fix(examples): repoint upload-sarif at a codeql-action SHA that exists - #44
Merged
Conversation
6624720a57d4c312633c7b953db2f2da5bcb4c3a is not a commit in
github/codeql-action ('No commit found for SHA'). Any consumer who
copied examples/oikosbot-ci.yml got a workflow GitHub could not even
start — the action fails to resolve during 'Set up job', which
produces no check run at all.
Repointed to 4187e74d05793876e9989daffde9c3e66b4acd07 (v3, 2026-07-22),
verified to exist. This repo's own .github/workflows/codeql.yml pin
(e4fba868…, v3.28.1) was checked and is valid — only the example was
dead.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Code Review ✅ ApprovedRepoints the upload-sarif example workflow at a verified existing commit SHA for codeql-action. No issues found.
OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
|
|
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
hyperpolymath
added a commit
that referenced
this pull request
Jul 28, 2026
…xist (#46) **The step that enforces SHA pinning could never fail.** `workflow-linter.yml`'s *Check pinned actions* set `errors=0`, only `echo`ed a WARNING (never incrementing), and — unlike the two steps above it — ended with **no `exit $errors`**. A declared policy with no enforcement. It also globbed only `.github/workflows`, so the phantom pin in `examples/oikosbot-ci.yml` (fixed in #44) was structurally invisible. **Now it:** - increments and exits — it can fail; - scans `examples/` too; - flags tag/branch refs; - **probes each SHA against the GitHub API and fails if it is not a real commit.** That last check is the point. A phantom SHA isn't an ordinary red: the ref resolves to nothing, the job dies in *Set up job*, and **no check run is produced at all** — invisible to `gh pr checks`, indistinguishable from green. Three distinct phantom `codeql-action` SHAs were circulating across this repo and metadatastician-governance. **Verified both directions** (a gate I cannot prove will fail is the exact thing being fixed here): - clean on this repo → exit 0; - falsifier fixture with one tag ref + the real phantom `39a73d65…` → **exit 2**, both named, the phantom caught inside `examples/`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
examples/oikosbot-ci.yml— the workflow we tell consumers to copy — pinnedgithub/codeql-action/upload-sarif@6624720a57d4c312633c7b953db2f2da5bcb4c3a. That SHA is not a commit ingithub/codeql-action(REST API:No commit found for SHA), so a consumer copying the example gets a workflow GitHub cannot start: the action fails to resolve during Set up job, producing no check run at all — the failure mode that looks like a green board.Repointed to
4187e74d05793876e9989daffde9c3e66b4acd07(v3, 2026-07-22), verified present.Checked while here: this repo's own
.github/workflows/codeql.ymlpin (e4fba868…, v3.28.1) is valid — only the example was dead. Companion fixes in metadatastician-governance#10 and #11 (two further distinct phantom SHAs).🤖 Generated with Claude Code