Point the three sites naming #81's code-scanning half at the leg that is it by iderex · Pull Request #405 · Flowfin/core

iderex · 2026-09-17T16:51:39Z

The issue this belongs to

Closes #404

What changed

Three sentences that described the semantic analysis over the core's own language
as something still waiting to be built now name the leg that does it. In
.github/workflows/shell-analysis.yml and .github/workflows/zizmor.yml the
sentence bounding what each leg reads now points at
.github/workflows/codeql.yml; in the shellcheck row of docs/gate-parity.md
the closing sentence says the core's own language has its own row in the same
table, which it does. Each of the three carries, beside the correction, what it
used to claim and how that was found.

Nothing else moves. No setting, permission, trigger or step of either workflow is
touched, no verdict or other cell of the parity table is touched, and no file
outside the three is opened.

What failure it prevents

A reader of any of the three was told that this repository runs no semantic
analysis over its own code. That is the direction that makes the gate look
thinner than it is, and two of the three sites are workflow files a contributor
opens to find out what the gate covers.

This is a correction, and the failure has already happened rather than being one
that could. What was wrong: the three sentences said the analysis was the other
half of #81, that it waited on #11, and that this tree held no code and had chosen
no language. All four claims were true on 2026-08-22, the day the three sentences
were written, and none of them is now.

How it was found: by reading the sentence in each file against the directory the
file sits in. .github/workflows/codeql.yml is that analysis, it names both
workflow files in its own header, and it has been three files away from two of the
three sites since the day it landed.

Evidence

Read at the commit being pushed, 0a619e0, and against origin/main
58453f4ae4b94f99c44cc6dc0de209b8909c9fa6, which is the base.

The three sentences as they stood.

git show 58453f4a:./.github/workflows/shell-analysis.yml | sed -n '25,27p'
# This covers the shell and nothing else. The analysis over the core's own language
# is the other half of #81 and waits on #11, because there is no code in this tree
# and no language chosen.
git show 58453f4a:./.github/workflows/zizmor.yml | sed -n '14,16p'
# being readable only in a job log. What #81 still holds is the analysis over the
# core's own language, which waits on #11 because no code is in this tree. How many
# shell scripts there are moves whenever one lands, so it is not counted here.
git show 58453f4a:docs/gate-parity.md | grep -c 'the half of #81 that waits on #11'
1

Each of the four claims, against what holds it.

gh api repos/Flowfin/core/issues/11 --jq '"#11 \(.state) \(.state_reason) closed \(.closed_at)"'
#11 closed completed closed 2026-08-25T03:52:59Z
gh api repos/Flowfin/core/issues/81 --jq '"#81 \(.state) \(.state_reason) closed \(.closed_at)"'
#81 closed completed closed 2026-08-31T19:26:41Z
git ls-tree -r --name-only 58453f4a src/ | wc -l
46
git ls-tree -r --name-only 58453f4a src/ | xargs -I{} git show "58453f4a:{}" | wc -l
30796
git log --format='%h %ad %s' --date=short --diff-filter=A 58453f4a -- .github/workflows/codeql.yml
635e322 2026-08-26 Analyse the core's own language, and fail the run on a finding (#81) (#195)

The leg says of itself that it is the half these three call absent.

git show 58453f4a:./.github/workflows/codeql.yml | sed -n '4,9p'
# THIS IS THE HALF OF #81 THAT WAITED ON A LANGUAGE. The shell this gate is
# written in is read by .github/workflows/shell-analysis.yml, the workflow files
# are read by .github/workflows/zizmor.yml, and until
# docs/decisions/0011-the-language-the-toolchain-and-the-binding-layer.md landed
# there was no third body of code to point an analyser at. There is now, in
# `src/`, and this is the leg that reads it.

They were right when they landed, and nothing opened them afterwards.

git log -S'there is no code in this tree' --format='%h %ad %s' --date=short 58453f4a -- .github/workflows/shell-analysis.yml
6587b1e 2026-08-22 Analyse the shell this gate is written in
git log -S'no code is in this tree' --format='%h %ad %s' --date=short 58453f4a -- .github/workflows/zizmor.yml
65216a1 2026-08-22 Name the leg that reads the shell, in the audit that says nothing does
git log -S'the half of #81 that waits on #11' --format='%h %ad %s' --date=short 58453f4a -- docs/gate-parity.md
6587b1e 2026-08-22 Analyse the shell this gate is written in
git log -1 --format='%h %ad %s' --date=short 58453f4a -- .github/workflows/shell-analysis.yml
ed5f6b4 2026-09-16 Bump the github-actions group across 1 directory with 4 updates

Not one of the four claims survives at the head being pushed.

git grep -c 'no code is in this tree\|there is no code in this tree\|waits on #11' HEAD -- .github/workflows/ docs/gate-parity.md ; echo "exit=$?"
exit=1

The paths this change touches.

git diff --name-only origin/main...HEAD
.github/workflows/shell-analysis.yml
.github/workflows/zizmor.yml
docs/gate-parity.md

The one check I can run against this tree on this machine, which reads the
documents this change edits.

bash .github/doc-paths/doc-paths.sh check | grep -A1 'names-a-path-that-resolves'
-- names-a-path-that-resolves
ok    78 document(s), 379 named path(s) resolved, 0 excused as examples

That output is from the run at this head. The script proves its own fixtures
before it judges anything, and prints them above the block quoted here.

The means. The change is prose in two YAML comments and one Markdown table
cell, in the formats those files already are. It adds no language, no runtime and
no dependency, and nothing here needs a means the tree does not already carry.

What this does not cover

The six sentences in docs/decisions/ that also say there is no code in this
tree. They are prose in landed records, and whether such a sentence going
false because the tree moved is inside 0269's subject is the decision 0001 says no check reads a decision record and pastes five workflow files, and a check over docs/decisions/ has run since 2026-09-02 #380 is
waiting on. I read none of them here and moved none of them.
Any other verdict, row or cell of docs/gate-parity.md. The eight waiting
rows are Eight parity rows wait on a register that closed with every entry answered #377. The shellcheck row keeps satisfied, and this change does not
re-derive that verdict.
Any other claim either workflow file makes. I read the sentences naming Add code scanning over this repository's own language #81
and Record the language and toolchain, with the costs the choice carries #11 in these three files. That is a sweep of one claim rather than of the
files, and a second stale sentence in either of them would not have been found
by it.
Anything a run does. No setting, permission, trigger, job or step changes,
so no leg of this gate behaves differently because of this change. Nothing here
adds or edits a guard, so this pull request has no section showing one bite.
The checks themselves. They run on GitHub for this board. I ran
.github/doc-paths/doc-paths.sh on this machine and nothing else; the verdicts
of the other legs are whatever this pull request's own runs report, and I have
not predicted them here.

Who has read it

Nobody other than the author has read this change. There is no second reader on
this board tonight, and the evidence above stands in place of one rather than the
question being left open.

… is it .github/workflows/shell-analysis.yml, .github/workflows/zizmor.yml and the shellcheck row of docs/gate-parity.md each said the analysis over the core's own language was still waiting, that it waited on #11, and that this tree held no code and had chosen no language. All four claims were true on 2026-08-22, the day the three sentences were written, and none of them is now: #11 closed on 2026-08-25, .github/workflows/codeql.yml landed on 2026-08-26 and is that analysis, and #81 closed on 2026-08-31. That leg's own header names both workflow files, so the answer sat one directory away from two of the three sites while they went on describing it as absent, and no change that made one of the four claims false had a reason to open any of them. It was found by reading the sentence in each file against the directory the file sits in. Each sentence now names that leg rather than an issue number, so it stops being a second declaration of where the leg stands and cannot go stale again on the tracker. What each sentence was there for survives: the bound on what the shell leg and the workflow leg each read, and that the shellcheck row is about the shell while the core's own language has its own row in the same table. It prevents a reader of any of the three concluding that this repository runs no semantic analysis over its own code. That is the direction that makes the gate look thinner than it is, in two files a contributor opens to find out what the gate covers and in the table this board measures that coverage with. Closes #404 Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>

…eads the core's language (#437) `.github/shell-analysis/shell-analysis.sh` prints, in the section a reader goes to for what a green tick does not cover, that the core's own language is not read here because none is chosen, because no code is in this tree, and that #11 is where that is decided. All three were true on 2026-08-22, the day this leg landed, and none of them is now. #11 closed as completed on 2026-08-25 with `docs/decisions/0011-the-language-the-toolchain-and-the-binding-layer.md`, `src/` holds 46 tracked files written in that language, and `.github/workflows/codeql.yml` landed on 2026-08-26 as `Analyze (rust)` and is the leg that reads them. #405 repaired the same sentence in three places on 2026-09-17: `.github/workflows/shell-analysis.yml`, `.github/workflows/zizmor.yml` and the shellcheck row of `docs/gate-parity.md`. Those three DESCRIBE this leg. This is the fourth site, it is the only one of the four a reader meets by running the check, and it was the one nothing was ever going to report, because no route in this tree reads a claim written into a shell string. The line now names `.github/workflows/codeql.yml` as the leg that analyses the core's language, and names the record the language was chosen in. The correction above it records what the line said, when each half stopped being true, and how it survived the sweep. What failure it prevents: a reader sizing what a green `shell-analysis` covers. The old line put the absence of any analysis over the core's code, the absence of the code, and an open question about the language into the one place on this board where a negative disclosure is read as authoritative. A division of subjects between two legs was printed as a gap with nothing behind it. A negative disclosure is not turned into a positive assurance here. This leg still says it does not read the core's own language, in the same words and no more weakly. What moves is the reason. What was wrong, and how it was found: a sweep of claims about issue state in non-Markdown files, read against the tracker and the tree. #405's own change is what named the population the fourth site sits outside of. No rule, no severity, no fixture and no excluded rule changes. What this leg analyses and what it refuses are what they were. `cargo build --locked --all-targets` and `cargo test --locked` are green at this commit, and `.github/doc-paths/doc-paths.sh check`, `.github/invariants/invariants.sh check` and `.github/statements/statements.sh check` each exit 0. `bash -n` on the edited file is clean. `.github/shell-analysis/shell-analysis.sh selftest` was NOT run to a verdict here. `shellcheck` is not on this machine, and the script refuses with `shellcheck: command not found` rather than passing, which is the behaviour the file's own header describes. The gate runs that leg with the analyser present. The first push of this branch was refused by the gate. The comment wrapped so that a line began with the analyser's own directive keyword, and the analyser read that sentence as a directive, refusing the file with SC1073 and SC1072. The sentence is rewrapped so the word is never first on a line, and the trap is written into the same comment, because that word is unavoidable in prose inside this particular script. A line parsed as a valid `disable` would have passed and taken a rule with it, which is why it is recorded rather than silently avoided. Closes #436 Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>

iderex merged commit a194071 into main Sep 17, 2026
28 checks passed

iderex deleted the the-half-of-81-these-three-sites-say-is-waiting-404 branch September 17, 2026 16:57

Navigation Menu

Point the three sites naming #81's code-scanning half at the leg that is it - #405

Point the three sites naming #81's code-scanning half at the leg that is it#405
iderex merged 1 commit into
mainfrom
the-half-of-81-these-three-sites-say-is-waiting-404

iderex commented Sep 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

iderex commented Sep 17, 2026

The issue this belongs to

What changed

What failure it prevents

Evidence

What this does not cover

Who has read it

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant