fix(ci): close the governance gate — SPDX, permissions, SHA pins, reusable bump - #17
Merged
Merged
Conversation
…sable bump The governance gate is all-jobs-must-pass, so these ship as one commit; individually none of them turns the repo green. * SPDX line-1 header and a top-level `permissions:` block on every workflow file (the two `Workflow security linter` checks). * Every `uses:` tag reference resolved to a full 40-hex commit SHA. This satisfies the linter and also the repository's own `sha_pinning_required` Actions policy, which refuses `@v4` at parse time — a refusal that produces no check run at all. * `hypatia-scan.yml` now grants `security-events: write`. This is not cosmetic and is not separable from the pin bump below: at HEAD the reusable declares `security-events: write` where the old pin declared `read`, and a called workflow cannot escalate beyond its caller's grant. Bumping the pin without this would fail at parse time. * The three reusables watched by the staleness gate (governance, hypatia-scan, scorecard) advanced to standards HEAD, which is 62 commits ahead of the false-green cache fix and includes the deny-list-negative fix from standards#524. `mirror-reusable` and `secret-scanner-reusable` are deliberately left on their current pins: the staleness gate does not watch them, so they are not holding anything red, and bumping them carries unrelated risk. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
8 tasks
hyperpolymath
added a commit
that referenced
this pull request
Jul 27, 2026
## Summary scaffoldia (sibling of `contractiles`) was scaffolded from `rsr-template-repo` but never fully instantiated. Companion cure to hyperpolymath/contractiles#21, adapted to scaffoldia's actual (different) disease shape — scaffoldia had already been partially cured in earlier PRs (#16/#17), so this closes the *remaining* gaps rather than repeating contractiles' fix verbatim. * **~420 `{{TOKEN}}` identity placeholders** resolved across ~65 files, derived from the repo's own SPDX headers, LICENSE file, and GitHub's own description (`gh repo view hyperpolymath/scaffoldia --json description`). Deliberately left `container/*`, `machine-readable-design/{canonical-directory-structure,harvested-registry}/`, `docs-template/`, and drift-detector files whose job is to literally match `{{PLACEHOLDER}}` as a pattern. * **Literal `rsr-template-repo` self-identity string** fixed in ~15 files — most notably `.machine_readable/contractiles/*` (a stale, never-updated copy of an earlier root `Justfile`) and three onboarding docs that described a nonexistent installable app with fabricated `just run`/`just heal`/`just setup` commands. Genuine references to the real upstream (pipeline mentions, clone-to-start-new-project examples, provenance notes) were left alone. * **Two real (non-template) doc bugs** found and fixed: `docs/attribution/CITATIONS.adoc` linked to `github.com/hyperpolymath/Scaffoldia` (capitalised, wrong) in all five citation formats; `docs/developer/ABI-FFI-README.adoc`'s Idris2 example imported a nonexistent `SCAFFOLDIA.ABI.Foreign` module (real path is `Abi.Foreign`). * **Removed a fabricated PGP fingerprint/key** from `.github/SECURITY.md` and `.well-known/security.txt` — confirmed via `curl https://github.com/hyperpolymath.gpg` and `gh api users/hyperpolymath/gpg_keys` that no key has ever been uploaded, rather than inventing one. ## Zig — the hard requirement `src/interface/ffi/src/main.zig` had the same three real Zig 0.16 compile bugs as contractiles, beyond placeholder text: 1. `Handle` was `opaque { allocator: ..., initialized: ... }` — opaque types cannot have fields; changed to a plain `struct`. 2. `callconv(.C)` is not a valid `CallingConvention` member under Zig 0.16 — changed to `.c`. 3. `std.heap.c_allocator` requires libc; `build.zig` never linked it. `build.zig` was a no-op stub — rewritten into a real build (static library, `.link_libc = true`, test steps for both the main module and the integration-test module). `test/integration_test.zig` was a fully-commented-out placeholder — replaced with 10 real tests exercising every exported `scaffoldia_*` function. **Verified:** - `zig fmt --check .` → exit 0 - `zig build` → exit 0 - `zig build test --summary all` → exit 0, **13/13 tests pass** (3 unit + 10 integration) - `idris2 --build abi.ipkg` → exit 0 - `just --list` → exit 0 - All workflow YAML still parses ## Justfile Fake-gate recipes (`build`, `build-release`, `test`, `test-verbose`, `test-smoke`, `e2e`, `aspect`, `bench`, `fmt`, `fmt-check`, `lint`, `deps`, `install`) replaced with real invocations. `run`/`run-verbose` deleted (library, no executable). `readiness` deleted (duplicated `crg-grade`/`crg-badge` with no distinct real check). `clean` fixed — it previously did `rm -rf ... build/ ...`, which would have deleted the repo's own tracked `build/` orchestration directory; now targets only `build/ttc/`, `.zig-cache/`, `zig-out/`. `tests/e2e.sh` (previously fully commented out) now runs real preflight + Idris2 build + Zig build/test. `benches/template_bench.sh` dropped its two benchmark sections that called the now-deleted scripts and kept the real ones. ## Deleted template-only machinery `scripts/validate-template.sh`, `tests/e2e/template_instantiation_test.sh`, `.machine_readable/ai/PLACEHOLDERS.adoc`. No workflow referenced them. `docs/status/TEST-NEEDS.adoc` rewritten — it previously narrated the deleted `validate-template.sh`'s "8-phase validation" as the repo's own feature; now describes the real test suite honestly. ## Test plan - [x] `zig fmt --check .` exits 0 - [x] `zig build` exits 0 (from `src/interface/ffi`) - [x] `zig build test --summary all` exits 0, 13/13 tests pass - [x] `idris2 --build abi.ipkg` exits 0 - [x] `just --list` exits 0 - [x] All `.github/workflows/*.yml` still parse as valid YAML - [x] `git diff --cached --stat` confirms `.editorconfig`, `.gitattributes`, `.gitignore`, `flake.nix`, `.tool-versions` untouched - [x] `tests/aspect_tests.sh` passes except the pre-existing, out-of-scope false positive on proof-doc prose mentioning "Admitted"/"sorry" 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The governance gate is all-jobs-must-pass, so these ship as one commit;
individually none of them turns the repo green.
permissions:block on everyworkflow file (the two
Workflow security linterchecks).uses:tag reference resolved to a full 40-hex commit SHA. Thissatisfies the linter and also the repository's own
sha_pinning_requiredActions policy, which refuses@v4at parsetime — a refusal that produces no check run at all.
hypatia-scan.ymlnow grantssecurity-events: write. This is notcosmetic and is not separable from the pin bump below: at HEAD the
reusable declares
security-events: writewhere the old pin declaredread, and a called workflow cannot escalate beyond its caller'sgrant. Bumping the pin without this would fail at parse time.
hypatia-scan, scorecard) advanced to standards HEAD, which is 62
commits ahead of the false-green cache fix and includes the
deny-list-negative fix from standards#524.
mirror-reusableandsecret-scanner-reusableare deliberately left ontheir current pins: the staleness gate does not watch them, so they are
not holding anything red, and bumping them carries unrelated risk.
Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com