fix(standards): unblock commits, repair the lockfile, gate it in CI

[hyperpolymath]

What this is

Four commits that take standards from "cannot accept any commit through its own
hooks" to "the lockfile is repaired and a gate stops it drifting again".

They are ordered because each one unblocks the next.

	commit	effect
1	8b5c9f2	unblocks commits — two staged-mode validator defects
2	e4f6e55	re-keys codeql-action — un-poisons every caller
3	a85c0a1	onboards check-suite-monitor.yml, never locked at all
4	75fea61	adds the uses ⊆ actions.lock gate, in CI as well as pre-commit

1 — The deadlock (8b5c9f2)

Two gates in .githooks/pre-commit could not both be satisfied:

• build-registry.sh --check failed every commit until you regenerated and staged
  .machine_readable/REGISTRY.a2ml;
• validate-a2ml.sh then rejected that very file.

No ordering satisfied both. --no-verify was the only exit, which is why nothing in
.githooks was really enforcing anything.

Separately, validate-spdx.sh applied its extension allowlist in scan mode but not in
staged mode, so any commit touching a non-source file — including the machine-generated
actions.lock — was judged by a rule written for source files and failed.

Cures: exempt files whose own header says GENERATED FILE ... DO NOT EDIT BY HAND (anchored
regex, so prose cannot spoof it), and apply the same extension predicate in both modes.

2 — The estate-wide poison (e4f6e55)

GitHub validates a reusable workflow against the callee repo's own actions.lock.

Dependabot bumped github/codeql-action from cdf488f5 to b96794f0 inside
codeql-reusable.yml, scorecard-reusable.yml and hypatia-scan-reusable.yml and never
regenerated the lockfile. So every repo calling those three failed — failure, not
startup_failure, 0 jobs, name == path, and no reason in either the REST or the GraphQL
payload; only the run page says why. actionlint passes on the files either way.

One lockfile commit repairs all of them.

3 — A workflow that was never locked (a85c0a1)

check-suite-monitor.yml had no section in the lockfile at all. Same class, different
cause: not a bump that skipped the lock, but a workflow added without one.

security-gate-pr-target.yml is the other unlocked workflow and is deliberately left
alone — see doctrine below.

4 — The gate (75fea61)

Every validator in .githooks ran only in pre-commit, and no workflow invoked any of
them. Dependabot never runs pre-commit, so it bypassed the entire suite. That is the actual
root cause, and it needs CI, not a hook.

Why not gh actions-lock --verify-local

Measured on v0.1.6, and both findings are why the new check is hand-written:

• It writes. It rewrote uses: ./.github/actions/signed-push to the invalid
  uses: $/.github/actions/signed-push — a ref that kills the workflow at startup — while in
  a mode its own help text calls read-only and "ideal for pre-commit hooks".
  --no-migrate-local-actions suppresses it, but then the tool stops descending into local
  composite actions and misreports their real dependencies as stale.
• Its coverage is repo-scoped, not SHA-exact. Bump one of a workflow's two refs to the
  same action and the old key is still referenced by the other: nothing stale, nothing
  missing, check green, workflow broken.

Mutation-tested, not merely run

mutant	rc
M1 partial bump — the one the tool misses	1	KILLED
M2 full Dependabot-shaped bump	1	KILLED
M3 new unlocked action added	1	KILLED
M4 lockfile key deleted	1	KILLED
M6 empty lockfile (parser control)	1	KILLED
N1 case flip Swatinem → SWATINEM	0	green, correct
N2 reusable-workflow ref bumped (out of scope)	0	green, by design

The script states its scope rather than implying it, prints how many refs it checked so a
silent collapse to zero is visible, and fails closed on a parse: an empty lockfile reports a
parser failure, never "every ref is missing".

Deliberately not fixed here

Two refs stay absent from the lockfile by doctrine, allow-listed in data with reasons:

• denoland/setup-deno@22d081ff (governance-reusable.yml) — the estate is bun-only;
  deno is banned. Keying it would make a banned runtime a required lockfile key for every
  caller. The cure is to remove the consumer, not to satisfy it.
• hyperpolymath/a2ml-ecosystem/secrets-check-action@f7a40a4d
  (security-gate-pr-target.yml) — A2ML is dead; do not connect new machinery to it.

An allow-list entry that stops being used is reported as stale, so the list cannot rot.

Also untouched, and worth separate issues:

• 215 pre-existing SPDX header failures in scan mode (unchanged by this PR — scan mode
  was already red at HEAD, and my patched output is byte-identical).
• validate-a2ml.sh's agent-id / pedigree checks match 0 of 222 tracked files in
  both syntaxes — a requirement nothing satisfies.
• run_validator returns 0 when a validator file is missing — a silent skip that reads green.
• gh actions-lock prepends a duplicate "managed by gh actions-lock" banner above the SPDX
  line on every run (its idempotence check reads only line 1; scorecard-reusable.yml already
  carries it on both line 1 and line 3). Those cosmetic hunks were reverted so each lockfile
  commit touches the lockfile alone.

What this gate does NOT catch -- stated, not implied

• Membership is global, not per-workflow-section. The lockfile groups keys under a
  section per workflow, which implies GitHub validates per section; this check only asks
  whether a ref appears somewhere in the lock. A workflow carrying SHA-pinned refs but
  no lock section of its own therefore passes. check-suite-monitor.yml was caught here
  only because github-script was globally absent -- had it used checkout alone, it
  would have gone undetected. Narrowing to per-section membership is a separate change.
• Tag refs are out of scope (validate-sha-pins.sh owns that question), as are
  reusable-workflow refs, which the lockfile keys no entry for at all.

Control

Every lockfile commit was made with the *.yml diff empty — verified with
git diff --stat -- '.github/workflows/*.yml' — because this tool is known to de-pin SHAs to
tags and invent invalid local-action refs when it rewrites workflows.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HfgwLCdKNd5iZVo6VTiSim

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 99562238-0dbd-462c-bd73-4ce569c14d46

📥 Commits

Reviewing files that changed from the base of the PR and between 317101e and 8b5c9f2.

📒 Files selected for processing (3)

• .githooks/validate-a2ml.sh
• .githooks/validate-spdx.sh
• .machine_readable/REGISTRY.a2ml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: Repo self-tests

⚠️ CI failures not shown inline (6)

GitHub Actions: Secret Scanner / 0_scan _ rust-secrets.txt: fix(hooks): unblock commits blocked by staged-mode validator defects

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

---

GitHub Actions: Secret Scanner / scan _ rust-secrets: fix(hooks): unblock commits blocked by staged-mode validator defects

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

---

GitHub Actions: Secret Scanner / 1_scan _ shell-secrets.txt: fix(hooks): unblock commits blocked by staged-mode validator defects

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

---

GitHub Actions: Secret Scanner / scan _ shell-secrets: fix(hooks): unblock commits blocked by staged-mode validator defects

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

---

GitHub Actions: Secret Scanner / 2_scan _ gitleaks.txt: fix(hooks): unblock commits blocked by staged-mode validator defects

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# fetch-depth: 0 on the checkout is load-bearing HERE. If it ever�[0m
 �[36;1m# regresses to the default depth-1 clone, detect would walk a single�[0m
 �[36;1m# commit, find nothing and report a pass — a gate that cannot fail.�[0m
 �[36;1m# Assert completeness from git itself: gitleaks' own "scanned N�[0m
 �[36;1m# commits" line under-reports and is not proof of depth.�[0m
 �[36;1mif [ "$(git rev-parse --is-shallow-repository)" != "false" ]; then�[0m
 �[36;1m  echo "::error::checkout is shallow -- a history scan here would be vacuous; refusing to report a pass"�[0m

---

GitHub Actions: Secret Scanner / scan _ gitleaks: fix(hooks): unblock commits blocked by staged-mode validator defects

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# fetch-depth: 0 on the checkout is load-bearing HERE. If it ever�[0m
 �[36;1m# regresses to the default depth-1 clone, detect would walk a single�[0m
 �[36;1m# commit, find nothing and report a pass — a gate that cannot fail.�[0m
 �[36;1m# Assert completeness from git itself: gitleaks' own "scanned N�[0m
 �[36;1m# commits" line under-reports and is not proof of depth.�[0m
 �[36;1mif [ "$(git rev-parse --is-shallow-repository)" != "false" ]; then�[0m
 �[36;1m  echo "::error::checkout is shallow -- a history scan here would be vacuous; refusing to report a pass"�[0m

🔇 Additional comments (3)

.githooks/validate-a2ml.sh (1)

14-22: LGTM!

.githooks/validate-spdx.sh (1)

10-25: LGTM!

Also applies to: 41-41

.machine_readable/REGISTRY.a2ml (1)

66-66: LGTM!

Also applies to: 129-129, 210-210

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes

  • Validation now recognises generated manifests and avoids applying manual-edit checks to them.
  • SPDX checks now apply only to supported source files, preventing irrelevant validation failures.

• Chores

  • Updated the machine-readable registry index to reflect current source contents for three specifications.

Walkthrough

The A2ML validator now skips marked generated manifests. The SPDX validator now checks only recognised source files. The registry updates source hashes for three existing specifications.

Changes

Validation and registry updates

Layer / File(s)	Summary
Validation rule updates .githooks/validate-a2ml.sh, .githooks/validate-spdx.sh	Generated A2ML files with the defined header bypass validation. Staged non-source files no longer require SPDX headers.
Registry source-hash updates .machine_readable/REGISTRY.a2ml	The meta-a2ml, 0-ai-gatekeeper-protocol, and rhodium-standard-repositories entries receive updated source_hash values. No entries are added or removed.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: joshuajewell

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarises the main changes: it unblocks commits, repairs the lockfile, and adds CI enforcement.
Description check	✅ Passed	The description is directly related to the changeset and provides detailed context for the validator fixes, lockfile repair, CI gate, scope, and testing.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the headers bright
Generated pages skip the fight
Source files keep their SPDX sign
Three registry hashes now align
The burrow builds with cleaner light}

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
16 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud