From c7665f649963c162530d26ec256760a4c441cb2c Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 16:19:11 +0100 Subject: [PATCH] fix(ci): close the three gaps left on main by #55 and #56 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #55 and #56 were merged before their final commits landed, so three fixes that were verified on those branches are not on main. One of them is a regression main did not have before #56. 1. Hypatia is startup_failure on main — REGRESSION from #56 #56 refreshed hypatia-scan-reusable.yml to standards HEAD. The newer reusable declares `security-events: write` (it uploads SARIF); the caller still grants `security-events: read`. A called workflow cannot escalate beyond its caller's grant, so GitHub rejects the run at parse time: zero jobs, no log. Caller now grants write. Confirmed by A/B on the tangle branch, which carries the identical change: 558f631 (old pin, read) -> Hypatia success 2369299 (new pin, read) -> Hypatia startup_failure d090ff2 (new pin, write) -> Hypatia success Note for future sweeps: `gh pr checks` does NOT list startup_failure among its `fail` rows, so a PR can read "0 fail" while a workflow never started. Use `gh run list --json conclusion` to see it. 2. Dogfood Gate still fails — k9-validate-action pin container/deploy.k9.ncl uses the canonical single-line pedigree form `pedigree = component_pedigree & { name = "krl-deploy" },`, which the pinned validator (2d96f43) cannot parse; support was added upstream after that pin. Same stale-pin trap as the a2ml bump in #55. Bumped to 08958c9. 3. Governance still fails — unpinned actions in pages.yml #56 fixed the SPDX half of the Workflow security linter, which then reported its next rule: `ERROR: Found unpinned actions`. pages.yml used floating tags where every other workflow pins by SHA: actions/checkout@v4 -> de0fac2e... # v6.0.2 actions/upload-pages-artifact@v3 -> 56afc609... # v3 actions/deploy-pages@v4 -> d6db9016... # v4 Same majors, so pinning only, not behaviour. Verified on this branch: K9 0 errors, A2ML 0 errors, actionlint 0, all 18 workflows carry SPDX, no unpinned third-party actions. Remaining reds after this lands are not fixable in-repo: * GitHub Pages deploy — Pages is not enabled (/repos/hyperpolymath/krl/pages returns 404). Owner action; the build itself passes and certifies a11y. * Instant Sync — deliberately frozen. --- .github/workflows/dogfood-gate.yml | 2 +- .github/workflows/hypatia-scan.yml | 5 ++++- .github/workflows/pages.yml | 8 ++++---- 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 59b3287..cb4dd69 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -92,7 +92,7 @@ jobs: - name: Validate K9 contracts if: steps.detect.outputs.k9_count > 0 - uses: hyperpolymath/k9-validate-action@2d96f43c538964b097d159ed3a56ba5b5ceca227 # main + uses: hyperpolymath/k9-validate-action@08958c9bab64f9941a85938a78122a0d4a3058e8 # main with: path: '.' strict: 'false' diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 637e90d..42fed59 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -12,7 +12,10 @@ on: permissions: contents: read - security-events: read + # The reusable declares security-events: write (it uploads SARIF). A called + # workflow cannot escalate beyond the caller's grant, so `read` here makes the + # whole run a startup_failure with zero jobs and no log. + security-events: write jobs: scan: diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index f2ebfff..97d9d9d 100755 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -20,9 +20,9 @@ jobs: image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff steps: - name: Checkout Site - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Checkout Ddraig SSG - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: repository: hyperpolymath/ddraig-ssg path: .ddraig-ssg @@ -39,7 +39,7 @@ jobs: fi ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/} - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 with: path: '_site' deploy: @@ -52,4 +52,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4