Repository navigation
feat(lock): check-only closure mode for actions.lock (#963) - #1318
Merged
Merged
Conversation
Owner decision on #963 criterion 5: Hypatia stays the authority for actions.lock closure. A deterministic local check guards the same property before push, and a shared corpus of test lockfiles binds the two implementations. scripts/close-lock.sh --check [DIR | LOCKFILE] Reports the dangling edges the repair passes would close, and nothing else: no gh call, no write. An edge dangles when a ref under workflows: or in a record's nested uses: has no top-level record of its own. Owner/repo compare case-insensitively and refs exactly, the same normalisation as GitHub's parser, #1294/#1314, and Hypatia's ActionsLock.normalise_ref/1. Exit 0 closed, 1 dangling, 2 no lock. scripts/lock-selfcheck.sh A dangling edge is a third POISON verdict, after unkeyed refs and self-SHA refs. It runs in the existing "Lockfile self-consistency" job, so no required check name changes. Only that job calls the script. .githooks/pre-commit When actions.lock is staged, the staged content is checked. Like the canonical-names guard, this runs only where the repository carries scripts/close-lock.sh. scripts/tests/fixtures/actions-lock-closure/ Five locks and expected.tsv: closed v0.0.2, closed v0.0.3 with hostname, closed case-variant, the #963 nested shape, and a dangling workflows: ref. Hypatia at aa34a4cc agrees on all five: ok, ok, ok, transitive_dependencies_missing, workflow_dependencies_missing. hyperpolymath/hypatia vendors a byte-identical copy for its own test. Tests close-lock-test: 34/34, 8 of them new. Each corpus row is checked by exit code and exact dangling list, the lock bytes must be unchanged, gh must not be called, and a missing lock exits 2. Two mutants each fail exactly one row: no case folding fails the case variant, and ignoring workflows: refs fails the dangling workflow ref. lock-selfcheck-test: 9/9, 2 of them new. Its base fixture lock had no dependencies: section, so it was not closed (Hypatia rejects that shape as workflow_dependencies_missing). It now carries the record. A mutant without the closure verdict fails both new cases. With gawk installed, these pass unchanged: regen-dependabot-locks 59, complete-job-refs 20, relock-sha-keys 12, prune-stale 18, check-lock-sync 13, validate-actions-lock 7. The hook blocks a staged lock with the #963 shape and names the ref. main's own lock is closed, and lock-selfcheck on HEAD is SELF-CONSISTENT. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TbbnKqskQA5mj5gfMniPzi
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 49 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
marked this pull request as ready for review
October 20, 2026 12:38
hyperpolymath
enabled auto-merge (squash)
October 20, 2026 12:38
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
SonarCloud reported 13 new issues on #1318. Its issue list is not reachable from here, but every test the PR adds uses [ ], which is the finding #1291 and #1305 cleared the same way. All twelve such lines are now [[ ]]. Lines this PR does not touch keep their [ ]. close-lock-test 34/34, lock-selfcheck-test 9/9. --check still exits 0, 1 and 2 for a closed lock, a dangling one and a missing one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TbbnKqskQA5mj5gfMniPzi
|
Contributor
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements the recommendation for #963 criterion 5, as the owner decided:
actions.lockclosure.What changes
scripts/close-lock.sh --check [DIR | LOCKFILE]ghcall, no write.workflows:or in a record's nesteduses:has no top-level record of its own.ActionsLock.normalise_ref/1.scripts/lock-selfcheck.sh.githooks/pre-commitactions.lockis staged, the hook checks the staged content.scripts/close-lock.sh.scripts/tests/fixtures/actions-lock-closure/: five locks plusexpected.tsv:hostnameworkflows:refHypatia at
aa34a4ccagrees on all five. hyperpolymath/hypatia#941 vendors a byte-identical copy and testsActionsLock.parse/1against the same table. If either side drifts, one of the two suites goes red.Tests
close-lock-test: 34/34, 8 of them new.ghmust not be called, and a missing lock exits 2.workflows:refs.lock-selfcheck-test: 9/9, 2 of them new.dependencies:section, so it was not closed (Hypatia rejects that shape). It now carries the record.apply-baseline-test52/52,exemption-ratchet-test14/14,hypatia-blocking-gate-test46/46.lock-selfcheck.sh HEADreports SELF-CONSISTENT.No licence headers are touched. The new fixture files carry MPL-2.0 SPDX from birth.
Refs #963 · companion: hyperpolymath/hypatia#941
Generated by Claude Code