Fix/docs presence GitHub dir - #1045
Merged
Merged
Conversation
Dependabot #977 (68acee7, merged 2026-09-22) bumped codeql-action from 4.38.0 back to 4.38.1 -- the version #973 had just escaped because it fails GitHub's workflow-startup validation estate-wide (nexia-list#100). Measured on hyperpolymath/standards within the hour: codeql.yml red from 12:09Z after four greens, scorecard.yml red from 11:51Z, and the newest run of each reports jobs=0. That is startup death, not a failing job; note GitHub surfaces it here as conclusion=failure, not startup_failure, because the death is in the called reusable. Five refs across three workflows went back to 1c5b675 (v4.38.1): codeql-reusable.yml init, analyze hypatia-scan-reusable.yml upload-sarif scorecard-reusable.yml upload-sarif x2 The first three are the more dangerous shape: #977 replaced the SHA but inherited #973's comment, so each line reads "@1c5b675... # v4.38.0 (4.38.1 blocked estate-wide)" -- an annotation asserting the exact opposite of the value it annotates. A reviewer reading the comment sees the safe version. scorecard-reusable.yml was never swept by #973 at all and kept honest "# v3" / "# v4.38.1" comments. Also widens the dependabot hold, which did not hold. The ignore entry named "github/codeql-action" while the workflows reference the subpath actions, and Dependabot treats github/codeql-action/init as its own dependency name -- #977's own body says "Updates `github/codeql-action/init` from 4.38.0 to 4.38.1". So the ignore matched nothing. The entry is now "github/codeql-action*". Without this the next scheduled run reopens the same PR and re-breaks both workflows. actions.lock is deliberately untouched: it already carried b96794f for all three workflows, so the lockfile was the correct side of the drift and the workflows were the stale side. Regenerating it instead -- the cure the gate's own error text prescribes -- would have written 1c5b675 back into the lock and re-legitimised the blocked version. Verified: zero refs to 1c5b675 remain under .github/; the actions-lock gate reports no error-severity and no stale findings (93 pre-existing sha-as-ref warnings are unchanged); git diff on actions.lock is empty. Refs: #973, #977, nexia-list#100, nexia-list#101, nexia-list#104 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WPSJ7fBhVAMcpSffCBWUDo Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
check-docs-presence.sh searched only the repository root for CONTRIBUTING, while estate repos have been deliberately relocating the file to .github/ -- the location GitHub itself auto-discovers (launch-scaffolder d426ea4d: "the estate canonical location is .github/CONTRIBUTING.md, which GitHub auto-discovers"). The gate and its consumers were therefore asking different questions, and the gate lost. Census of 516 local clones on 2026-09-22: 401 repos carry CONTRIBUTING at the root, 96 under .github/, 1 under docs/, and 94 have none anywhere. So 19 unique repos were being reported missing a document they demonstrably have, against 94 genuine misses. This widens WHERE the gate looks without widening WHAT it asks: the 94 still block. Also corrects the failure message, which named only the root locations and so prescribed a cure narrower than the code accepts (cf. standards#930). Tests: four new accept cases, one per added path, plus an anti-overreach case proving a CONTRIBUTING at an undiscoverable depth still BLOCKS -- that one guards against a future 'fix' by recursive find, which would silently pass all 94. Suite 29/29. Mutants killed, both leaving the pre-existing cases green: gate fully reverted -> the 4 new accept cases fail only .github/CONTRIBUTING.md added -> 3 fail (each path load-bearing) Real-world controls: launch-scaffolder rc=0 (was the reported miss), standards itself rc=0 via 3-practice/, cicd-suite rc=1 (genuine miss). Refs: hyperpolymath/launch-scaffolder#37 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WPSJ7fBhVAMcpSffCBWUDo Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Contributor
|
Warning Review limit reachedNext included review available in 50 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
enabled auto-merge (squash)
September 23, 2026 09:30
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #
Type of change
How has this been verified?
Checklist
git commit -S).SPDX-License-Identifier(code/configMPL-2.0,prose
CC-BY-SA-4.0); I did not relicense existing files.Notes for reviewers