fix(ci): resync actions.lock after PR #66 and clear the SPDX gate - #70
Conversation
Measured CI result on this headThe acceptance criterion is met:
And the gate that was red on
⚠ Correction to my description above: the remaining red is NOT "the same set"I predicted no new failure names. That was wrong, and the mechanism is worth stating:
Everything else red is the out-of-scope set named in the description: missing 🤖 Generated with Claude Code |
PR #66 (dependabot actions-group) changed `uses:` in six workflows without touching .github/workflows/actions.lock. Refs absent from the lock are rejected at workflow load, so quality/codeql/coverage/oikosbot died with startup_failure (jobs=0, no logs); separately the existing entry for dtolnay/rust-toolchain@stable had gone unreachable after an upstream force-push, killing Rust CI, Cross-platform build and Fuzz Smoke in "Set up job". Regenerated the lock for the six bumped refs plus one transitive (actions/github-script via codecov-action) and re-pinned rust-toolchain. Also relax the workflow-linter SPDX gate from `head -1` to `head -5`: `gh actions-lock` prepends its own managed-by banner to line 1 on every fix run, pushing a correct line-1 SPDX header to line 2. The old predicate failed 33 of 35 workflow files for headers that are present and correct; the new one passes 35 of 35 while still rejecting a header-less file and a header below line 5. Verified: `gh actions-lock --verify` valid=true rc=0, 0 errors (was valid=false rc=1, 16 errors: 8 ref-changed + 8 unreachable-pin). The 3 remaining ref-moved warnings are the @main refs, left alone deliberately. Workflow bytes are unchanged apart from the linter. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YSq3UodR3CjsuAK5yoTzHF
1ca3b7c to
dade862
Compare
|
Badge removal split out of this PR. The OpenSSF Best Practices badge removal that was commit This branch has been rebased onto
🤖 Generated with Claude Code |
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe workflow linter now scans the first five lines of each workflow file for the SPDX header. Its failure message reflects the accepted header position. ChangesWorkflow SPDX validation
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~8 minutes Change: Bug fix Merge Risk: ⚪ Minimal · up to The workflow linter now accepts valid SPDX headers after the actions-lock banner while retaining placement validation. The change is mergeable. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)❌ Error committing Unit Tests locally.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
changed the title
|
Note Unit test generation is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Generating unit tests... This may take up to 20 minutes. |
|
🤖 Coding Agent task started for unit test generation. |
|
Note Unit test generation is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Generating unit tests... This may take up to 20 minutes. |
|
Failed to create Coding Agent finishing-touch task. |
…80) The `Check SHA-Pinned Actions` step in `workflow-linter.yml` demanded an inline 40-hex SHA on every action reference. This repo pins through `.github/workflows/actions.lock`, which binds a symbolic ref to a commit. The two regimes contradict each other, so that step could never go green. ## Measured, not assumed | | | |---|---| | action references on `main` | **93** | | violating the 40-hex predicate | **88** | | actually 40-hex pinned | **4** | | this workflow's own lock entry | `actions/checkout@v7.0.1` — a **tag**, which its own step would reject | ## Why deleted rather than softened A replacement predicate that reads the lockfile would be a third lock parser beside `gh actions-lock` and `scripts/check-lock-sync.sh`. A body that `exit 0`s would be a vacuous gate. The question is already owned and **green** elsewhere: the governance bundle's `Actions lockfile verify` job, whose step is literally named *"Verify actions.lock (or SHA pins during the grace window)"*. Retiring this step therefore leaves **no coverage gap**. ## The unmasking was pre-measured A job halts at its first failing step, so the four steps after this one have been `skipped` — **unknown, not passing** — on every run. Fixing an early step unmasks every later one, which is exactly what bit #70. Each was executed against the tree under a clean `bash -e` before this change: ``` rc=0 Check for Duplicate Workflows rc=0 Check CodeQL Language Matrix rc=0 Check Secrets Guards rc=0 Summary ``` `codeql-analysis.yml` and `rust-ci.yml` are both **absent**, so the only `exit 1` path among those four cannot fire. ## Scope - **No `uses:` line changes**, so `.github/workflows/actions.lock` needs no edit — this does not touch the file owned by #73, and does not conflict with it. - Net **−18/+6**: one step removed, a comment left in its place naming where the pinning question now lives. - `yq` parses the result; all seven surviving step bodies parse under `bash -n`. ⚠ For the later "require the checks" work: this workflow is **path-filtered** on `.github/workflows/**`, so its context can never be a required status check — it would block every PR that does not touch `.github/`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01YSq3UodR3CjsuAK5yoTzHF <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated workflow validation to rely on the centralized actions lockfile verification. * Removed the previous SHA-format validation step that conflicted with the lock-based verification approach. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
…ush (#84) Retires the a2ml-keyed manifest gates per owner ruling **D-B**, stops CodeQL firing on PR/push, and fixes one unambiguous defect that the retirement exposed. This is **PR 6a** — the first of a three-way split of the original PR 6. It contains only the parts that could be **fully pre-measured locally**; the hypatia gate (6b) and the Governance parse failure (6c) follow separately, because a five-part PR has five ways to be red and the standing ruling is to land only fully-green PRs. ## What changed, and why each **1. `verify-manifests.yml` — retire STATE / ECOSYSTEM / META (D-B).** Job *Verify Machine-Readable Manifest Currency* halted at step 3 on `.machine_readable/STATE.a2ml`, leaving steps 4–7 `skipped` — **unknown, not passing**. All three a2ml files are **absent**, so there is no content to move and nothing to preserve: only steps to remove. The requirement survives as issue #81 (re-express as `.deed`). Nothing new connects to a2ml. **2. `verify-manifests.yml` — repair a step that had never once executed.** Unmasking step 6 exposed a real defect in *Check TEMPLATE-STANDARDS-AUDIT.adoc currency*: ``` first line of the file : v1.2, 2026-07-26 old: sed 's/v//' → "1.2, 2026-07-26" compared against literal "1.2" → FAIL new: sed 's/^v//' | cut -d, -f1 | tr -d '[:space:]' → "1.2" → PASS ``` The document **is** v1.2, **is** dated 2026-07-26, and **does** reference DEP-09. The gate's own extraction was wrong, not the content — so this is an unambiguous defect fixed directly, per the 09-22 ruling. Both arms were measured against the real file; the old code is a working mutant control. **3. `openssf-compliance.yml` — same STATE.a2ml demand, three steps masked.** Step retired. The three a2ml filenames are also dropped from the placeholder-token list, where each was already guarded by `[ -f "$f" ]` and therefore inert. **4. `codeql.yml` — `workflow_dispatch:` only.** Org code-scanning config 256896 sets `allow_advanced: false`, so this workflow's SARIF is refused outright (*"analyses from advanced configurations cannot be processed when the default setup is enabled"*). Default-setup CodeQL runs separately, is **green**, and already satisfies the `code_scanning` ruleset rule. **The file is not deleted** — `actions.lock` keys an entry to it, and deleting it would orphan that entry and red the bidirectional `check-lock-sync.sh` arriving in #73. The rationale is recorded in-file so a later reader does not "restore" the trigger. ## Pre-measured, not predicted Deleting a failing step promotes whatever sat behind it to its **first real measurement**. All five newly-unmasked predicates were run locally against the real tree *before* pushing: | unmasked predicate | result | |---|---| | `Check TEMPLATE-STANDARDS-AUDIT.adoc currency` | ❌ → **fixed in this PR** (item 2) | | `Check reusable workflow pins` | ✅ both 40-hex and identical | | `Check CHANGELOG exists` | ✅ `CHANGELOG.md` present | | `Check no unfilled placeholder tokens` | ✅ 0 across 7 present files | | `Summary` | ✅ | ## ⚠ Scope — what this PR does *not* claim **This does not turn the `Verify Manifest Files` *workflow* green.** Its other job, *Verify AI-MANIFEST and README.adoc files*, fails **independently** on two missing `README.adoc` files whose cure lives on **PR #73's** branch. The assertion here is the job-level check-run **`Verify Machine-Readable Manifest Currency`**, not the workflow conclusion. Reading job 1's red as "D-B failed" would be a misreading. ## 🚨 Finding for #82 — a fourth settings.yml divergence `.github/settings.yml` declares `analyze (javascript-typescript, none)` as a required status check. That is the CodeQL **advanced** job's matrix name, which item 4 makes permanently unemittable. It is inert today only because the live ruleset carries **no `required_status_checks` rule at all** — which is precisely the drift #82 already tracks. Adding it there rather than silently working around it. ## Verification - `yq` parses all three files; `actionlint` clean. - SPDX header still within `head -5` on `codeql.yml` (the gate PR #70 relaxed). - `yq e '.on | keys'` on `codeql.yml` returns exactly `[workflow_dispatch]`. - Commit signed (`%G? = G`), satisfying `required_signatures`. - Assertion is **per step, not per job**. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01YSq3UodR3CjsuAK5yoTzHF Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
1 participant
What this fixes
mainis red, and the CI half of it traces to a single commit: PR #66, adependabot actions-group bump that changed
uses:in six workflows withouttouching
.github/workflows/actions.lock.That produced two distinct failure classes:
startup_failure(quality, codeql, coverage, oikosbot) — jobs=0, no logsfailurein "Set up job" (Rust CI, Cross-platform build, Fuzz Smoke)dtolnay/rust-toolchain@stablehas an entry, but its pin became unreachable after an upstream force-pushgh actions-lockprepends its managed-by banner to line 1, pushing a correct SPDX header to line 2; the gate washead -1-strictChanges
1.
actions.lockregenerated — six bumped refs onboarded plus one transitive:plus
dtolnay/rust-toolchain@stablere-pinned to the livestablecommit.2. SPDX gate relaxed
head -1→head -5inworkflow-linter.yml.Moving the header back to line 1 was considered and rejected: the tool
re-prepends its banner on every fix run, so that arm is re-broken by the
next lock regeneration. Relaxing the gate is the stable arm.
3. Badge 8509 removed from
README.adoc.bestpractices.dev/projects/8509resolves to "PA-updated-Weapon-Master", an unrelated MS-PL RPG game at
github.com/Isaiah0521/PA-updated-Weapon-Master. It was a false publicprovenance claim, corroborated by the open
CIIBestPracticesIDScorecard alert.Verification (matched pair, identical binary)
gh actions-lock --verifyvalid=false, rc=1, 16 errors (8ref-changed+ 8unreachable-pin)valid=true, rc=0, 0 errors--verify-local(the pre-commit path) is alsovalid=true, rc=0.The 3 remaining findings are
ref-movedwarnings on@mainrefs(
a2ml-ecosystem,k9-ecosystem,oikosbot) — deliberately left alone;re-pinning a moving
@mainis a separate decision.Workflow bytes were proven unchanged across the lock regeneration by
sha256 over
git ls-files -s .github/workflows/excluding the lock itself,so the only workflow edit in this PR is the linter predicate.
SPDX gate checked against a mutant control: old predicate fails 33/35,
new predicate passes 35/35, and a header-less file and a file with its
header at line 6 are both still rejected — the relaxed gate is not vacuous.
Deliberately NOT in this PR
Surfaced during recon, recorded, not actioned here: no
required_status_checksrule exists on
main(so every gate here is advisory, andRepositoryRole:alwayssits in the bypass list); the Coverage/CodeQL workflow badges and the
SOC 3 / ISO 27001 / CIAQ self-assertions; dependabot's npm entry hard-failing on a
missing
/package.jsonand cargo pointed at a rootCargo.tomlthat does notexist;
tests/e2e.sh:121calling an undefinedfail(hiding the real Zig error);Hypatia logging 198 findings as
##[error][hypatia] null; the Well-Known gatelooking at
.well-known/while content lives atwww/.well-known/.Expect the remaining red on
mainafter this lands to be exactly that set —no new failures.
🤖 Generated with Claude Code
https://claude.ai/code/session_01YSq3UodR3CjsuAK5yoTzHF
Summary by CodeRabbit