From ac15d5e52f43ee5eaa2763cb8429b78f570418dc Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 22 Sep 2026 18:39:57 +0100 Subject: [PATCH 1/5] ci(pipeline): re-pin ci-pipeline.yml to f95130bb This caller was pinned to 2eb9bb19, which predates hyperpolymath/standards#985. That commit fixed the ci-pipeline detect gate; every caller still on 2eb9bb19 runs the pre-fix gate and goes red on its next pull_request. Re-pins to f95130bb (the #985 squash merge) and updates the provenance comment to the matching blob 8bcdeaf2. Both lines move together: a SHA bump that leaves a stale blob comment behind is a phantom pin, unverifiable against the tree it claims to name. f95130bb was chosen over current main (d1bd7f42) deliberately: ci-pipeline.yml is byte-identical at both (blob 8bcdeaf2), f95130bb is the reviewed revision, and its only red checks are SonarCloud and the mirror trio -- all four listed in standards' own config/rulesets/gates.json never_required_workflows. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR --- .github/workflows/standards-pipeline.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/standards-pipeline.yml b/.github/workflows/standards-pipeline.yml index 592680b..8ab3c44 100644 --- a/.github/workflows/standards-pipeline.yml +++ b/.github/workflows/standards-pipeline.yml @@ -33,10 +33,10 @@ permissions: jobs: pipeline: - # hyperpolymath/standards @ 2eb9bb19 — ci-pipeline.yml blob d2583657. + # hyperpolymath/standards @ f95130bb — ci-pipeline.yml blob 8bcdeaf2. # # NO `secrets:` block, deliberately. ci-pipeline.yml declares # `workflow_call.inputs` only, has no `secrets:` block and references no # `secrets.*` anywhere; `secrets: inherit` would hand the whole store to a # workflow that consumes none of it. - uses: hyperpolymath/standards/.github/workflows/ci-pipeline.yml@2eb9bb19d43b6285466ca36b92d1324a09e7a207 + uses: hyperpolymath/standards/.github/workflows/ci-pipeline.yml@f95130bbcbc8917bfec8f8875fa810ad93b08871 From c0d88e7fbf8aa4ade0b0f139c3b8b43c78f3e837 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 22 Sep 2026 20:09:50 +0100 Subject: [PATCH 2/5] fix(ci): retarget ci-pipeline pin to standards#989 squash SHA ed5e3f65 f95130bb predated hyperpolymath/standards#989 and carried both defects that PR cures: the exemption-ledger checkout read `ref: a2ff696a` (an abbreviated SHA, which `git fetch` cannot resolve) and `detect` did its own `exit 1`, so a ledgered repository went red regardless of its exemption. Re-pins to ed5e3f65 - the squash merge of #989 on standards' main - where the ledger is read at `${{ job.workflow_sha }}` and `report` is the single judge. Proven on the pilot before this wave: AcceleratorGate.jl#40, dispatch run 35770740241, printed `ledger read at 'ed5e3f651305dd1ce0d0b5d2d08b97a963634632'` - the callee's own commit, 40 hex, non-empty - and the run was green while correctly refusing. The provenance comment moves with the pin: a stale comment is a phantom pin. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR --- .github/workflows/standards-pipeline.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/standards-pipeline.yml b/.github/workflows/standards-pipeline.yml index 8ab3c44..e9bf8c8 100644 --- a/.github/workflows/standards-pipeline.yml +++ b/.github/workflows/standards-pipeline.yml @@ -33,10 +33,10 @@ permissions: jobs: pipeline: - # hyperpolymath/standards @ f95130bb — ci-pipeline.yml blob 8bcdeaf2. + # hyperpolymath/standards @ ed5e3f65 — ci-pipeline.yml blob ea87c43a. # # NO `secrets:` block, deliberately. ci-pipeline.yml declares # `workflow_call.inputs` only, has no `secrets:` block and references no # `secrets.*` anywhere; `secrets: inherit` would hand the whole store to a # workflow that consumes none of it. - uses: hyperpolymath/standards/.github/workflows/ci-pipeline.yml@f95130bbcbc8917bfec8f8875fa810ad93b08871 + uses: hyperpolymath/standards/.github/workflows/ci-pipeline.yml@ed5e3f651305dd1ce0d0b5d2d08b97a963634632 From 9883c2b0d9f73bd5abb7f4cea2cf0e9ed8a89e94 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 22 Sep 2026 20:18:56 +0100 Subject: [PATCH 3/5] ci(lock): move actions.lock standards-pipeline entry to ed5e3f65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `uses:` ref in `.github/workflows/standards-pipeline.yml` was re-pinned to `hyperpolymath/standards@ed5e3f65` (standards#989 squash), but `actions.lock` still recorded `hyperpolymath/standards@2eb9bb19`. The lock keys per workflow file, so the mismatch fails "actions.lock is in sync with the workflow YAML" and leaves the caller with a dangling lock edge. Edited by hand: only the `.github/workflows/standards-pipeline.yml` entry changes. The other 11 `hyperpolymath/standards@` entries (governance.yml, hypatia-scan.yml, ...) are untouched — `gh actions-lock` rewrite mode is never used here, it de-pins SHAs to tags and invents invalid local-action refs. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR --- .github/workflows/actions.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index c157436..896f32a 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -57,7 +57,7 @@ workflows: '.github/workflows/security-policy.yml': - 'actions/checkout@v7.0.1' '.github/workflows/standards-pipeline.yml': - - 'hyperpolymath/standards@2eb9bb19d43b6285466ca36b92d1324a09e7a207' + - 'hyperpolymath/standards@ed5e3f651305dd1ce0d0b5d2d08b97a963634632' '.github/workflows/static-analysis-gate.yml': - 'actions/checkout@v7.0.1' - 'actions/download-artifact@v8.0.1' From 73cf89c7f142bbb5e034d0a576aa0042a18b697e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 22 Sep 2026 20:23:45 +0100 Subject: [PATCH 4/5] ci(lock): give standards@ed5e3f65 its own dependencies record MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Moving only the `uses:` reference was not enough. `check-lock-sync.sh` enforces TRANSITIVE CLOSURE: every ref named under a workflow path must also resolve to a top-level `dependencies:` record. Renaming the reference alone left FAIL actions.lock: DANGLING EDGES hyperpolymath/standards@ed5e3f65... named by .github/workflows/standards-pipeline.yml and a dangling edge is not cosmetic — GitHub refuses the run at startup, creating ZERO jobs. That is exactly what was observed: 0 `pipeline /` checks on this PR. The old `@2eb9bb19` record was referenced by nothing else once the pin moved, so it is retired rather than kept. The replacement record carries the same four transitive deps, re-derived from ci-pipeline.yml at ed5e3f65 rather than copied on faith — the set is unchanged (checkout, haskell-actions/setup, standards@571cc734, oven-sh/setup-bun), with the two reusable subpaths collapsed to bare OWNER/REPO@REF as the schema requires. Placed after @da2c748a to hold LC_ALL=C key order. Edited by hand and verified by running ./scripts/check-lock-sync.sh locally: "in sync and transitively closed ... 0 dangling edges", rc=0. `gh actions-lock` rewrite mode is never used here — it de-pins SHAs to floating tags and invents invalid local-action refs. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR --- .github/workflows/actions.lock | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 896f32a..5d31064 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -182,16 +182,6 @@ dependencies: commit: 'sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be' owner_id: 6759885 repo_id: 1352485172 - 'hyperpolymath/standards@2eb9bb19d43b6285466ca36b92d1324a09e7a207': - ref: '2eb9bb19d43b6285466ca36b92d1324a09e7a207' - commit: 'sha1-2eb9bb19d43b6285466ca36b92d1324a09e7a207' - owner_id: 6759885 - repo_id: 1116521501 - uses: - - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d' - - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd' - - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6' 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd': ref: '571cc734cd69fb846032ec77a662aa8ee4fc32cd' commit: 'sha1-571cc734cd69fb846032ec77a662aa8ee4fc32cd' @@ -223,6 +213,16 @@ dependencies: - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' - 'github/codeql-action@cdf488f595d80d6e07e03d4674febd5ab45fa938' - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' + 'hyperpolymath/standards@ed5e3f651305dd1ce0d0b5d2d08b97a963634632': + ref: 'ed5e3f651305dd1ce0d0b5d2d08b97a963634632' + commit: 'sha1-ed5e3f651305dd1ce0d0b5d2d08b97a963634632' + owner_id: 6759885 + repo_id: 1116521501 + uses: + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d' + - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd' + - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6' 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': ref: '2d1146689b8cda280b9bc96326124645441f03bc' commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' From 6f462684374d8869cb57d6c34d15ccbdaf43f1fa Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 22 Sep 2026 20:35:12 +0100 Subject: [PATCH 5/5] =?UTF-8?q?ci(lock):=20match=20the=20working=20control?= =?UTF-8?q?=20=E2=80=94=20standards-pipeline=20entry=20back=20to=20[]?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `🟡 CHECK: Standards pipeline` has been startup_failure (jobs=0) on this branch at every commit since the entry stopped being `[]`. This restores the shape used by the four repos where the SAME callee at the SAME pin succeeds. Measured, in this repo at 73cf89c: - 17 other workflows create jobs normally at that commit. - Six of them (governance, hypatia-scan, mirror, rust-ci, scorecard, secret-scanner) DO name a hyperpolymath/standards@ job-level ref in actions.lock and run fine. So "naming a job-level ref" is NOT by itself the cause; that hypothesis is refuted by six counter-examples. Also refuted by measurement, so nobody re-tests them: - Actions allow-list: `hyperpolymath/*` IS present (92 patterns). - sha_pinning_required: every uses: in the callee is 40-hex. - Permissions escalation: callee declares only `contents: read` throughout, and the caller grants exactly that. - Callee reachability: ed5e3f65 resolves; tropical-types, modshells, ddraig-ssg and AcceleratorGate.jl all run it to success. The true discriminator is NOT yet isolated. What is established is that `[]` is the shape that runs, in four independent repos, against this exact callee. ⚠ KNOWINGLY LEAVING `Lock Sync Gate` RED. scripts/check-lock-sync.sh demands the ref be named; GitHub kills the run when it is. Its own help text concedes the tool it delegates to "does NOT handle job-level reusable-workflow refs", yet the gate requires precisely that. It is not a required check on this repo (no active branch ruleset), and it was already red on this PR beforehand. DO NOT "fix" this by naming the ref again — that is what fix/lock-standards-pipeline-ref did, and it killed the pipeline estate-wide. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR --- .github/workflows/actions.lock | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 5d31064..7a8393c 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -56,8 +56,7 @@ workflows: - 'hyperpolymath/standards@8f2ee50841e216cd8c192eeb68953118190f105c' '.github/workflows/security-policy.yml': - 'actions/checkout@v7.0.1' - '.github/workflows/standards-pipeline.yml': - - 'hyperpolymath/standards@ed5e3f651305dd1ce0d0b5d2d08b97a963634632' + '.github/workflows/standards-pipeline.yml': [] '.github/workflows/static-analysis-gate.yml': - 'actions/checkout@v7.0.1' - 'actions/download-artifact@v8.0.1' @@ -213,16 +212,6 @@ dependencies: - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' - 'github/codeql-action@cdf488f595d80d6e07e03d4674febd5ab45fa938' - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' - 'hyperpolymath/standards@ed5e3f651305dd1ce0d0b5d2d08b97a963634632': - ref: 'ed5e3f651305dd1ce0d0b5d2d08b97a963634632' - commit: 'sha1-ed5e3f651305dd1ce0d0b5d2d08b97a963634632' - owner_id: 6759885 - repo_id: 1116521501 - uses: - - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d' - - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd' - - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6' 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': ref: '2d1146689b8cda280b9bc96326124645441f03bc' commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'