fix(ci): revive the startup-dead governance gates (0 jobs -> running) - #174
Merged
Merged
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (5)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details
|
| Layer / File(s) | Summary |
|---|---|
Workflow permissions and pins .github/workflows/governance.yml, .github/workflows/elixir-ci.yml, .github/workflows/mirror.yml, .github/workflows/scorecard.yml, .github/workflows/secret-scanner.yml |
The workflows update reusable workflow references. They add actions: read where required and define read permissions at workflow and job scope where specified. |
Priority: ⬆️ High
Estimated code review effort: 1 (Trivial) | ~5 minutes
Merge Risk: ⚪ Minimal · up to 987bd
This updates reusable GitHub Actions workflow pins and read permissions across five workflows. No concrete current-head merge-blocking risk remains.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
| Check name | Status | Explanation |
|---|---|---|
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Title check | ✅ Passed | The title clearly describes the primary change: restoring governance gates that previously started with zero jobs. It matches the workflow pin and permission updates. |
| Description check | ✅ Passed | The description directly explains the failed governance gates, the causes, the workflow changes, and the verification results. It is relevant to the changeset. |
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
- Create stacked PR
- Commit on current branch
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit checks each workflow pin
Read permissions let jobs begin
Five paths point to one revision
YAML stays neat with clear precision
Hop, hop, the updates win
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
The governance suite was dying at startup on this repo: scorecard, mirror and secret-scanner each reported 0 jobs and 0 check runs, so main looked green because the gates were ABSENT, not passing. Two causes, both fixed here: 1. Callers sat on older standards pins (7fdc2705, 892497fe) whose reusables request `actions: read`, which the callers did not grant. 2. A job-level `permissions:` block REPLACES the workflow-level map rather than merging with it, so scorecard's job ran with neither `contents: read` nor `actions: read` regardless of the workflow-level grant. All five callers are repointed to standards main HEAD 257869d3 and now grant `actions: read` + `contents: read` at BOTH workflow and job level. Verified: every *-reusable.yml referenced exists at 257869d3. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QMTyDv9CoJo5PfeNzyp519
hyperpolymath
force-pushed
the
fix/restore-reachable-standards-pin
branch
from
September 8, 2026 18:11
bab40dc to
3ba1737
Compare
standards main HEAD (257869d3) cannot be parsed by a caller: its actions.lock is out of sync with governance-reusable.yml after Dependabot PR #746, so a caller pinning it gets HTTP 422 and dies at startup with zero jobs. hyperpolymath/standards#754 resyncs the lockfile. Until it merges, governance stays on fad242d3 - the pin with a verified green 15-job run. The other four callers move to main HEAD, which parses cleanly (mirror verified: 7 jobs, was 0). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QMTyDv9CoJo5PfeNzyp519
…emand scorecard.yml triggered only on branch_protection_rule and schedule, so there was no way to prove the startup-failure repair works before merging it. The canonical template caller (proof-burrower, the verified-working control) carries workflow_dispatch; this matches it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QMTyDv9CoJo5PfeNzyp519
hyperpolymath
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was actually wrong
Three of this repo's five governance-suite gates were dying at startup:
scorecard,mirrorandsecret-scannereach reported 0 jobs and 0 check runs. A gate that never starts is absent, not red — somainlooked green while nothing ran.gh run viewon those runs says only: "This run likely failed because of a workflow file issue."Two causes
actions: read— a permission the callers never granted. The reusable call fails validation and the run dies before any job is created.permissions:block REPLACES the workflow-level map rather than merging with it. So a job carrying its own block ran with neithercontents: readnoractions: read, regardless of what the top of the file granted. This is why "just addactions: readat the top" is a no-op on these callers — the gate stays absent while looking patched.What this PR does
257869d3.actions: read+contents: readat both workflow and job level.workflow_dispatchtoscorecard.ymlso the gate is verifiable on demand (matchingproof-burrower, the verified-working control caller).governance.ymlatfad242d3. standards main HEAD is currently unparseable by callers: itsactions.lockfell out of sync withgovernance-reusable.ymlafter Dependabot #746, so pinning HEAD returnsHTTP 422 … references actions not present in the lockfileand the run dies at startup. fix(ci): resync actions.lock with the workflow refs Dependabot bumped (#746) standards#754 resyncs it; governance moves to HEAD once that lands.Verification — dispatched on this branch, job counts measured
Job counts come from
actions/runs/<id>/jobs .total_count— a failing-checks list cannot distinguish "gate passed" from "gate never ran", so the positive control is the count itself.Newly-visible failures (e.g. mirror's bitbucket/sourcehut targets) are real findings the absent gate was concealing, not regressions introduced here.
🤖 Generated with Claude Code
https://claude.ai/code/session_01QMTyDv9CoJo5PfeNzyp519