: { uses: "…@<sha>" }`; - `uses:` after `{`, `,` or a space (what merged) drops quoted keys, `"uses": …@<sha>`. `apply-workflow-pins-remote.sh` still rewrites the SHA in such a call, but the relock then refuses with "no workflow pins". The only line that needed excluding was a full-line comment. `standards_pins` is now main's original match with those lines removed, and nothing else changed: ```sh standards_pins() { grep -hvE '^[[:space:]]*#' "$@" 2>/dev/null | grep -oE "$PIN_RE"; } ``` ## Type of change - [x] 🐛 Bug fix (non-breaking change that fixes an issue) - [x] 🔧 Build / CI / tooling ## How has this been verified? `bash scripts/tests/relock-standards-pin-test.sh` → `PASS`, with one new case: "a quoted uses key is counted as a pin". I ran the suite against the script at each earlier version. Each fails exactly the case it missed: | Script at | Result | |---|---| | main before #1317 | FAIL: commented caller example | | `38e4d91a` | FAIL: flow-style call | | `b3862040` (merged) | FAIL: quoted `uses` key | | this PR | PASS | On this repo, `relock-standards-pin.sh --to d55304a` reports "already keyed" and `check-lock-sync.sh` reports in sync. `shellcheck -S warning` on the script is clean. ## Checklist - [ ] My commits are **signed**. The session's managed signing is inactive (see CLAUDE.md). - [x] I ran the project's own checks/tests locally and they pass. - [x] No new files; no SPDX or licence change. - [x] Docs: no public claim changes. - [x] No soundness hole introduced. The scan matches what main's did, except full-line comments. ## Notes for reviewers A `run:` body or a trailing comment that quotes a pin still counts, as it always has. Excluding those would need a YAML parser. This script greps everywhere else, so I kept it to the one exclusion that was actually breaking relocks. Separately, #1317 works on main: Mirror run 1169 on `0d47b892` started under its real name and resolved `mirror-reusable.yml@d55304a`. --- _Generated by [Claude Code](https://claude.ai/code/session_01N6my4F3ohjwFReLW8cYYqC)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Since 2026-10-19 17:14 UTC, Mirror to Git Forges and Self CI have failed on every push to main with zero jobs. The run is named after the file path, which is how GitHub labels a workflow it would not start.
Cause. Both callers use standards reusables pinned at
427eb35c. That commit was never on main:ci/workflow-contract-foundation-20261018).cd477f24has the same tree as its parent333b06a0.427eb35cis now reachable only throughrefs/pull/1301/head.The first run after the merge failed at startup:
333b06a0cd477f24(same tree, same pin, same lock record)So the repo's files didn't change. Only whether GitHub could reach
427eb35cdid.Fix.
d55304a0, which is on main.lock-selfcheck.shreports it SELF-CONSISTENT. The calls aremirror.yml→mirror-reusable.yml, plussecret-scanner-reusable.ymlandrust-ci-reusable.ymlfromci-pipeline.yml.relock-standards-pin.sh. The reusables' inputs and secrets are unchanged between the two commits. Their internal changes arepersist-credentials: falseon the mirror checkouts, a newerdtolnay/rust-toolchainSHA, and the secret scanner's.gitleaks.tomlgating.Tool fix needed on the way.
relock-standards-pin.shrefused this relock. Its stale-pin scan and its per-workflow entry check read every line of a workflow, so commented caller examples counted as live pins. Example:# uses: …rust-ci-reusable.yml@571cc734inchangelog-reusable.yml,elixir-ci-reusable.ymlandrust-ci-reusable.yml. Both checks now go through onestandards_pinshelper. It skips full-line comments and takes the pin wherever auses:key holds it, in block or flow (KYAML) style. Flow style was added in b386204 after the Codex review: the first version's^\s*uses:anchor dropped one-line flow calls.Type of change
How has this been verified?
bash scripts/tests/relock-standards-pin-test.sh→PASS. Two new cases:relock-standards-pin.sh --to d55304a0 .github/workflows→ keyed tod55304a0from427eb35c. It removed one record that only427eb35cused,dtolnay/rust-toolchain@e2a55d2. Re-run after b386204, it reports "already keyed".check-lock-sync.sh .github/workflows→ in sync..githooks/validate-actions-lock.sh→ passes.check-workflow-duplicate-keys.sh→ 60 files clean.prune-stale.sh→ no further change.tests/test_governance_reusable_shape.sh→ 14 passed, 0 failed.lock-selfcheck.shon427eb35cand ond55304a0→ both SELF-CONSISTENT. This needs the Goyq; with the Pythonyqthe script reports UNEXAMINED.shellcheck -S warning→ the script is clean. The test file has one warning, SC2034 onNEW2, which was already there: the variable is used inside anevalstring.Call CI Pipeline / …jobs ran. That is the Self CI fix working: it starts again, through both re-pinned reusables. Mirror runs only on pushes to main, so the merge itself is its proof.actionlint, which isn't installed in this container.Checklist
Notes for reviewers
docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adoc. Once this lands, Mirror will start again and should go back to those per-forge reds, not to green.lock-selfcheck.shdoesn't check that a pinned SHA is reachable from main. A pin to a PR-branch commit passes every local gate and then breaks once the branch is deleted. Any estate repo pinned at427eb35cwill fail the same way.🤖 Generated with Claude Code
https://claude.ai/code/session_01N6my4F3ohjwFReLW8cYYqC