From f543d7a4e3503b2209743e619a7d61126be5aeb0 Mon Sep 17 00:00:00 2001 From: hyperpolymath Date: Tue, 22 Sep 2026 13:19:12 +0100 Subject: [PATCH] ci: add standards ci-pipeline dry-run caller Adds a pinned caller for hyperpolymath/standards ci-pipeline.yml as part of the deliberate dry-run wave that seeds .machine_readable/pipeline-allow.txt by OBSERVATION rather than by inference. actions.lock key added BY HAND (never `gh actions-lock` rewrite mode). Discloses hyperpolymath/standards#976 in the workflow header. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR --- .github/workflows/actions.lock | 1 + .github/workflows/standards-pipeline.yml | 42 ++++++++++++++++++++++++ 2 files changed, 43 insertions(+) create mode 100644 .github/workflows/standards-pipeline.yml diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 42be1e9..ccb8239 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -50,6 +50,7 @@ workflows: '.github/workflows/secret-scanner.yml': [] '.github/workflows/security-policy.yml': - 'actions/checkout@v7.0.1' + '.github/workflows/standards-pipeline.yml': [] '.github/workflows/static-analysis-gate.yml': - 'actions/checkout@v7.0.1' - 'actions/download-artifact@v8.0.1' diff --git a/.github/workflows/standards-pipeline.yml b/.github/workflows/standards-pipeline.yml new file mode 100644 index 0000000..592680b --- /dev/null +++ b/.github/workflows/standards-pipeline.yml @@ -0,0 +1,42 @@ +# SPDX-License-Identifier: MPL-2.0 +# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) +# +# Standards pipeline — DRY-RUN WAVE caller. This is a deliberate OBSERVATION, +# not an adoption, and it is expected to be informative whether it is green or +# red. +# +# `.machine_readable/pipeline-allow.txt` in hyperpolymath/standards is seeded +# EMPTY by doctrine. Its own text: "An entry here must be EARNED BY +# OBSERVATION: the pipeline ran in that repository and went red. It must never +# be seeded by inference." and "The honest seed is a dry-run wave: adopt the +# caller in a deliberate sample, record the real verdict per repository, and add +# only what actually went red." This caller is how that observation is earned. +# +# ⚠ KNOWN DEFECT DISCLOSED: hyperpolymath/standards#976 — ci-pipeline.yml's +# `detect` job counts `*.ncl` into its ecosystem denominator, and the RSR +# template ships a six-file k9 Nickel set into every seeded repository, so +# TOTAL can be lifted above zero by boilerplate alone and the zero-denominator +# refusal is then never reached. This repository was chosen BECAUSE its verdict +# does not depend on that contaminated signal. +# +# Pinned to an immutable commit, never `@main`: following main would let one +# push in standards change the verdict of every already-pinned caller with no +# review here. +name: "🟡 CHECK: Standards pipeline" + +on: + pull_request: + workflow_dispatch: + +permissions: + contents: read + +jobs: + pipeline: + # hyperpolymath/standards @ 2eb9bb19 — ci-pipeline.yml blob d2583657. + # + # NO `secrets:` block, deliberately. ci-pipeline.yml declares + # `workflow_call.inputs` only, has no `secrets:` block and references no + # `secrets.*` anywhere; `secrets: inherit` would hand the whole store to a + # workflow that consumes none of it. + uses: hyperpolymath/standards/.github/workflows/ci-pipeline.yml@2eb9bb19d43b6285466ca36b92d1324a09e7a207