Repository navigation
chore: R-16 toolchain pin + reconciliation #53
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,11 +6,15 @@ on: | |
| schedule: | ||
| - cron: '23 4 * * 1' | ||
|
|
||
| permissions: | ||
| contents: read | ||
| security-events: write | ||
| id-token: write | ||
|
Comment on lines
+11
to
+12
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: printf '%s\n' '--- repository conventions ---'
find /tmp/coderabbit-repo-knowledge/hyperpolymath-dictask-24f6a8ac -maxdepth 2 -type f -name '*.md' -print
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/scorecard.yml
printf '%s\n' '--- directly related workflow ---'
if [ -f .github/workflows/mirror.yml ]; then cat -n .github/workflows/mirror.yml; fiRepository: hyperpolymath/dictask Length of output: 3155 🏁 Script executed: printf '%s\n' '--- repo-wide convention ---'
cat /tmp/coderabbit-repo-knowledge/hyperpolymath-dictask-24f6a8ac/conventions/repo-wide.md
printf '%s\n' '--- integration convention ---'
cat /tmp/coderabbit-repo-knowledge/hyperpolymath-dictask-24f6a8ac/conventions/machine-readable-integrations.md
printf '%s\n' '--- relevant learnings and architecture files ---'
find /tmp/coderabbit-repo-knowledge/hyperpolymath-dictask-24f6a8ac \( -path '*/learnings/*' -o -path '*/architecture/*' \) -type f -maxdepth 3 -printRepository: hyperpolymath/dictask Length of output: 1574 🌐 Web query:
💡 Result: In GitHub Actions, the Citations:
Keep write permissions at job scope.
🧰 Tools🪛 zizmor (1.29.0)[warning] 11-11: overly broad permissions (excessive-permissions): security-events: write is overly broad at the workflow level (excessive-permissions) [error] 12-12: overly broad permissions (excessive-permissions): id-token: write is overly broad at the workflow level (excessive-permissions) [warning] 11-11: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment (undocumented-permissions) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
| actions: read | ||
|
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- repository conventions and learnings ---'
find /tmp/coderabbit-repo-knowledge/hyperpolymath-dictask-24f6a8ac -type f -name '*.md' -maxdepth 3 -print
printf '%s\n' '--- scorecard workflow ---'
cat -n .github/workflows/scorecard.yml
printf '%s\n' '--- referenced reusable workflows ---'
rg -n --hidden --glob '!node_modules' 'scorecard-reusable\.yml|workflow_call|permissions:|actions/' .githubRepository: hyperpolymath/dictask Length of output: 6432 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- scoped conventions ---'
for f in /tmp/coderabbit-repo-knowledge/hyperpolymath-dictask-24f6a8ac/*/*.md; do
[ -f "$f" ] || continue
printf '\n### %s\n' "$f"
head -200 "$f"
doneRepository: hyperpolymath/dictask Length of output: 11040 🏁 Script executed: #!/bin/bash
set -eu
commit='5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236'
url="https://raw.githubusercontent.com/hyperpolymath/standards/$commit/.github/workflows/scorecard-reusable.yml"
printf '%s\n' '--- pinned reusable workflow ---'
curl --fail --silent --show-error --location "$url" | nl -ba
printf '%s\n' '--- commit existence ---'
curl --fail --silent --show-error --location \
"https://api.github.com/repos/hyperpolymath/standards/commits/$commit" |
jq -r '[.sha, .commit.message] | `@tsv`'Repository: hyperpolymath/dictask Length of output: 281 🌐 Web query:
💡 Result: In GitHub Actions, if you omit a job-level Citations:
🏁 Script executed: #!/bin/bash
set -u
commit='5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236'
printf '%s\n' '--- pinned commit response ---'
curl --silent --show-error --location --write-out '\nHTTP %{http_code}\n' \
"https://api.github.com/repos/hyperpolymath/standards/commits/$commit"
printf '%s\n' '--- workflow path response ---'
curl --silent --show-error --location --write-out '\nHTTP %{http_code}\n' \
"https://api.github.com/repos/hyperpolymath/standards/contents/.github/workflows/scorecard-reusable.yml?ref=$commit"Repository: hyperpolymath/dictask Length of output: 605 Add The job-level permissions map overrides the workflow-level map. Because it omits 🤖 Prompt for AI Agents |
||
|
|
||
| jobs: | ||
| analysis: | ||
| uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236 | ||
| permissions: | ||
| contents: read | ||
| security-events: write | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| [tools] | ||
| # = "Uncomment and customize for your project" | ||
| # = "rust nightly" | ||
| # = "just 1.40.0" | ||
| # = "nickel 1.10.0" | ||
| # = "gleam 1.8.0" | ||
| # = "elixir 1.18.0" | ||
| # = "erlang 27.2" | ||
| # = "zig 0.14.0" | ||
| # = "idris2 0.7.0" | ||
|
Comment on lines
+2
to
+10
Contributor
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win Reconcile the repository tool-file contract.
📍 Affects 1 file
🤖 Prompt for AI Agents |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
Repository: hyperpolymath/dictask
Length of output: 240
Replace the invalid reusable-workflow pin.
The
5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236reference does not resolve inhyperpolymath/standards(No commit found for SHA, HTTP 422). Both workflows can therefore fail to resolve their reusable workflow. Use a valid commit that contains the referenced workflow file.🧰 Tools
🪛 zizmor (1.29.0)
[warning] 15-15: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
📍 Affects 2 files
.github/workflows/mirror.yml#L15-L15(this comment).github/workflows/scorecard.yml#L17-L17🤖 Prompt for AI Agents
🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
Repository: hyperpolymath/dictask
Length of output: 3177
🏁 Script executed:
Repository: hyperpolymath/dictask
Length of output: 415
🏁 Script executed:
Repository: hyperpolymath/dictask
Length of output: 30342
Remove
secrets: inheritfromscorecard.yml.scorecard-reusable.ymldeclares and consumes no secrets, so inheritance is unnecessary. Retainsecrets: inheritformirror-reusable.yml, whose contract requires the forge keys andRADICLE_KEY.🧰 Tools
🪛 zizmor (1.29.0)
[warning] 15-15: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
📍 Affects 2 files
.github/workflows/mirror.yml#L15-L15(this comment).github/workflows/scorecard.yml#L17-L17🤖 Prompt for AI Agents
Source: Linters/SAST tools