Skip to content

ci(pipeline): re-pin ci-pipeline.yml to standards#989 squash SHA ed5e3f65 - #40

Merged
hyperpolymath merged 2 commits into
mainfrom
secqual/repin-ci-pipeline-ed5e3f65
Sep 22, 2026
Merged

hyperpolymath merged 2 commits into
mainfrom
secqual/repin-ci-pipeline-ed5e3f65

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

What

Re-pins ci-pipeline.yml from 2eb9bb19 to ed5e3f65 — the squash merge of
hyperpolymath/standards#989 on main. The provenance comment moves with the pin
(a stale comment is a phantom pin).

-    # hyperpolymath/standards @ 2eb9bb19 — ci-pipeline.yml blob d2583657.
+    # hyperpolymath/standards @ ed5e3f65 — ci-pipeline.yml blob ea87c43a.
-    uses: .../ci-pipeline.yml@2eb9bb19d43b6285466ca36b92d1324a09e7a207
+    uses: .../ci-pipeline.yml@ed5e3f651305dd1ce0d0b5d2d08b97a963634632

Why this SHA and not f95130bb

This supersedes #39, which targeted f95130bb. That SHA predated #989 and carried
both defects #989 cures
— the ledger checkout read ref: a2ff696a (abbreviated, so
git fetch cannot resolve it) and detect did its own exit 1, so a ledgered
repository went red regardless of its exemption.

Verified before landing — this is the pilot of the 5-repo wave

Dispatch run
35770740241
on this branch's content is green, and prints the line that gates the whole wave:

ledger read at 'ed5e3f651305dd1ce0d0b5d2d08b97a963634632'

40 hex, non-empty, and equal to the callee's own commit — so job.workflow_sha
resolves correctly against the squash SHA, not just the PR-head commit it was first
proven on.

Assertion Result
Ledger SHA is 40-hex and non-empty ✅
It names the callee's commit (ed5e3f65) ✅
Empty-SHA ::error:: guard did not fire ✅
report is the single judge; run is green while refusing ✅ REFUSED: true, conclusion success
Exemption ledger actually read ✅ pipeline debt: 4 repos
Debt named in-run ✅ notice cites #967 and the removal condition

Both commits are signature-verified.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

hyperpolymath and others added 2 commits September 22, 2026 18:40
This caller was pinned to 2eb9bb19, which predates hyperpolymath/standards#985.
That commit fixed the ci-pipeline detect gate; every caller still on 2eb9bb19
runs the pre-fix gate and goes red on its next pull_request.

Re-pins to f95130bb (the #985 squash merge) and updates the provenance comment
to the matching blob 8bcdeaf2. Both lines move together: a SHA bump that leaves
a stale blob comment behind is a phantom pin, unverifiable against the tree it
claims to name.

f95130bb was chosen over current main (d1bd7f42) deliberately: ci-pipeline.yml
is byte-identical at both (blob 8bcdeaf2), f95130bb is the reviewed revision,
and its only red checks are SonarCloud and the mirror trio -- all four listed
in standards' own config/rulesets/gates.json never_required_workflows.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR
f95130bb predated hyperpolymath/standards#989 and carried both defects that
PR cures: the ledger checkout read `ref: a2ff696a` (an abbreviated SHA, which
`git fetch` cannot resolve) and `detect` did its own `exit 1`, so a ledgered
repository went red regardless of the exemption.

Re-pins to ed5e3f65, the squash merge of #989 on standards' main, where the
ledger is read at `${{ job.workflow_sha }}` and `report` is the single judge.

Verified before landing: dispatch run 35770740241 on this branch is green and
prints `ledger read at 'ed5e3f651305dd1ce0d0b5d2d08b97a963634632'` - the
callee's own commit, 40 hex, non-empty.

The provenance comment moves with the pin: a stale comment is a phantom pin.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR
@coderabbitai

coderabbitai Bot commented Sep 22, 2026

Copy link
Copy Markdown

Warning

Review limit reached

Next included review available in 52 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 000713fc-e26e-49f8-8f29-2feaa88cf3bd

📥 Commits

Reviewing files that changed from the base of the PR and between 0e7bea7 and 603f06a.

📒 Files selected for processing (1)
  • .github/workflows/standards-pipeline.yml

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@hyperpolymath
hyperpolymath merged commit 3748958 into main Sep 22, 2026
31 of 32 checks passed
@hyperpolymath
hyperpolymath deleted the secqual/repin-ci-pipeline-ed5e3f65 branch September 22, 2026 19:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant