Merge branch 'main' into fix/empty-linter-pattern-never-matched

Author: hyperpolymath

.github/workflows/dogfood-gate.yml

@@ -21,7 +21,7 @@ jobs:
   # ---------------------------------------------------------------------------
   a2ml-validate:
     name: Validate A2ML manifests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Checkout repository
@@ -65,7 +65,7 @@ jobs:
   # ---------------------------------------------------------------------------
   k9-validate:
     name: Validate K9 contracts
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Checkout repository
@@ -114,7 +114,7 @@ jobs:
   # ---------------------------------------------------------------------------
   empty-lint:
     name: Empty-linter (invisible characters)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Checkout repository
@@ -206,7 +206,7 @@ jobs:
   # ---------------------------------------------------------------------------
   groove-check:
     name: Groove manifest check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Checkout repository
@@ -264,7 +264,7 @@ jobs:
   # ---------------------------------------------------------------------------
   eclexiaiser-validate:
     name: Validate eclexiaiser manifest
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Checkout repository
@@ -284,28 +284,34 @@ jobs:
 
           echo "has_manifest=true" >> "$GITHUB_OUTPUT"
 
-          # Validate TOML structure using Python 3.11+ tomllib
-          python3 -c "
-          import tomllib, sys
-          with open('eclexiaiser.toml', 'rb') as f:
-              data = tomllib.load(f)
-          project = data.get('project', {})
-          if not project.get('name', '').strip():
-              print('ERROR: project.name is required', file=sys.stderr)
-              sys.exit(1)
-          functions = data.get('functions', [])
-          if not functions:
-              print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)
-              sys.exit(1)
-          for fn in functions:
-              if not fn.get('name', '').strip():
-                  print('ERROR: function name cannot be empty', file=sys.stderr)
-                  sys.exit(1)
-              if not fn.get('source', '').strip():
-                  print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)
-                  sys.exit(1)
-          print(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')
-          " || {
+          # Validate TOML structure using pre-installed yq
+          (
+            PROJECT_NAME=$(yq -e '.project.name // ""' eclexiaiser.toml)
+            if [ -z "$PROJECT_NAME" ]; then
+                echo "ERROR: project.name is required" >&2
+                exit 1
+            fi
+
+            FUNCTIONS_LEN=$(yq -e '.functions | length' eclexiaiser.toml)
+            if [ -z "$FUNCTIONS_LEN" ] || [ "$FUNCTIONS_LEN" -eq 0 ]; then
+                echo "ERROR: at least one [[functions]] entry is required" >&2
+                exit 1
+            fi
+
+            for i in $(seq 0 $((FUNCTIONS_LEN - 1))); do
+                FN_NAME=$(yq -e ".functions[$i].name // \"\"" eclexiaiser.toml)
+                if [ -z "$FN_NAME" ]; then
+                    echo "ERROR: function name cannot be empty" >&2
+                    exit 1
+                fi
+                FN_SRC=$(yq -e ".functions[$i].source // \"\"" eclexiaiser.toml)
+                if [ -z "$FN_SRC" ]; then
+                    echo "ERROR: function $FN_NAME has no source path" >&2
+                    exit 1
+                fi
+            done
+            echo "Valid: $PROJECT_NAME ($FUNCTIONS_LEN function(s))"
+          ) || {
             echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"
             exit 1
           }
@@ -327,7 +333,7 @@ jobs:
   # ---------------------------------------------------------------------------
   dogfood-summary:
     name: Dogfooding compliance summary
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: [a2ml-validate, k9-validate, empty-lint, groove-check, eclexiaiser-validate]
     if: always()
 

.github/workflows/governance.yml

@@ -27,8 +27,9 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3

.github/workflows/mirror.yml

@@ -11,5 +11,5 @@ permissions:
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3
     secrets: inherit

.github/workflows/push-email-notify.yml

@@ -3,19 +3,43 @@
 # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
 # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by
 # new repos from the template; placed on existing repos by the farm sweep.
+#
+# Re-landed after the 2026-07-20 notification-storm freeze (removed in
+# 09f94c5), now on hyperpolymath/smtp-notify-action: Node-free, the SMTP
+# session is Idris2-specified and machine-checked, the binary is Zig-built,
+# byte-reproducible, and SHA-256-pinned inside the action itself.
 name: Push email notification
 on:
-  push: {}
+  push:
+    # Branch pushes only: tag and deletion payloads mislabel Branch:/head_commit.
+    branches: ['**']
+concurrency:
+  # Deliberately per-RUN, so no run is ever queued behind another and none is
+  # ever cancelled. Do NOT "tidy" this into a shared group such as
+  # ${{ github.workflow }}-${{ github.ref }}. GitHub's workflow-syntax docs:
+  # "By default, any existing pending job or workflow in the same concurrency
+  # group will be canceled and the new queued job or workflow will take its
+  # place." That happens regardless of cancel-in-progress, which governs only
+  # the RUNNING job. On this workflow it silently loses a notification email,
+  # with no error anywhere. Every run here reports a DISTINCT commit, so there
+  # is no redundant work for a concurrency limit to remove.
+  # The docs also offer `queue: max` (up to 100 pending); not used, because 100
+  # is still a cap whereas a per-run group needs none.
+  # Verified with zizmor 1.30.0: deleting this block raises concurrency-limits;
+  # this form silences it exactly as a shared group would.
+  group: push-email-${{ github.run_id }}
+  cancel-in-progress: false
 permissions:
   contents: read
 jobs:
   notify:
     name: Email on push
     if: ${{ vars.PUSH_EMAIL_ENABLED == 'true' }}
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Send push notification email
-        uses: dawidd6/action-send-mail@6e502825a508b867ab2954ad6343b68787624c01 # pinned
+        uses: hyperpolymath/smtp-notify-action@ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7 # v0.2.0
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}

.github/workflows/rust-ci.yml

@@ -14,4 +14,4 @@ permissions:
 
 jobs:
   rust-ci:
-    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
+    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3

.github/workflows/scorecard.yml

@@ -6,11 +6,14 @@ on:
   schedule:
     - cron: '23 4 * * 1'
 
-permissions: read-all
+permissions:
+  contents: read
+  security-events: write
+  id-token: write
 
 jobs:
   analysis:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3
     permissions:
       contents: read
       security-events: write

.github/workflows/secret-scanner.yml

@@ -17,5 +17,5 @@ jobs:
   scan:
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3
     secrets: inherit

.mise.toml

@@ -0,0 +1,3 @@
+[tools]
+rust = "stable"
+just = "1.46.0"

.tool-versions

@@ -0,0 +1,14 @@
+// Lust.a2ml for cloudguard-cli
+// SPDX-License-Identifier: MPL-2.0
+// Generated: 2026-04-08T19:51:51+01:00
+
+Lust {
+    name: "cloudguard-cli"
+    version: "1.0.0"
+    description: "Lust contractile for cloudguard-cli"
+
+    // Basic Lust configuration
+    enabled: true
+
+    // Repository-specific settings will be added here
+}