fix(main-red-round3): map drift repair + WH004-path asana ack - #959
Conversation
- standards-map.toml: repair drift the map gate caught. #851 moved root .well-known/ to www/.well-known/ but the map still listed the root path (assertion 1) and never mapped www/ (assertion 2); the #947 squash added SECURITY.md, also unmapped. Replace the stale .well-known entry with www/ (migration wrapper note) + add SECURITY.md; entry_count 122 -> 123. All 5 assertions pass locally. - .hypatia-baseline.json: 211 -> 212. The real scanner emits invalid_actions_lock TWICE (verified by running Hypatia locally): workflow_audit (file actions.lock, acked in the previous commit) and WH004 standalone (rule_module workflow_hardening, full path). Ack the second path; same root cause and exit criteria (#951). Ratchet-exception: .hypatia-baseline.json — second ack for the same asana float-transitive, other emission path (#951).
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (14)
🔇 Additional comments (2)
📝 SummarySummary by CodeRabbit
WalkthroughThe pull request updates the standards map for the ChangesStandards metadata
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Bug fix Suggested reviewers: Merge Risk: ⚪ Minimal · up to The change updates standards metadata for the .well-known migration, adds SECURITY.md coverage, and records the known workflow baseline. No production behavior is changed, so it is ready to merge with normal checks. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks the map at dawn Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
1 participant
Round 3. #954 merged as 9c256b6 (with its 3 known failures); this PR carries the two fixes that landed after the merge, rebased onto main+9c256b67 (+#948, +#952):
wwwunmapped since chore(www): migrate root .well-known/ to www/.well-known/ #851,SECURITY.mdunmapped since the fix(main-red): repair the post-#899 red main (code + baseline triage + regen) #947 squash,.well-knownentry stale since chore(www): migrate root .well-known/ to www/.well-known/ #851): replace withwww/+SECURITY.mdentries, entry_count 122 -> 123. All 5 assertions pass locally.invalid_actions_lockTWICE (verified by building Hypatia locally and scanning this tree):workflow_audit(acked in round 2) and WH004 standalone (rule_module workflow_hardening, full path — acked here, 211 -> 212, same hypatia invalid_actions_lock: asana/push-signed-commits floats setup-python@v2 transitive #951 root cause).Also verified by local full-fidelity scan (194 findings, token-enabled): the only unacknowledged findings are CI-invisible (git-state dirty-tree + code-scanning-alert echoes that need a live PAT — see #957 for the PAT-refresh tripwire). #948/#952 introduce zero new findings.
Local battery: debt run 0 breached, map rc=0, uses-lock clean, registry in sync, both ratchets OK, gate keeps nothing CI-visible.