Repository navigation
Fix/ci context producibility - #63
Merged
Merged
Conversation
…xt contract (#17) `main`'s rules required the *bare* status context `Hypatia Neurosymbolic Analysis`. Nothing can publish that name: a job that calls a reusable workflow publishes `<caller> / <inner job name>`, so this repository published `scan / Hypatia Neurosymbolic Analysis`, and no check run ever carried the required string. Result: green board, permanently blocked merges (issue #17). Three changes, all mechanical and independently checkable: * `.github/workflows/hypatia-scan.yml` — caller job `scan` -> `hypatia`, so the published name is the estate-canonical `hypatia / Hypatia Neurosymbolic Analysis` (standards docs/audits/audit-hypatia-pin-orphan-2026-05-27.adoc). The wrapper header records the published string so the next reader does not have to rediscover the naming rule. * `.machine_readable/CI-CONTEXTS.a2ml` — machine-readable contract: the wrapper caller ids, the exact contexts they publish, what may be armed as a required check, and the strings that can never be satisfied (`bare-hypatia`). * `tools/check-ci-contexts.sh` + `.github/workflows/ci-contexts.yml` — the guard. Offline half: every contract entry must still describe the workflow as it is (caller job id present, contexts prefixed by it) — deterministic, fails the build, no token needed. Live half: every context required by this repository's branch rulesets (and legacy branch protection when readable) is checked for producibility, advisory by default and fatal under REQUIRED_CONTEXTS_STRICT=1, following the estate's "no manufactured red noise" rule. The bare legacy name, if required, is reported with its exact replacement. `actions.lock` regenerated with the official extension (`gh actions-lock`, v0.1.6) in the same commit, as the lockfile gate requires; the diff is the single new workflow entry. Verified before pushing: `lake build` 20/20; the guard passes and fails as designed when the caller job is renamed back; `check-actions-lock-gate.sh`, `check-docs-presence.sh`, `check-allowed-actions.sh`, `check-canonical-names.sh origin/main`, `check-licence-consistency.sh`, `check-trusted-base.sh` and `check-workflow-staleness.sh` all pass.
The CI context contract job referenced , which trips the Hypatia
scanner's RE001 research extension ('job references secrets.* but does not
install step-security/harden-runner'), and surfaced as a new code-scanning alert
on this pull request.
step-security/harden-runner is not in the estate actions allowlist, so adding it
is not an option (it would fail the allowlist preflight and the repository's
selected-actions policy). Use instead: the job needs only read
access, it can read branch rulesets with that token, and the script states
plainly what it could not read (legacy branch protection needs a credential with
Administration: read, which the Actions token cannot have) rather than guessing.
Also move the new workflow to actions/checkout@v7.0.1, the pin every other
estate workflow uses, and record it in actions.lock with the official extension.
Contributor
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. ✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
hyperpolymath
enabled auto-merge (squash)
October 3, 2026 10:18
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #
Type of change
How has this been verified?
Checklist
git commit -S).SPDX-License-Identifier(code/configMPL-2.0,prose
CC-BY-SA-4.0); I did not relicense existing files.Notes for reviewers