fix(ci): repoint codeql-action at a SHA that exists - #68
Merged
Conversation
github/codeql-action@29b1f65 is pinned here but exists in no repository -- the GitHub API returns 422 for it. CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all. Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API. Found while auditing the estate: the same non-existent SHA is pinned in over 100 repositories, so CodeQL is dead across nearly all of them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Code Review ✅ ApprovedRepoints the CodeQL action at a valid SHA to restore security scanning, alongside estate-wide compliance updates and duplicate governance file cleanup. No issues found.
OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
|
|
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
|
4 tasks
hyperpolymath
added a commit
that referenced
this pull request
Jul 28, 2026
Two clean-ups, both closing loose ends left by earlier sweeps. 1. GOVERNANCE — recover what was lost, fix the dangling references ------------------------------------------------------------------ #68 deleted GOVERNANCE.adoc as a duplicate of GOVERNANCE.md. It was not one. Fifteen sections existed ONLY in the .adoc, and went with it: Contribution Lifecycle · Conflict Resolution · Project Policies · Repository-Specific Conventions · Governance Evolution · See Also · Changelog "Repository-Specific Conventions" is the load-bearing one — it is where the signing requirement, the SPDX rule, the contractile layout and the .machine_readable/6a2/ convention were written down. That content is recovered here from 5501ec6^ and merged into GOVERNANCE.md, converted from AsciiDoc to Markdown. GOVERNANCE.md is now genuinely the single source, which is what #68 intended but did not achieve. The deletion also left two dangling references, now repointed: .machine_readable/contractiles/Trustfile.a2ml:74 areas: GOVERNANCE.adoc .machine_readable/contractiles/Mustfile.a2ml:38 "GOVERNANCE.adoc ... must exist" The Mustfile one is worth flagging: it is a `severity: critical` contract whose `run:` is literally test -f GOVERNANCE.adoc && test -f MAINTAINERS.adoc && test -f .github/CODEOWNERS That assertion has been FALSE since #68 and nothing went red — because nothing executes it. grep finds no runner for Mustfile contracts; validate-a2ml.sh only parses them as TOML. So a critical contract silently became false. Repointed to GOVERNANCE.md, and the assertion now genuinely holds — but the contracts being declarative-only is a separate gap, filed rather than papered over here. 2. push-email-notify.yml — deleted, not left disabled ----------------------------------------------------- Estate dual-use policy removes push-email everywhere except 007, robodog-defensive-systems-lab and defensive-multiplicity. statistikles is not one of the three, so it was already `disabled_manually`. Verified dormant: PUSH_EMAIL_ENABLED is not set on this repo, and nothing else references it. Deleting beats leaving it disabled — a disabled-but-present workflow reads as an oversight to the next person, and it is one re-run of a farm sweep away from being re-enabled. Verified: all 18 remaining workflows parse and declare jobs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Jul 28, 2026
…st recurrence (#69) **Four gates are dead on `main` right now.** This restores them and stops the loop. ## What is broken `zig.yml`, `e2e.yml`, `container-build.yml`, `install-smoke.yml` — the Zig FFI gate, the Julia test suite, the container build and the install smoke test — are **unparseable**: ```yaml permissions: read-all actions: read # mapping values are not allowed here ``` All four declare permissions in the **scalar** form. Hanging a mapping key under a scalar is invalid YAML. ## Why nobody noticed Actions rejects a malformed workflow **at parse time** → **zero jobs, no check run**. Not a red X — an *absence*. `gh pr checks` shows nothing wrong. The only visible tell, and how this was caught: ``` $ gh run list --branch main failure .github/workflows/zig.yml <-- PATH, not "Zig FFI" failure .github/workflows/e2e.yml failure .github/workflows/container-build.yml failure .github/workflows/install-smoke.yml success Governance ``` When `gh run list` prints a **path** where it normally prints a **name**, the workflow never parsed. ## How it came back | | | |---|---| | **#64** | fixed all four | | **#68** | re-ran the sweep → reintroduced all four | #68’s stated purpose (repointing codeql-action at a SHA that exists) was correct and is untouched here. It simply carried the sweep along with it. Same root cause both times: **the sweep matches `permissions:` as text, not as a YAML node**, so it cannot distinguish the scalar form from the mapping form. The insertion is redundant regardless — `read-all` already grants every read scope, `actions: read` included. ## The guard Fixing this twice without a guard just queues up a third time. Added `.githooks/validate-workflow-yaml.sh`, wired as the **first job of the dogfood gate**: parse every workflow, fail on any that does not parse **or** that declares no jobs — a workflow can be valid YAML and still be inert. Deliberately dumb and total. A text-only sweep cannot satisfy it. ## Proven fail-closed, not assumed | Case | Result | |---|---| | A. clean tree | `exit 0` — "all 19 workflows parse and declare jobs" | | B. `actions: read` reintroduced into `zig.yml` | **`exit 1`** — names the file and the reason | | C. restored | `exit 0` | Case B is the one that matters: the guard fails on the exact defect it exists to catch. ## Verification - [x] All 19 workflows parse under `yaml.safe_load` - [x] Guard proven to fail on the reintroduced bug (case B above) - [ ] `Zig FFI`, `E2E + Aspect`, `Container Build`, `Install Smoke` **appear by NAME** in the checks below — their appearance *is* the fix; absence is the failure mode - [ ] `Workflows parse (no silent-dead gates)` passes ## Follow-up The sweep script itself should be made YAML-aware before it is run against the estate again — this repo is unlikely to be the only one with scalar `permissions:` blocks. --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github/codeql-action@29b1f65c1f735799893313399435a59f54045865is pinned here but exists in no repository — the GitHub API returns 422 for it.CodeQL therefore could not start: the run graph fails to build and the job reports
startup_failure, so this repository has had no CodeQL scanning at all.Repointed at
4187e74d05793876e9989daffde9c3e66b4acd07, which is what thev3tag currently resolves to (v3.37.3), verified against the API.Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.
Summary by Gitar
funding.ymland enabledactions: readpermissions across workflow filesGOVERNANCE.adocin favor ofGOVERNANCE.mdThis will update automatically on new commits.