main is CI-dead since #830: tests.yml startup_failure (jobs=0) and Actions lockfile verify red #837

Activity

1. github-actions

   added

   cicdCI/CD: workflows, actions, lockfiles, pins, runners, release gatesCI/CD: workflows, actions, lockfiles, pins, runners, release gates

   testingTests, benchmarks, fuzzing, property checks, coverageTests, benchmarks, fuzzing, property checks, coverage

   on Sep 22, 2026
2. hyperpolymath commented on Sep 22, 2026

   

   hyperpolymath

   on Sep 22, 2026

   OwnerAuthor

   More actions

   The startup death is four workflows, not one — and it hides a dead doctest tier

   Measured 2026-09-22 while landing #840. This issue names tests.yml; the same
   fault is live on four workflows on main:

   $ gh run list --repo hyperpolymath/hypatia --branch main --limit 40 \
       --json conclusion,name
   
   CI                                          startup_failure
   Security                                    startup_failure
   CodeQL Security Analysis                    startup_failure
   Tests (E2E / Integration / Stress / Bench)  startup_failure
   

   Reproduced identically on the fix/cargo-testcontainers branch, so it is a
   property of the tree, not of the main ref. This is consistent with the cause
   already identified here — the #830 pin bumps landed across five workflows,
   and this issue only followed one of them.

   The consequence worth naming: the only doctest run in the repo is dead

   Job-name mapping, measured from the workflow files:

   Workflow	Supplies	State
   rust.yml ("Rust CI")	Check, Test, Format, Clippy, Cargo check + clippy + fmt, Cargo test	runs
   quality.yml ("Docs & Code Quality")	Build AsciiDoc, Validate Documentation, …	runs
   ci.yml ("CI")	Rust Check & Clippy, Rust Format, Rust Tests, Rust Coverage, Haskell jobs, CI Status	startup_failure — none run

   ci.yml:98 is the only cargo test --doc in the entire repository:

   $ command grep -rn -- '--doc' .github/workflows/
   .github/workflows/ci.yml:98:  run: cargo test --workspace --doc
   

   Those doctests exist and pass — cargo test --workspace --doc locally on
   main @ 4fa2e39 reports 4 passed (integration/src/lib.rs,
   ci_simulation/{mod,scenarios,assertions}.rs). They execute nowhere in CI.
   Rust Coverage is likewise never produced.

   This is the same shape as #836 — a tier that exists, passes locally, and runs
   in no pipeline — reached by a different route. #836 is a needs:-skip; this is
   a startup death. Both are invisible in the checks list for the same reason: the
   absence of a check reads like nothing rather than like a failure.

   Suggested addition to the acceptance criteria

   • Whatever cures tests.yml must be verified on all four workflows, each
     evidenced by jobs > 0 on a real run — not by the workflow reappearing in
     the checks list.
   • After the cure, confirm cargo test --workspace --doc actually executes in
     CI and reports a non-zero denominator, so the doctest tier is provably live
     rather than merely present.

   Found while landing #840 (#838). Related: #836, #841.
3. hyperpolymath

   added 2 commits that reference this issue on Sep 22, 2026

   fix(ci): pin taiki-e/install-action v2.87.16 in actions.lock

   ...

   dccb065

   fix(ci): revive four startup-dead workflows -- codeql-action v4.38.0 …

   ...

   450734e
4. hyperpolymath commented on Sep 22, 2026

   

   hyperpolymath

   on Sep 22, 2026

   OwnerAuthor

   More actions

   Fixed by #842, squash-merged to main as 450734e
   (verified=true reason=valid).

   Root cause -- two faults, not four

   1. codeql-action pinned to the version its own comment forbids.
   #830 (chore(deps): bump the actions group) moved all 8 sites to
   1c5b675653bb5c22dbe9b12b556ec555138e09fd while leaving the trailing comment
   reading # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100). That SHA is
   v4.38.1, which GitHub refuses at workflow startup estate-wide. Reverted to
   b96794f015dfd88f77b49b1c93e0fa7110f94c63 (genuinely v4.38.0).

   A trailing version comment is not evidence of what is pinned.

   2. An unparseable actions.lock under sha_pinning_required.
   taiki-e/install-action@v2.87.16 was used while the lock pinned only
   v2.87.15, and the lock carried an entry whose full-40-hex key did not resolve
   to itself (codeql-action@1c5b675... claiming commit b96794f...). A
   self-contradicting entry makes the whole lockfile unreadable, which is why
   ci.yml and tests.yml died too although neither uses codeql-action.

   How it was localized

   actionlint reported zero errors and yq parsed all four files, and
   actions.lock already covered 32 of 32 workflows -- so neither the workflow
   files nor the "absent from the lock" cure applied. Comparing each workflow's
   normalized uses: refs against the lock (collapsing
   codeql-action/init@X and /analyze@X to codeql-action@X) implicated
   exactly the four dead workflows and no others.

   ⚠ gh actions-lock --no-fix exits 0 while printing lockfile is unreadable. Branch on the message, never the exit code.

   Verification on main @ 450734e

   All four previously 0-job / 0s startup deaths now produce jobs:

   Workflow	before	after
   CodeQL Security Analysis	0 jobs	2 jobs
   CI	0 jobs	6 jobs
   Security	0 jobs	14 jobs
   Tests (E2E / Integration / Stress / Bench)	0 jobs	6 jobs

   gh actions-lock --no-fix now scans 32 workflows with zero findings.

   What the cure surfaced

   Reviving tests.yml also repaired the needs: chain: Build Test Images
   passes, so Integration Tests executed and passed -- mix test has now run
   for the first time, which retires the premise behind #836.

   It also made End-to-End Tests run for the first time ever, and it fails --
   docker compose cannot find its configuration file, so the E2E suite is still
   skipped. That job was skipped on every run before the startup death and
   absent after, so it has never once executed. This is a first measurement of
   pre-existing breakage, not a regression from #842. Filed as #843.
   Integration Status is red purely as the rollup of that job.

   🤖 Generated with Claude Code

   https://claude.ai/code/session_0113HQM9LVGkNCzU1WwkJZSV
5. hyperpolymath

   closed this as completedon Sep 22, 2026