fix(ci): clear Dogfood+Governance check failures - #95
Merged
Merged
Conversation
Two independent reds on main at cb2b475, both reproduced locally with the exact pinned tooling before fixing: - Dogfood Gate "Validate DEED manifests": deed-ecosystem validate-action errored on tests/idris2/{depends,diagnosticity}.a2ml — missing required identity field. Both are corpus metadata docs (README.adoc); add name + version so the validator exits 0 (0 errors, warnings down 6 → 4, all advisory in non-strict mode). - Governance "Workflow security linter": .github/workflows/build.yml had neither a SPDX header comment block nor a top-level permissions: declaration — both required by standards governance-reusable (092deda). Add the standard estate header + contents: read. Drive-bys in the Dogfood summary steps (same failed workflow): the scorecard row and manifest-count line read the never-set A2ML_STATUS / A2ML_COUNT instead of DEED_STATUS / MANIFEST_COUNT (empty cells), and the empty-K9 branch printed the missing-DEED text. Gates re-run locally after the fix, all green: SPDX+permissions scan, duplicate-key check (17 workflows clean), workflow parse, action-pin resolve (20/20 upstream), A2ML validator (0 errors). Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
arena-ai-coding-agent
Bot
requested a review
from hyperpolymath
as a code owner
September 25, 2026 21:29
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
approved these changes
Sep 25, 2026
hyperpolymath
added a commit
that referenced
this pull request
Sep 25, 2026
## What Follow-up to #95. Governance on main (f4e49a7) now passes `Check SPDX headers + permissions` ✅ but fails one step later: ``` ::error::1 of 20 action pin(s) DO NOT EXIST upstream. NOT-ANCESTOR hyperpolymath/standards@892497f (compare main → diverged) ``` **Root cause (a real, determinate negative — not a flake):** `892497fe`, the pin on `secret-scanner.yml`'s reusable workflow, is a real commit object but **not an ancestor of `standards/main`** (orphan — squash-merge residue / PR-head lineage). GitHub's resolver only accepts reusable-workflow commits reachable from the default branch, so: - **every Secret Scanner run** (push *and* PR) fails at graph resolution with 0 jobs — the "This run likely failed because of a workflow file issue" rows red on main since at least #93; - the estate's updated pin gate (standards\@main, now run by Governance's linter) determinately fails on it. standards issue #782 documents this class: *four such SHAs (7fdc2705…, **892497fe**…, 46960521…, 5b1d0022…) account for 61 dead workflow-run rows with ZERO alive rows* — aerie's secret-scanner pin is literally one of the named four. ## Fix Repin to `e13e2ea3dbbc9c7815e39c3749b4480514f555a6` — the newest commit on `standards/main` touching the reusable (2026-09-19, standards #867): - **ancestry verified**: `compare/main...e13e2ea3` → `behind` (ancestor) — the same predicate the gate applies; - **strict superset** of the orphan's content: estate gitleaks baseline wiring, full-history gating pass (`fetch-depth: 0` + shallow-assert), `--verbose` findings, repo-local config resolution. Per the gate's own guidance: repin to a merge commit **on** the default branch, never a PR head. ## Verification (local, CI script versions) | Gate | Result | |---|---| | `check-action-pins-resolve.sh` (standards\@main — what CI runs) | ✅ 20/20 | | SPDX + permissions | ✅ | | duplicate keys | ✅ 17 clean | | workflow parse | ✅ 25 | ## Expected effect after merge - **Governance** → green (linter completes: SPDX ✓ → pin-resolve ✓ → dup-workflows ✓). - **Secret Scanner** → schedules jobs for the first time (was unresolvable at graph resolution). Note: Label Triage / Pages / Mirror / SonarQube remain owner-token items (allow-list, secrets) — see `docs/REPO-SETTINGS.adoc` §3/§9. --------- Co-authored-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two independent reds on
mainatcb2b475, each reproduced locally with the exact pinned tooling, then fixed:1. Dogfood Gate —
Validate DEED manifests(run 36188043077)hyperpolymath/deed-ecosystem/validate-action@aa4b836reported:Both files are corpus metadata docs (
tests/idris2/README.adoc, ROADMAP Phase 9) in.a2mlform. Fix: addname+versionidentity fields. Validator now exits 0 — 0 errors, warnings down 6 → 4 (remaining ones are advisory SPDX/attestation warnings in non-strict mode).2. Governance —
Workflow security linter/Check SPDX headers + permissions(run 36188043851).github/workflows/build.ymlhad neither a SPDX header comment block nor a top-levelpermissions:declaration — both required byhyperpolymath/standardsgovernance-reusable@092deda. Fix: standard estate header +permissions: contents: read.Drive-bys in the same (failed) workflow's summary steps
A2ML_STATUS/A2ML_COUNT→ empty cells; nowDEED_STATUS/MANIFEST_COUNT.Verification (local, before pushing)
validate-a2ml.sh@aa4b836(job step, verbatim)check-workflow-duplicate-keys.sh@092dedacheck-workflows-parse.sh@092dedacheck-action-pins-resolve.sh@092deda.a2mlfilesNot in this PR (owner-token / other sessions)
docs/REPO-SETTINGS.adoc§3/§9,docs/ESTATE-PROPAGATION.adoc§4–5).SONAR_TOKENowner secret.Optimus-Branchenablement + check contexts — only after checks schedule again (REPO-SETTINGS §1).docs/ESTATE-PROPAGATION.adoc.