Coderabbit/changes/233fc4bc - #109
Merged
Merged
Conversation
CI in this repository has been silently dead: `.github/workflows/actions.lock` drifted from the workflow YAML, and GitHub refuses such a run at startup — zero jobs are created and the run reports only "This run likely failed because of a workflow file issue." Three changes: * `actions.lock` regenerated with `gh actions-lock --no-migrate-local-actions --no-narrow --no-interactive`, which repaired the step-level ref `step-security/harden-runner`. `--no-migrate-local-actions` is mandatory: fix mode otherwise rewrites `uses: ./…` to the invalid `uses: $/…`, which itself causes startup death. * Six job-level reusable-workflow refs added to `actions.lock` by hand. `gh actions-lock` v0.1.6 cannot see a job-level `uses:` (upstream #129), so it can neither report nor repair these. * `scripts/check-lock-sync.sh` + `.github/workflows/lock-sync-gate.yml` close the recurrence. Dependabot rewrites `uses:` refs and cannot touch the lockfile, so a grouped actions update re-breaks the repository on its next run. The gate fails such a pull request before it merges. It carries no `uses:` of its own — it checks out via git in a `run:` step — so it cannot be killed by the very desync it detects, and it has no `paths:` filter, so it cannot deadlock a ruleset that requires it. Verified before commit: all three mutants killed (a deleted step-level entry, a deleted job-level entry, an injected `$/` rewrite), positive control clean, `gh actions-lock --verify-local` clean, and only these three files modified. Refs: hyperpolymath/standards#968 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm
Listing a ref under `workflows:` without a matching record under `dependencies:` produces an UNRESOLVABLE lockfile, and GitHub rejects the run at startup exactly as a desync does. Measured on this pull request: `hypatia-scan`, `rust-ci` and `secret-scanner` were green on `main` on 2026-09-21 and went `startup_failure` with jobs=0 on the previous commit here, which listed their job-level refs but supplied no records. The `dependencies:` section is the lockfile's resolution table, not commentary. `gh actions-lock` v0.1.6 writes neither half for a job-level `uses:` (upstream #129) and will not backfill a record for a key it did not write, so both halves are supplied by hand. The nested `uses:` list is the sorted union of the called reusable file's own pinned refs at that ref, normalised to OWNER/REPO@REF — the lockfile schema rejects a subpath such as `github/codeql-action/upload-sarif@…`. Verified: `scripts/check-lock-sync.sh` clean, `gh actions-lock --verify-local` clean (it was rc=2 on the un-normalised form), regeneration idempotent, and only `actions.lock` modified. Refs: hyperpolymath/standards#968 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm
`gh actions-lock` stamps this line on every workflow it scans. Committing it keeps the working tree clean on subsequent runs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm
Adds top-level `dependencies:` records for the 11 refs that appeared only inside another record's nested `uses:` list, leaving the lockfile with zero dangling edges. MEASURED on this PR: GitHub rejects a run at startup (jobs=0, "This run likely failed because of a workflow file issue") when the lockfile names a ref it cannot resolve to a record. Governance, Hypatia Security Scan, Rust CI and Secret Scanner all ran with jobs on `pull_request` on 2026-09-21 and went startup_failure on fe22bbc (workflows: entry, no record) and again on cfadcf9 (record present, but its nested uses: were themselves unrecorded). Both commits left a dangling edge; only its class differed. metadatastician/burble's working lockfile is the control: 11 nested refs, 49 records, 0 unrecorded. This brings cicd-squabbler to the same shape. Leaf records carry no nested `uses:`, so closure is reached in a single pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm
…t was blind to The gate shipped in this PR was GREEN on two commits of this very branch that GitHub refused to start. Measured here, 2026-09-22: commit dangling-edge class result fe22bbc workflows: -> dependencies: (ref listed, no record) 4 workflows startup_failure, jobs=0 cfadcf9 dependencies: -> dependencies: (record added, its own nested uses: unrecorded) the same 4 still startup_failure 5286aa5 none - transitively closed 0 startup_failure, all 17 runs create jobs At fe22bbc AND cfadcf9 check-lock-sync.sh exited 0, `gh actions-lock --verify-local` exited 0, and the Lock Sync Gate reported green while four workflows were dead. Every local gate was green on a fatal commit. That is the guard/consumer trap: the gate asked "is every uses: locked?" while GitHub asks "is every locked ref RESOLVABLE?". The asymmetry is counter-intuitive and is what makes the new clause mandatory: * a job-level ref ABSENT from the lockfile entirely is HARMLESS; * a ref PRESENT in the lockfile but unresolvable is FATAL. So adding entries without closing them is strictly worse than adding nothing. Clause 1 demands entries be added; only the new clause 3 makes that demand safe. Shipping clause 1 alone actively steers a developer into the fatal state: Dependabot bumps a job-level ref -> clause 1 reds -> `gh actions-lock` will not backfill a job-level key it did not write -> the developer hand-adds the workflows: entry to go green -> no dependencies: record -> CI dies silently with the gate still green. Clause 3: every ref named anywhere in the lockfile must resolve to a top-level dependencies: record. Closure terminates in one pass because a leaf record may legally omit the nested uses: key, so adding leaves introduces no new edges. Also require an awk with 3-argument match() (a GNU extension) and probe for it rather than trusting the name: mawk is the Debian/Ubuntu default `awk`, and a silent parse failure here would read as a clean pass - the exact failure mode this script exists to prevent. Regression-tested against the real trees, not synthetic mutants: red on fe22bbc (2 edges) and cfadcf9 (11 edges), green on 5286aa5. Mutant: deleting one leaf record is detected, with a before/after assertion that the deletion applied. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm
Contributor
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Contributor
|
❌ Failed to create Coding Agent finishing-touch task. Please try again. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes
RSR Quality Checklist
Required
just testor equivalent)just fmtor equivalent)unsafeblocks without// SAFETY:commentsbelieve_me,unsafeCoerce,Obj.magic,Admitted,sorry).envfiles includedAs Applicable
.machine_readable/descriptiles/STATE.a2mlupdated (if project state changed).machine_readable/descriptiles/ECOSYSTEM.a2mlupdated (if integrations changed).machine_readable/descriptiles/META.a2mlupdated (if architectural decisions changed)TOPOLOGY.mdupdated (if architecture changed)CHANGELOGor release notes updatedsrc/interface/abi/andsrc/interface/ffi/consistent)Testing
Screenshots