ci: Secret Scanner caller must grant the reusable's job permissions - #51
Merged
Conversation
The standards secret-scanner reusable's gitleaks job declares pull-requests:write + actions:read (PR summary comment via the Issues/PR API). A called workflow is capped at the caller's grant, so without these at the calling job the run dies at startup (0s startup_failure, estate-wide). Caller-side fix; bumping the pin never fixes it. Ref: hyperpolymath/standards#472.
hyperpolymath
enabled auto-merge (squash)
July 9, 2026 06:28
hyperpolymath
disabled auto-merge
July 9, 2026 08:52
hyperpolymath
added a commit
that referenced
this pull request
Jul 27, 2026
…n label, guix licence (#59) ## What Three fixes toward a fully green main, from the 2026-07-27 sitrep (`dev-notes/eclexia-sitrep-2026-07-27.md`): 1. **Scorecards `startup_failure`** — the reusable requests `contents: read` at workflow level; our explicit job-level permissions block zeroed it out, so Actions rejected the whole file at parse time (zero jobs, no check run — invisible to `gh pr checks`). Fix: grant `contents: read` on the caller job, same as the Secret Scanner fix (#51). 2. **Cargo Audit red** — RUSTSEC-2026-0204 (`crossbeam-epoch` 0.9.18 → 0.9.20, invalid pointer deref in `fmt::Pointer`) plus warning-only RUSTSEC-2026-0190 (`anyhow` 1.0.101 → 1.0.104). `cargo check --workspace` passes locally after the bumps. 3. **CodeQL pin label** — the pinned SHA `7188fc36` was commented `# v3.28.1` but `git ls-remote` shows it is actually tag **v4.37.1**. SHA kept (it's what's green on main), comment corrected. Supersedes local commit `3a140ae` which changed the label to the equally-wrong `# v3`. 4. **guix.scm licence** — `license:pmpl-1.0-or-later` is not a Guix licence symbol and contradicts the MPL-2.0 normalisation (#45); now `license:mpl2.0`. ## Not in this PR - **ClusterFuzzLite red is a REAL finding** (reproducible OOM in `fuzz_main`, artifact `oom-abc6a184…`) — compiler bug, filed separately, workflow untouched. - The squisher guix.scm clobber existed only as uncommitted dirty-tree damage in the local checkout; discarded, never committed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Jul 29, 2026
Work from the 2026-07-29 session. Full narrative: `dev-notes/eclexia-sitrep-2026-07-27.md`. ## 1. Parser recursion limit — fixes the ClusterFuzzLite red ClusterFuzzLite has been red on a **reproducible** finding (artifact `oom-abc6a184…`). It is not really an OOM: the recursive-descent parser descends the native stack, so deeply nested input aborts the process with `fatal runtime error: stack overflow`, which libFuzzer reports as an OOM. **About 1000 nested parens — roughly 2 KB — was enough**, far inside the target's 100 KB cap. Adds `MAX_RECURSION_DEPTH` + `with_recursion_guard()` at the four recursive entry points (`parse_expr_prec`, `parse_type`, `parse_block`, `parse_block_inner`), returning a `RecursionLimitExceeded` error instead of dying. The limit is **64** because it must hold on the smallest stack the parser runs on: Rust spawns threads with 2 MiB by default and both the LSP and the test harness parse off the main thread. At ~8 KiB of debug stack per level, 256 still overflowed a 2 MiB thread while passing on the main thread's 8 MiB — a discrepancy worth knowing about. Verified: paren/type/brace nesting at 1k and 50k all survive on a 2 MiB thread (all three aborted at 1k before); **all 108 `.ecl` files in the repo parse with zero depth-limit rejections**; `cargo test -p eclexia-parser` 7/7 including a new regression test. ## 2. Scorecards `startup_failure` The reusable declares `contents: read` at workflow level; our caller's job-level `permissions:` block **replaced** rather than extended it, so Actions rejected the file at parse time. Parse rejection produces **no check run at all**, which is why `gh pr checks` showed nothing — use `gh run list --json conclusion`. Same root cause as #51. ## 3. Cargo Audit RUSTSEC-2026-0204 (`crossbeam-epoch` 0.9.18 → 0.9.20) and warning-only RUSTSEC-2026-0190 (`anyhow` 1.0.101 → 1.0.104). ## 4. CodeQL pin label SHA `7188fc36` was commented `# v3.28.1`; `git ls-remote` resolves it to tag **v4.37.1**. The SHA works, so this was green and invisible. SHA kept, comment corrected. Supersedes local commit `3a140ae`, which relabelled it to the equally-wrong `# v3` — **do not push that commit**. ## 5. Documentation, human and machine Every defect here was copy-in, not decay: - **`0-AI-MANIFEST.a2ml` pointed agents at `README.adoc`**, gone since #47 converted it to Markdown — the agent entry point was dead. Now v1.1 with a correct pointer and explicit read-order. - **`ARCHITECTURE.md` was a generic template stub** describing `src/ tests/ config/`, a layout this repo does not have. Replaced with the real pipeline, directory table, resource economy (incl. Echo/Landauer), and an honest gaps list. - `STATE.a2ml` advanced June → July, with new `[repo-facts]` and `[ci-status]` blocks. - `QUICK_STATUS.md`, `TOOLCHAIN_STATUS.md`, `.claude/CLAUDE.md`: currency notes rather than fake rewrites — the 2026-02 tables are accurate as descriptions but predate Echo and undercount the workspace (**53 members, not 25 crates**). `.claude/CLAUDE.md` also still listed **Nix as a packaging fallback** despite the Guix-only ruling of 2026-05-18. - `README.md`: licence badge alt-text said `PMPL-1.0` while its own image said MPL-2.0. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
pull-requests: write+actions: readto thescanjob so the standards secret-scanner reusable's gitleaks job can start. A called workflow cannot exceed the caller's grant; without this the run dies at startup (startup_failure, 0s) — the estate-wide Secret Scanner red.Mechanical caller-side fix, mirrors hyperpolymath/standards#472. No behaviour change beyond letting the scan run.
🤖 Generated with Claude Code