From 9de66dad98e843867373e9f78dc8fcce1028e39b Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 22 Sep 2026 11:42:14 +0100 Subject: [PATCH] fix(ci): remove the duplicate 'with:' block from six workflows (#822) Dependabot's #810 bump rewrote the dtolnay/rust-toolchain ref and ADDED a second `with:` block rather than editing the existing one, leaving uses: dtolnay/rust-toolchain@v1 with: toolchain: master <- orphaned, left behind with: toolchain: stable ... in place. Each affected step is fixed by deleting the orphaned first block. 12 deletions, 0 insertions, 2 lines per file. MEASURED, NOT ASSUMED --------------------- #822's body reports the symptom at ONE site (build-gossamer-gui.yml line 143). The gate reports SIX. An issue body is a dated record; the linter's own run log on 033193c lists: build-gossamer-gui.yml:143 ci.yml:43 quality.yml:118 release.yml:129 security-policy.yml:41 tests.yml:81 and prints its denominator: "6 of 32 workflow file(s) contain duplicate keys." All six are the same mechanical shape, so #822's acceptance criterion 5 (sweep the other #810 workflows) is discharged by fixing all six here rather than one. THE MUTANT IS ALREADY DEAD -------------------------- Ran the gate's own script, scripts/check-workflow-duplicate-keys.sh from hyperpolymath/standards, against both trees locally: origin/main 7e1f9fd -> rc=1, "6 of 32 workflow file(s) contain duplicate keys." this branch -> rc=0, "duplicate-key check: 32 workflow file(s) clean" Same script, same invocation, red and green, denominator printed in both directions. Reverting this commit reproduces the red, which is what criterion 4 asks for. Note why no ordinary linter caught this: the script's own header states that conventional YAML parsers silently keep the LAST duplicate and report success. Confirmed here -- yq accepted all 32 files including the six defective ones, so a yq-based check would have been vacuous. CRITERION 2 DELIBERATELY NOT IMPLEMENTED ---------------------------------------- #822 also asks that dtolnay/rust-toolchain be pinned to a commit SHA. Not done, deliberately: - dtolnay/rust-toolchain@v1 appears at 22 sites across 8 workflows. Converting the 1 site in build-gossamer-gui.yml would leave it inconsistent with 21 identical siblings and create the appearance of compliance without it. - hypatia's convention is symbolic refs, measured 40 tag/ref to 8 SHA. - .github/workflows/actions.lock ALREADY records the resolved commit for 'dtolnay/rust-toolchain@v1' (sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de), and that lockfile gate is green as of #823. The tag is pinned by the lock; a literal SHA at one call site would desynchronise it from the lock's key. Raised as its own issue covering all 22 sites instead. NO uses: LINE IS CHANGED ------------------------ Verified: 0 'uses:' lines appear in the diff and actions.lock is not modified. This is deliberate -- it makes this PR the clean control for #818's remaining acceptance criterion, that the lockfile verify is still green on a SUBSEQUENT UNRELATED PR and not an artefact of #823's own merge commit. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0113HQM9LVGkNCzU1WwkJZSV --- .github/workflows/build-gossamer-gui.yml | 2 -- .github/workflows/ci.yml | 2 -- .github/workflows/quality.yml | 2 -- .github/workflows/release.yml | 2 -- .github/workflows/security-policy.yml | 2 -- .github/workflows/tests.yml | 2 -- 6 files changed, 12 deletions(-) diff --git a/.github/workflows/build-gossamer-gui.yml b/.github/workflows/build-gossamer-gui.yml index 25c7c4c9..ea967e0f 100644 --- a/.github/workflows/build-gossamer-gui.yml +++ b/.github/workflows/build-gossamer-gui.yml @@ -138,8 +138,6 @@ jobs: - name: Setup Rust (stable) with wasm32 target uses: dtolnay/rust-toolchain@v1 - with: - toolchain: master with: toolchain: stable targets: wasm32-unknown-unknown diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6fb3a3ea..31251f22 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -38,8 +38,6 @@ jobs: - name: Install Rust toolchain uses: dtolnay/rust-toolchain@v1 - with: - toolchain: master with: toolchain: stable components: clippy, rustfmt diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index 77d77b35..75a5ec16 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -113,8 +113,6 @@ jobs: # shell-piped installer — satisfies the download_then_run policy. - name: Setup Rust toolchain uses: dtolnay/rust-toolchain@v1 - with: - toolchain: master with: toolchain: stable components: rust-docs diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 110e4cac..9c25fc50 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -124,8 +124,6 @@ jobs: - name: Install Rust toolchain uses: dtolnay/rust-toolchain@v1 - with: - toolchain: master with: toolchain: stable targets: ${{ matrix.target }} diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml index f1d3bf48..41b11100 100644 --- a/.github/workflows/security-policy.yml +++ b/.github/workflows/security-policy.yml @@ -36,8 +36,6 @@ jobs: - name: Install Rust toolchain uses: dtolnay/rust-toolchain@v1 - with: - toolchain: master with: toolchain: stable diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 68b395db..b17cfee0 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -76,8 +76,6 @@ jobs: - name: Install Rust toolchain uses: dtolnay/rust-toolchain@v1 - with: - toolchain: master with: toolchain: stable