feat(ci): propagate-hypatia-caller-id — standardise the wrapper caller id, audited - #877
Merged
Merged
Conversation
…r id, audited The check a reusable-caller job publishes is `<caller job id or name> / <inner job display name>`. The estate's canonical required context is `hypatia / Hypatia Neurosymbolic Analysis`; in 202 of the 274 repositories that have a scan wrapper the caller is named `scan`, so they publish `scan / Hypatia Neurosymbolic Analysis` instead. Two names for one gate: an arming decision that picks the wrong one is unsatisfiable, which is the class tropical-types#17 belongs to. Adds the standards-side action that settles it, mirroring the shape of scripts/propagate-workflow-pins.sh: * audit by default, one tab-separated line per repository; * --fix stages the rename in the consumer checkout — one job key, nothing else; the pin, the inputs and `secrets: inherit` are untouched byte-for-byte; * requirement-aware: a repository whose rules name the old prefixed string is reported BLOCKED and refused under --fix, because the rename and the requirement must move together; * honest about blindness: when the requirement set cannot be read (no API, offline, multi-repo path) the verdict is UNVERIFIED and --fix refuses. Never rename on an unread requirement set; * never commits, never pushes (estate guardrail: no unattended mutations). Fixture suite scripts/tests/propagate-hypatia-caller-id-test.sh drives fifteen branches against synthetic repositories with no network and no token: canonical, stage, blocked-but-untouched, absent, unchanged-shape, key-only rewrite, pin and secrets preserved, idempotent, and both refusal paths. Scope measured with a read-only pass over all 365 non-archived public repositories on 2026-09-20: 274 wrappers (202 `scan`, 72 `hypatia`), of which 7 require the old prefixed form in a ruleset and must update the rule in the same change.
Contributor
|
Warning Review limit reachedNext included review available in 40 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The standards-side action for standardising the Hypatia wrapper's caller job id, in the shape of
scripts/propagate-workflow-pins.sh: audit by default,--fixstages, never commits, never pushes.Why
The check a reusable-caller job publishes is
<caller job id or name> / <inner job display name>. The estate's canonical required context ishypatia / Hypatia Neurosymbolic Analysis. Measured read-only across all 365 non-archived public repositories on 2026-09-20:scanhypatiascan / Hypatia Neurosymbolic AnalysisTwo names for one gate is a trap for the next arming decision: a rule written against the form a repository does not publish is unsatisfiable, which is the class
tropical-types#17belongs to.Behaviour
canonical | stage | BLOCKED | UNVERIFIED | unchanged-shape | absent;--fixrewrites exactly one job key. The pin, the inputs andsecrets: inheritare untouched byte-for-byte (the fixture asserts a two-line diff);BLOCKEDand refused under--fix, because the rename and the requirement must move together;UNVERIFIEDand--fixrefuses — no rename on an unread requirement set;Verification
bash scripts/tests/propagate-hypatia-caller-id-test.sh— 15 branches, all pass (canonical, stage, blocked-and-untouched, absent, unchanged-shape, key-only rewrite, pin preserved,secrets: inheritpreserved, idempotent, both refusal paths).bash scripts/check-canonical-names.sh origin/main— clean./users/hyperpolymath/repos+ per-repo rulesets and branch protection.Related
Not a repair of anything currently broken — nothing in the estate is blocked by the drift today. This is the mechanism for the decision to publish one name, taken deliberately rather than by whoever arms the next rule.