fix(ci): untrack vendored gossamer CI and drop a fabricated SHA from the docs - #86
Merged
Merged
Conversation
Contributor
|
Warning Review limit reachedNext included review available in 52 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (19)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…the docs `Governance Check / Workflow security linter` fails at its FIRST step, `Parse every tracked workflow`, which leaves five later steps `skipped` — unknown, not passing. This clears the parse failure and the one real defect that sat masked behind it. 1. Untrack `third_party/gossamer/.github/workflows/` (17 files). The gate delegates to `tools/policy/check-workflows-parse.sh`, which enumerates with `git ls-files -- '**/.github/workflows/*.yml'`. It scans TRACKED files, so untracking is the lever and no policy change is needed. `dogfood-gate.yml` is the single unparseable file in the repo: a `python3 -c` heredoc whose continuation lines sit at column 0 and escape their block scalar. paint-type neither owns nor runs gossamer's CI, and the other 26 vendored `.github/` files are left tracked. A `.gitignore` rule keeps a re-vendor from silently re-adding them. Checked before removing: no `.gitmodules` and no `git-subtree-dir` commit (plain vendored files, mode 100644); `actions.lock` has no `third_party` key, so nothing is orphaned for the lock-sync gate in #73; and nothing outside the vendored tree references `gossamer/.github`. 2. Remove a fabricated commit SHA from `.github/workflows/README.adoc`. Unmasking the parse step exposes `Check action pins resolve upstream`, which was ALREADY failing. Its script greps the whole of `.github/workflows/` for `uses: owner/repo@<40 hex>` with no filename filter, so it read an illustrative pin in prose as a real one: `actions/checkout@8e5e7e5ab8b370d3a0e0e70878d379440678a716 # v3.3.0`. That commit does not exist — `repos/actions/checkout/commits/<sha>` returns 422 "No commit found for SHA". The surrounding prose also asserted that actions "should be SHA-pinned to specific commits", which contradicts every real `uses:` line in the directory: they are tags, and `actions.lock` binds each to a commit. The section now describes the lockfile regime that is actually in force and warns against writing a 40-hex example into this directory again. Measured on this tree, one change apart (same bytes otherwise): step before after Parse every tracked workflow 1 0 Duplicate YAML keys 0 0 Check SPDX headers + permissions 0 0 Check action pins resolve upstream 1 0 Check for duplicate workflows 0 0 The pin gate goes from "1 of 3 action pins DO NOT EXIST upstream" to "All 2 verifiable action pin(s) resolve upstream". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YSq3UodR3CjsuAK5yoTzHF
hyperpolymath
force-pushed
the
fix/governance-untrack-vendored-workflows
branch
from
September 22, 2026 21:48
2549ee2 to
2f38608
Compare
Contributor
Author
CI verification at
|
| # | conclusion | step |
|---|---|---|
| 4 | success | Parse every tracked workflow |
| 5 | success | Duplicate YAML keys in workflows |
| 6 | success | Check SPDX headers + permissions |
| 7 | success | Checkout standards for the pin-existence gate |
| 8 | success | Check action pins resolve upstream |
| 9 | success | Check for duplicate workflows |
Steps 5–9 had never once executed on this repository: the job halted at step 4, so every
later step was skipped — unknown, not passing. Both defects this PR fixes were required
to get here; untracking the vendored tree alone would have left step 8 red.
Strict-subset proof, at job granularity.
| ref | failing jobs |
|---|---|
main@7217ca7 |
3 — Governance Check / Workflow security linter, Sustainability Analysis, Validate A2ML manifests |
PR@2f38608 |
2 — Sustainability Analysis, Validate A2ML manifests |
In PR but not in main: empty — no new failure introduced.
In main but not in PR: Governance Check / Workflow security linter — exactly this PR's target.
Checks overall: 56 success, 2 failure, both pre-existing.
The two remaining reds, each diagnosed and out of scope.
Sustainability Analysis(OikosBot) — its pinned container digest returnsmanifest unknown
from the registry. External to this repository; no edit here can cure it.Validate A2ML manifests— fails at step 1, "Set up job", i.e. action resolution:
dogfood-gate.yml:51useshyperpolymath/a2ml-ecosystem/validate-action@main. The job
carriescontinue-on-error: true(dogfood-gate.yml:31), which is why the Dogfood Gate
run concludessuccesswhile this job isfailure— a run-level green covering a red job.
Both become issues with acceptance criteria rather than blockers, per the standing ruling.
🤖 Generated with Claude Code
3 tasks
4 tasks
hyperpolymath
added a commit
that referenced
this pull request
Sep 24, 2026
…tions.lock drift killing CI (#106) ## Summary Closes the long-standing conflict in #102 by merging `chore/apply-foundation-ci-fixes-20260911` into current main **with every conflict resolved at source**, and fixes the CI/CD breakage that stale branch had masked: Dependabot #105 rewrote `uses:` refs without touching `actions.lock`, which is why **Coverage** and **OikosBot** die at startup (`startup_failure`, zero jobs) on main HEAD and **Governance / Actions lockfile verify** + **Lock Sync Gate** are red. ## Changes **Conflict resolution (15 conflicts, all resolved semantically, not textually)** - main's deliberately evolved state wins everywhere it later re-owned the ground: lockfile-owned pins (#80), retired A2ML gates (#84, #89), fail-closed Hypatia/static-analysis policy (#85), untracked vendored gossamer workflows (#86), the rewritten release pipeline (#91), current `hyperpolymath/standards@092deda` pin. - #102's still-valuable security intent is kept **on top of** main's refs: `persist-credentials: false` on the CodeQL checkout, removal of the dead `analyze (javascript-typescript, none)` required-status context, curated `.gitignore` additions (`zig-cache/`, OCaml artefacts, `.tool-versions`, `*.backup`). - Rejected as damaged: #102's mechanical word-stripping sweep, which corrupted prose ("OCaml/", "Posript", "No new , Python") **and shell logic** (`runtime-policy.yml`, dogfood-gate `find` excludes, pre-commit regex, release.yml's build-detect). Those files are restored to main's text; vendored `third_party/gossamer` is left untouched. - Funding consolidated into the canonical `.github/FUNDING.yml` (legacy duplicate-key file + lowercase twin dropped, invalid empty `indieweb` key removed); root `FUNDING` adoc retained. **CI/CD repair — `actions.lock` resync (the real source of the red gates)** - `codeql.yml` / `oikosbot.yml`: `github/codeql-action` v4.38.0 → v4.38.1 (`1c5b675`) - `coverage.yml`: `codecov/codecov-action` v7.1.0 → v7.1.1 (`303a32d`), `taiki-e/install-action` v2.87.13 → v2.87.17 (`94c31af`) - `release.yml`: drop the stale `slsa-github-generator` entry (the #91 rewrite removed the SLSA job) and prune its now-unreachable dependency records - SHAs verified via `git ls-remote` tag dereference; nested `uses:` graphs re-verified against the upstream `action.yml` at each new tag ## Testing - Faithful local port of `scripts/check-lock-sync.sh` passes **all four clauses** (every `uses:` locked under its workflow path incl. job-level reusable refs; no orphans; transitively closed — 0 dangling edges; every workflow file has a lockfile key). - All 36 tracked workflows + lockfile parse as YAML. - Workflow Security Linter steps run locally: SPDX headers ✅, permissions declarations ✅, no duplicate workflows ✅. - `grep` sweep: zero conflict markers anywhere. - Merge verified: `git merge-base --is-ancestor` confirms the #102 branch is fully contained in this merge. ## RSR Quality Checklist - [x] No banned language patterns - [x] No secrets, credentials, or `.env` files included - [x] Documentation updated for user-facing changes (FUNDING) - [ ] `.machine_readable/STATE.a2ml` — N/A (retired per D-B) <!-- SPDX-License-Identifier: AGPL-3.0-or-later --> --------- Co-authored-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Mistral Vibe <vibe@mistral.ai> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Governance Check / Workflow security linterfails at its first step,Parse every tracked workflow, which leaves five later stepsskipped—unknown, not passing. This PR clears the parse failure and the one real defect
that was sitting masked behind it.
1. Untrack
third_party/gossamer/.github/workflows/(17 files)The gate delegates to
tools/policy/check-workflows-parse.sh, which enumerates withgit ls-files -- '**/.github/workflows/*.yml'. It scans tracked files, sountracking is the correct lever and no policy change in
standardsis required.third_party/gossamer/.github/workflows/dogfood-gate.ymlis the singleunparseable file in the repository — a
python3 -cheredoc whose continuation linessit at column 0 and escape their block scalar. paint-type neither owns nor runs
gossamer's CI. The other 26 vendored
.github/files stay tracked; only theworkflows directory is removed, and a
.gitignorerule stops a re-vendor fromsilently re-adding it.
Checked before removing:
.gitmodules, nogit-subtree-dircommit — plain vendored files, mode100644actions.lock?third_partykey, so #73's bidirectionalcheck-lock-sync.shis unaffectedgossamer/.github2. Remove a fabricated commit SHA from
.github/workflows/README.adocUnmasking the parse step exposes
Check action pins resolve upstream, which wasalready failing. Its script greps the whole of
.github/workflows/foruses: owner/repo@<40 hex>with no filename filter, so it read an illustrativepin in a prose file as a real one:
That commit does not exist —
repos/actions/checkout/commits/<sha>returns422 "No commit found for SHA".
The surrounding prose also asserted that actions "should be SHA-pinned to specific
commits", which contradicts every real
uses:line in the directory: they aretags, and
actions.lockbinds each to a commit (workflows:allow-lists therefs per workflow,
dependencies:records the resolvedcommit: sha1-…). Thesection now documents the regime actually in force and warns against writing a
40-hex example into this directory again.
Measured — this tree, one change apart
The pin gate moves from
1 of 3 action pin(s) DO NOT EXIST upstreamtoAll 2 verifiable action pin(s) resolve upstream.Steps 1 and 4 are two-arm controlled: same tree, same bytes, one change.
Steps 2, 3 and 5 are root-scoped (
.github/workflowswith no**), so untrackinga vendored tree cannot affect them — measured green in both arms.
Not claimed
No reduction in Hypatia findings is asserted. 14 of the 17 vendored basenames
collide with root workflow basenames, and
workflow_auditemits bare basenames, sothose findings cannot be attributed to the vendored tree. The justification here
is the parse gate and the dead pin, nothing else.
Follow-up (issue, not a blocker)
The root cause of §2 is estate-wide:
check-action-pins-resolve.shscans every filein
.github/workflows/, so any repository documenting a SHA pin in prose reds thisgate. Filtering it to
*.yml/*.yamlbelongs inhyperpolymath/standards, nothere.
🤖 Generated with Claude Code
https://claude.ai/code/session_01YSq3UodR3CjsuAK5yoTzHF