ci: deploy docs via Ddraig SSG - #56
Merged
Merged
Conversation
|
5 tasks
hyperpolymath
added a commit
that referenced
this pull request
Jul 21, 2026
`governance / Workflow security linter` fails with
ERROR: .github/workflows/pages.yml missing SPDX header
This is pre-existing, not caused by removing casket-pages.yml — pages.yml
arrived via the estate-wide Ddraig mass-deploy (#56) without the header
that every other workflow in this repo carries. Deleting casket-pages.yml
did make it the *only* Pages workflow, so the gap is now unmasked rather
than introduced.
One-line fix; matches the header format used by codeql.yml, e2e.yml and
the rest.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Jul 21, 2026
…yer (#57) Two of the five red checks on `main`, with two distinct root causes. Neither touches product code. ## 1. CodeQL — it was failing because it had nothing to scan `analyze (javascript-typescript)` exited **32**: > CodeQL detected code written in JavaScript/TypeScript but could not process any of it statistikles is Julia + Agda + Zig. CodeQL supports **none** of those three, so the only analysable file in the repository is the ~100-line agent harness at `.claude/workflows/prod-readiness.js` (valid syntax — `node --check` passes). The JavaScript extractor skips dot-directories by default, so it extracted **zero** files and reported a configuration error. This adds `.github/codeql/codeql-config.yml` naming that directory explicitly, wired in via `config-file:` on the `init` step. Existing SHA pins are untouched. **Honest scope — please read before trusting the badge.** This covers the agent harness, *not* `src/**/*.jl`. A green CodeQL tick here means "the one JS file is clean" and says nothing about the statistical code. The real correctness gates remain `e2e.yml` (Julia suite) and `agda.yml` (`agda --safe`). The rationale is written into the config file header so the next reader doesn't have to rediscover it. If you'd rather not carry a scanner that can't see the product code at all, deleting `codeql.yml` outright is the defensible alternative — say the word and I'll swap this half of the PR for that. ## 2. GitHub Pages — two deployers, both red `casket-pages.yml` and `pages.yml` **both** declared `concurrency: group: "pages"`, so they serialised rather than raced, and both failed: - `casket-pages.yml` — died in ghcup, `GHC 9.8.2` / `cabal 3.10.3.0` not installed - `pages.yml` (Ddraig) — HTTP 404, Pages not enabled on the repo Ddraig is canonical (mass-deployed estate-wide in #56), so this removes `casket-pages.yml`. **No site content is lost**: casket built from `site/`, which does not exist here, and synthesised a placeholder index; Ddraig falls back to `README.md` the same way. ## Verification - [x] Both YAML files parse (`yaml.safe_load`) - [x] Exactly one workflow with `pages: write` remains - [x] Commit signed (ED25519, `%G? = G`) - [x] Checked the ruleset first — the only required context is `E2E — Julia Test Suite`, so `codeql` is not a required check and this cannot wedge `main` - [ ] **Must be confirmed on this PR's CI run:** CodeQL reports a *non-zero* extracted-file count. A pass with zero files is the same vacuous green in a new coat — the point of this change is that it stops being vacuous. ## Correction to an earlier reading `error_count: 10` in the last Ddraig run is the **deploy step's retry counter** against the 404 — not ten build errors. The Ddraig build itself succeeded and uploaded its artifact. There is one root cause there, not eleven. ## Not addressed here (owner actions / blocked) - **Enable GitHub Pages** (Settings → Pages, source: GitHub Actions). Until then `pages.yml` 404s on every push to `main`. - **Rotate `FARM_DISPATCH_TOKEN`** — Instant Sync fails `Bad credentials`; this is issue #32. The workflow guards on token *presence*, not validity, so it cannot detect expiry. - **Governance red is blocked upstream, deliberately not fixed.** CI instructs refreshing the `standards` reusable pins (`d7c22711e830`, 52 commits / 22d stale). Doing that makes the gitleaks gate real, which surfaces 23/23 false positives unless the `.gitleaks.toml` baseline lands first. Verified today: `hyperpolymath/standards` **#512 is still OPEN** and `.gitleaks.toml` **404s** at standards root. Re-pinning now would be reverted. ## Follow-ups spotted, not changed here - `pages.yml` uses floating tags (`actions/checkout@v4`, `upload-pages-artifact@v3`) while the rest of this repo SHA-pins. It arrived via the estate mass-deploy, so fixing it here would create drift — better fixed at the source. - `e2e.yml`'s header claims "693 @test assertions, 10 Agda proofs". Measured: **841** and **3**. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
5 tasks
hyperpolymath
added a commit
that referenced
this pull request
Jul 21, 2026
…overnance red) (#61) Closes the **only remaining red check on `main`**. ## What was failing `governance / Workflow security linter` on `main@69ca454`: ``` ERROR: Found unpinned actions: .github/workflows/pages.yml:23: uses: actions/checkout@v4 .github/workflows/pages.yml:25: uses: actions/checkout@v4 .github/workflows/pages.yml:42: uses: actions/upload-pages-artifact@v3 .github/workflows/pages.yml:55: uses: actions/deploy-pages@v4 ``` All four are in `pages.yml`, which arrived via the estate mass-deploy (#56) and never picked up this repo’s pinning convention. Every one of the other 12 workflows was already pinned. ## What changed | Action | Before | After | Rationale | |---|---|---|---| | `actions/checkout` (×2) | `@v4` | `@9c091bb` v7.0.0 | Matches the SHA the other 12 workflows already use; **verified against the API** that `9c091bb` really is `v7.0.0` | | `actions/upload-pages-artifact` | `@v3` | `@56afc60` v3.0.1 | Exactly what `@v3` resolves to today — running code unchanged | | `actions/deploy-pages` | `@v4` | `@d6db901` v4.0.5 | Exactly what `@v4` resolves to today — running code unchanged | ## Why not upgrade to v5 Both Pages actions have a v5. Deliberately not taken: - They are a **matched pair** — `upload-pages-artifact` v5 swaps its internal `actions/upload-artifact` v4 → v7, changing the artifact format handed to `deploy-pages`. - **`deploy-pages` cannot be exercised at all** until Pages is enabled on this repo (it currently 404s: *"Ensure GitHub Pages has been enabled"*). So a v5 bump is a behavioural change to a step that cannot be tested here. Pinning at the current resolution is the one option that provably changes nothing. ## A caveat worth recording Pinning `upload-pages-artifact` is only **shallow** pinning. It is a *composite* action, and its own `action.yml` at v3 still contains a floating tag: ```yaml uses: actions/upload-artifact@v4 # inside actions/upload-pages-artifact@v3 ``` v5 pins that transitively (`@bbbca2d # v7.0.0`). So "all actions pinned" here means *directly* pinned, one level deep — not a fake gate (the linter checks direct `uses:` and claims nothing more), but not the whole supply chain either. Closing that gap needs the same untestable upgrade, so it is **gated on Pages being enabled**, not dropped. ## Verification - [x] No unpinned `uses:` remain anywhere in `.github/workflows/` — checked with a pattern that also catches the inline `- uses:` form the estate linter is known to miss - [x] `pages.yml` parses as valid YAML; both jobs intact - [x] `9c091bb` confirmed = `actions/checkout` `v7.0.0` via `gh api` - [ ] `build` job green on this PR — exercises checkout ×2 + upload-pages-artifact - [ ] `deploy` job — **cannot be verified until Pages is enabled** (owner-only) ## Follow-up, not in this PR The same fix belongs in the **#56 estate template** so sibling repos inherit it rather than each drifting. This PR fixes the symptom locally because a known-red gate is worse than local drift. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mass rollout for Ddraig SSG