fix(ci): three CI blockers — dead rsr-antipattern ref, K9 pedigree gap - #24
Conversation
Three independent CI-blocker fixes bundled together (verified individually, listed by check name): lint-workflows: rsr-antipattern.yml called hyperpolymath/standards/.github/workflows/rsr-antipattern-reusable.yml, which has never existed on that repo (empty result from the commits API filtered on that path; absent from the current rsr-template-repo too). The estate's own docs/audits/audit-reusables-convergence-2026-05-26.adoc confirms `antipattern-check` was retired as part of the "Old rsr-template suite" and its required-status-check context was dropped because "no workflow ever produced" it again. Its function (language/package anti-pattern policy) is already covered by governance.yml -> governance-reusable.yml's language-policy/package-policy jobs, which this repo already runs. No SHA exists to pin against a file that was never committed, so the fix is to delete the dead workflow rather than write an unresolvable pin. Validate K9 contracts: locally reproduced the reported 8 errors / 10 files. 6 of the 8 were a scope bug in the shared k9-ecosystem validate-action (coordination.k9, session/custom-checks.k9, and self-validating/methodology-guard.k9.ncl are not K9 pedigree contracts at all — fixed at the source in hyperpolymath/k9-ecosystem#21, with a local paths-ignore override here as a stopgap since the wrapper pins the action to a commit SHA). The remaining 2 were a genuine defect in container/deploy.k9.ncl: missing the literal `K9!` first line, and its `pedigree` field pointed at a let-bound variable rather than an inline `pedigree = { ... }` block, so the validator's line-based scanner never saw name/version/leash. Fixed by adding the magic line and re-exposing the required fields inline via a Nickel record merge. Latent, non-blocking finding: adding `K9!` as line 1 breaks `nickel typecheck` (the file's own "Usage" comment documents that command). This is NOT new — the existing canonical templates (.machine_readable/self-validating/template-*.k9.ncl) already have this same property and already fail `nickel typecheck` today. No workflow in this repo invokes `nickel typecheck` on `.k9.ncl` files, so nothing is currently gated on it, but it means the whole estate's K9.ncl convention would break instantly if that check were ever wired up. Recorded here for whoever picks that up; out of scope to fix in this PR. openssf-compliance: N/A for bitfuckit — its "Check no unfilled placeholder tokens" step was already passing (its .machine_readable/6a2/ECOSYSTEM.a2ml describes bitfuckit itself, not the template it was scaffolded from). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
|
CI failed: CI check `scripts/check-root-shape.sh` failed because the new root entries `LICENSES/` and `flake.nix` are not included in the root allowlist.Overview1 root-shape validation failure across 2 jobs, caused by new repository root files/directories violating the allowed root shape configuration. FailuresRoot Shape Validation Failure (confidence: high)
Summary
Code Review ✅ Approved 2 resolved / 2 findingsRemoves the dead rsr-antipattern workflow reference and fixes K9 contract validation errors. Consider addressing the invalid Nickel syntax caused by the K9! magic line and the duplicated metadata in component_pedigree.
✅ 2 resolved✅ Quality: name/version duplicated between metadata and exported pedigree
✅ Bug: K9! magic line makes deploy.k9.ncl invalid Nickel
Tip Comment OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
1 participant
Summary
Fixes the three CI blockers keeping the estate's PR queue stuck, as
diagnosed for this repo (full per-blocker root-cause detail is in the
commit message):
rsr-antipattern.yml:15): thereferenced reusable (
rsr-antipattern-reusable.yml) has neverexisted on
hyperpolymath/standards— verified viagh api repos/hyperpolymath/standards/commits?path=...(empty) andabsence from the current
rsr-template-repo. It's dead, retiredestate-wide per
docs/audits/audit-reusables-convergence-2026-05-26.adoc,and superseded by
governance.yml(already present here). No SHAexists to pin, so the file is deleted rather than pinned to an
unresolvable reference.
k9-ecosystem/validate-actionscope bug, fixed at the source infix(validate-action): exclude non-pedigree files from K9 checks k9-ecosystem#21 (with a local stopgap override here).
The remaining 2 were a genuine
container/deploy.k9.ncldefect(missing
K9!line, pedigree hidden behind a let-binding) — fixeddirectly.
Test plan
bash validate-action/validate-k9.sh(k9-ecosystem, with thenew paths-ignore) →
Errors: 0(was 8)grep -rnE '^[[:space:]]+uses:' .github/workflows/ | grep -v '@[a-f0-9]{40}'→ empty (was 1 match:
rsr-antipattern.yml:15)nickel typecheck container/deploy.k9.ncl— confirmed the K9!line breaks this (a latent, non-blocking, estate-wide property
shared by the existing canonical templates too — see commit
message); nothing in this repo's CI invokes it today.
yaml.safe_load.🤖 Generated with Claude Code