Repository navigation
fix: 2026-09-17 issue-triage batch — repair committed conflict markers, finish banner dedup, unbreak the mint path, align Deno policy - #105
Merged
Conversation
added 4 commits
September 17, 2026 18:59
…y.yml PR #100 (f7527ed) committed an unresolved three-way conflict into this workflow: nested <<<<<<< / ======= / >>>>>>> markers at lines 43-51. The file is not valid YAML, so the workflow has failed on every push to main since it landed (witness: run at 2026-09-17T17:52, conclusion=failure). Both sides of the conflict carried the same action ref (hyperpolymath/smtp-notify-action@v0.3.0); they differed only in the NOSONAR pin-authority comment. Resolved to the single pre-corruption line from b80b3dd, with one correction: the comment cited sha1-ede1191e..., but actions.lock now records sha1-22e7bdb3... for v0.3.0 (moved by the actions-group bump in e8764e7). A comment whose sole purpose is to cite the lock must cite the lock's current value. Verified: file parses as YAML; no conflict markers remain repo-wide.
…lows Issue #56 item 2 flagged a duplicated '# This workflow is managed by gh actions-lock.' banner in scorecard.yml. PR #101 de-duplicated exactly one file (dogfood-gate.yml); the defect is estate-template-wide: 24 of 36 workflows carried 2-3 identical copies of the banner in their header block (scorecard.yml and quality.yml had three). The repeated line is an artifact of the lockfile regime inserting its banner on every pass without checking for an existing one. Duplicates are removed keeping the first occurrence, so each file now states the management fact exactly once. No non-comment line is touched; all 36 workflows still parse as YAML. Fixes the remaining open item of #56 (items 1 and 3 were fixed by #59 and by empty-linter.yml respectively).
…cripts Issue #62: Python is banned estate-wide (standards hypatia-rules rsr-self-compliance.a2ml: 'Python banned'; CLAUDE.md deny list). PR #80 ported scripts/strip-instruction-blocks.py and scripts/prune-dependabot-ecosystems.py to Ruby and added tests/workflows/mint_cleanup_test.sh exercising the .rb interfaces — but left the mint path pointing at the deleted .py files: build/just/repo-init.just:325 python3 scripts/strip-instruction-blocks.py . build/just/repo-init.just:340 python3 scripts/prune-dependabot-ecosystems.py ... Both invocations now fail (no such file), so 'just repo-init' — the one command every minted repo starts from — is broken on main. This also keeps a banned-language call site in the template every mint inherits. Additionally, the LEFTOVER_BLOCKS exclusion regexes in repo-init.just and tests/e2e/template_instantiation_test.sh still exempted the .py path. Exempting a file that no longer exists while the .rb port (which necessarily contains the literal marker string) is NOT exempted would make the post-mint check flag the stripping tool itself. Interfaces are identical (dir arg / file+keep args), verified against mint_cleanup_test.sh. Remaining .py references repo-wide: none.
…g (standards#655) Issue #70's residue. The original gate failure is long fixed (the line no longer matches the standards typescript_runtime regex — re-verified), but CLAUDE.md still called Deno 'grandfathered' — the exact word the owner ruling of 2026-08-26 repudiates ('deno is to go and bun is the way we are going'). This template's own runtime-policy.yml already encodes the ruling ('Deno is BEING REMOVED, not grandfathered … canon standards#655'), so the two documents this template ships disagreed with each other. Also repoints two dead .hypatia-ignore exemptions at the files that actually exist: - RE001 boj-build.yml -> build-notification.yml (renamed; workflow 'BoJ Server Build Trigger') - RE005 wellknown-enforcement.yml -> dot-wellknown-enforcement.yml Path fragments are substring matches against repo-relative paths, so both old entries could never match and the reviewed exemptions were silently inert. Verified: every fail-pattern in standards tools/policy/check-language-policy.sh re-run against the edited CLAUDE.md — none fire.
Contributor
|
Warning Review limit reachedNext included review available in 35 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (28)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This was referenced Sep 17, 2026
hyperpolymath
added a commit
that referenced
this pull request
Sep 17, 2026
…ebangless planted control (#110) Two small repairs for red gates on `main` left in the wake of the 2026-09-17 triage batch (#105/#106). Independent commits; both verified locally against current `main`. ## 1. `fix(ci)`: merge the duplicated `permissions:` block in main-estate-audit.yml — Governance gate Fixing the conflict markers in `push-email-notify.yml` (#105) let the Governance gate get past its first step ("Parse every tracked workflow") for the first time since #100 — and the *next* step immediately went red on a defect that had been hiding behind the parse failure: `main-estate-audit.yml` carried **two identical top-level `permissions: contents: read` blocks** — one from #92, a second (with the reusable-caller rationale comment) inserted below the `on:` block. **Fix:** merge into a single block, rationale comment preserved and hoisted above it. **Zero behaviour change** (YAML last-key-wins meant the second block was already the effective one). Verified: file parses; duplicate-key scan across all workflows repo-wide now reports none — the "Duplicate YAML keys in workflows" step should go green. **Not fixed here — escalated as an owner call:** the Workflow Security Linter's "Check SHA-Pinned Actions" failure is also in this file: ``` main-estate-audit.yml:22: hyperpolymath/cicd-suite/.github/workflows/main-estate-audit.yml@feat/cicd-workflow-call ``` The reusable call is **branch-pinned**. The owner is actively iterating that cicd-suite branch (Estate Rules failed there too before #108 fixed it), so pinning a SHA mid-iteration would freeze work in flight. Recommendation: once cicd-suite stabilises, pin to a SHA and add the `actions.lock` entry like every other reusable. This is the one gate that stays red after this PR, deliberately. ## 2. `fix(tests)`: shebang for the bad-deploy planted control — Code Quality gate `www/tests/controls/bad-deploy/tests/run-all.sh` (stage 4 of #106) ships the one-word body `planted` with no shebang. The repo-wide ShellCheck gate runs at **error severity** and flags SC2148 ("Add a shebang or a 'shell' directive") — so Code Quality went red on `main` the moment #106 landed. That one is squarely mine. **Fix:** add `#!/usr/bin/env bash`. The control's violation is its **path** (a `tests/` subtree inside a staged deploy tree); `check-publication-boundary.sh:129` never reads its contents. Re-verified after the edit: `www/tests/run-all.sh` → 6 checks, 0 failures, "planted bad stage rejected" still prints. ## Post-merge gate status (at `042d654`, before this PR) | gate | failing step | cause | disposition | |---|---|---|---| | Governance | Duplicate YAML keys | hidden since #92/#100, exposed by #105's parse fix | **fixed here (commit 1)** | | Code Quality | ShellCheck SC2148 | planted control from #106 | **fixed here (commit 2)** | | Workflow Security Linter | Check SHA-Pinned Actions | branch-pinned reusable → owner's cicd-suite work in flight | **escalated** | | Central Estate CI/CD Audit | (whole run) | same branch-pinned reusable call | **escalated** | No issue to close — documented here for the record, as with the conflict-marker defect in #105. Co-authored-by: hyperpolymath <hyperpolymath@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Batch from the 2026-09-17 issue triage. Four independently reviewable commits, rebased clean onto
750f0fe— the #103/#104 lockstep work is untouched (verified: both this branch's edits and #104's coexist indogfood-gate.yml).1.
fix(ci): resolve committed merge-conflict markers in push-email-notify.ymlUnfiled critical defect. PR #100 (
f7527ed) committed a nested, unresolved three-way conflict into.github/workflows/push-email-notify.yml(lines 43–51). The file has not been valid YAML since; the workflow has failed on every push to main (witness: run at 2026-09-17T17:52,conclusion=failure). Both sides carried the same ref (smtp-notify-action@v0.3.0); resolved to the single pre-corruption line fromb80b3dd, with the NOSONAR pin citation synced toactions.lock's current value (sha1-22e7bdb3…— the committed comment cited the pre-bumpsha1-ede1191e…, stale sincee8764e7). The #58/#73 guards around the damage are preserved intact.2.
fix(ci): finish the managed-by banner de-duplication across all workflows#56 item 2 flagged
scorecard.yml; #101 de-duplicated exactly one file (dogfood-gate.yml). The defect spans 24 of 36 workflows (2–3 identical banners each;scorecard.ymlandquality.ymlhad three). Mechanical de-dup keeping the first occurrence; all 36 re-verified to parse. Root cause worth a follow-up: the lockfile inserter is not idempotent — every pass adds a line.3.
fix(mint): repoint repo-init at the Ruby ports of the two ex-Python scripts#62 remainder. #80 ported
strip-instruction-blocks/prune-dependabot-ecosystemsto Ruby and addedtests/workflows/mint_cleanup_test.sh(re-executed here under ruby 3.3.8: PASS), but left the mint path calling the deleted.pyfiles:just repo-inithas been broken for every mint since #80. Also repoints the twoLEFTOVER_BLOCKSexclusion regexes (repo-init.just:721,template_instantiation_test.sh:258) that still exempted the vanished.pypath while the.rbport — which necessarily contains the literalTEMPLATE INSTRUCTIONSmarker — was not exempted: the post-mint check would have flagged the stripping tool itself.4.
docs(policy): align CLAUDE.md Deno status with the closed owner ruling (standards#655)#70 remainder. The filed gate failure is stale (the
typescript_runtimeregex no longer matchesCLAUDE.md— re-verified), butCLAUDE.mdstill said "Deno (grandfathered)" — the exact word the 2026-08-26 ruling repudiates — while this repo's ownruntime-policy.ymlenforces "BEING REMOVED, not grandfathered (canon standards#655)". Canon-side companion PR: hyperpolymath/standardsdeno-row-655-completion(linked below) — merge together. Every fail-pattern ofstandards/tools/policy/check-language-policy.shre-run against the editedCLAUDE.md: none fire. Same commit repoints two dead.hypatia-ignoreexemptions (boj-build.yml→build-notification.yml;wellknown-enforcement.yml→dot-wellknown-enforcement.yml; substring fragments could never match the renamed files).Verification (local)
.pyreferences to the ported scriptstests/workflows/mint_cleanup_test.sh(ruby 3.3.8)check-language-policy.shfail-patterns vs editedCLAUDE.md.hypatia-ignorefragments resolve to existing filesCloses #56 (items 1 & 3 fixed earlier by #59 /
empty-linter.yml; item 2 by commit 2 here).Closes #62 (port + tests landed in #80; call sites and exclusions fixed here).
Closes #70 (template side here; canon side in the standards PR; the RSR-spec inversion and ai-instruction examples are escalated there as owner calls).
A follow-on stacked PR (www/ site-operations bundle, #53 stages 1–4) is based on this branch.