fix(governance): actions-lock-verify as its own context; advisory jobs cannot fail silently (step 2a) - #718
Merged
Conversation
…s cannot fail silently (step 2a)
Behaviour-only repairs to governance-reusable.yml. No job name or
caller id changes: every live ruleset types "<job id> / <job name>",
so a rename would turn a required context into a phantom estate-wide.
tests/test_governance_reusable_shape.sh freezes the 15 names.
- New job `Actions lockfile verify` (actions-lock-verify). It fetches
scripts/check-actions-lock-gate.sh + update-actions-lock.sh from
standards at `job.workflow_sha` (the reusable's own pin, one speed
of propagation) instead of running them from the consumer's cwd,
which is why "Workflow security linter" died with exit 127
("scripts/update-actions-lock.sh: No such file") on every consumer.
Lock present -> `gh actions-lock --verify-local`, rc propagated.
Lock absent + unpinned uses -> fail. Lock absent + all SHA-pinned ->
warning until ENFORCE_ACTIONS_LOCK_FROM (2026-10-01), error after.
11 fixture cases incl. a planted positive (stub verifier exit 1 ->
gate exit 1).
- workflow-lint no longer carries the lock check (one context, one
cause).
- Every job honours inputs.runs-on (two were hardcoded).
- Live Actions policy: "not evaluated" is a ::warning, not a ::notice.
- Security policy: weak-crypto and http findings say ADVISORY in the
message; hardcoded secrets say they FAIL the job.
- gates.json: "Live Actions policy (credentialed advisory)" and
"Code quality + docs" join never_required_contexts; match rule and
context-freeze note recorded.
- Spec §14: fold table for the estate policy files (step 2f).
Known: actionlint reports `job.workflow_sha` as undefined; it is
undocumented but populated with the called reusable's SHA (verified on
consumer runs pinned at 571cc73). scripts/tests/wave3-scorecards-test.sh
fails 2/9 on unmodified main too (pre-existing, not touched here).
|
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (6)
📝 SummarySummary by CodeRabbit
WalkthroughThe reusable governance workflow now uses caller-selected runners, explicit advisory annotations, and a dedicated action-lock verification job. New policy documentation, a lock-gate script, and structural Bash tests define and validate the updated governance behaviour. ChangesGovernance workflow regularisation
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant CallerRepository
participant governance-reusable
participant check-actions-lock-gate.sh
participant update-actions-lock.sh
CallerRepository->>governance-reusable: invoke reusable workflow
governance-reusable->>CallerRepository: checkout repository and pinned standards scripts
governance-reusable->>check-actions-lock-gate.sh: run action-lock gate
check-actions-lock-gate.sh->>update-actions-lock.sh: verify existing actions.lock
update-actions-lock.sh-->>check-actions-lock-gate.sh: return verification result
check-actions-lock-gate.sh-->>governance-reusable: return gate status
Poem
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Behaviour-only repairs to governance-reusable.yml. No job name or
caller id changes: every live ruleset types " / ",
so a rename would turn a required context into a phantom estate-wide.
tests/test_governance_reusable_shape.sh freezes the 15 names.
Actions lockfile verify(actions-lock-verify). It fetchesscripts/check-actions-lock-gate.sh + update-actions-lock.sh from
standards at
job.workflow_sha(the reusable's own pin, one speedof propagation) instead of running them from the consumer's cwd,
which is why "Workflow security linter" died with exit 127
("scripts/update-actions-lock.sh: No such file") on every consumer.
Lock present ->
gh actions-lock --verify-local, rc propagated.Lock absent + unpinned uses -> fail. Lock absent + all SHA-pinned ->
warning until ENFORCE_ACTIONS_LOCK_FROM (2026-10-01), error after.
11 fixture cases incl. a planted positive (stub verifier exit 1 ->
gate exit 1).
cause).
message; hardcoded secrets say they FAIL the job.
"Code quality + docs" join never_required_contexts; match rule and
context-freeze note recorded.
Known: actionlint reports
job.workflow_shaas undefined; it isundocumented but populated with the called reusable's SHA (verified on
consumer runs pinned at 571cc73). scripts/tests/wave3-scorecards-test.sh
fails 2/9 on unmodified main too (pre-existing, not touched here).