CI punch list: Scorecards startup_failure, Cargo Audit red, CodeQL pin label, guix licence - #59
Merged
Merged
Conversation
The pinned SHA was commented '# v3.28.1' but actually resolves to tag v4.37.1 upstream (verified via git ls-remote). Keep the working SHA, label it honestly. Also fix guix.scm licence: pmpl-1.0-or-later is not a Guix licence symbol and contradicts the MPL-2.0 normalisation (#45). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The scorecard reusable requests contents:read at workflow level; the caller's explicit job-level permissions block zeroed it out, so Actions rejected the file at parse time (startup_failure, zero jobs — invisible to gh pr checks). Same class as the Secret Scanner fix in #51. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
….104 Clears Cargo Audit red: RUSTSEC-2026-0204 (crossbeam-epoch invalid pointer deref in fmt::Pointer) and warning RUSTSEC-2026-0190 (anyhow unsound downcast_mut). cargo check --workspace passes locally. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Three fixes toward a fully green main, from the 2026-07-27 sitrep (
dev-notes/eclexia-sitrep-2026-07-27.md):startup_failure— the reusable requestscontents: readat workflow level; our explicit job-level permissions block zeroed it out, so Actions rejected the whole file at parse time (zero jobs, no check run — invisible togh pr checks). Fix: grantcontents: readon the caller job, same as the Secret Scanner fix (ci: Secret Scanner caller must grant the reusable's job permissions #51).crossbeam-epoch0.9.18 → 0.9.20, invalid pointer deref infmt::Pointer) plus warning-only RUSTSEC-2026-0190 (anyhow1.0.101 → 1.0.104).cargo check --workspacepasses locally after the bumps.7188fc36was commented# v3.28.1butgit ls-remoteshows it is actually tag v4.37.1. SHA kept (it's what's green on main), comment corrected. Supersedes local commit3a140aewhich changed the label to the equally-wrong# v3.license:pmpl-1.0-or-lateris not a Guix licence symbol and contradicts the MPL-2.0 normalisation (chore(licence): normalise to MPL-2.0 + CC-BY-SA-4.0 (canonical pair) #45); nowlicense:mpl2.0.Not in this PR
fuzz_main, artifactoom-abc6a184…) — compiler bug, filed separately, workflow untouched.🤖 Generated with Claude Code