Repository navigation
fix(governance): follow the standards transfer — blocked on an Actions policy (owner decision) - #291
Merged
Merged
Conversation
hyperpolymath/standards was transferred to metadatastician/standards at 10:13 UTC on 2026-10-25. A reusable-workflow reference does not follow that redirect: from the next run, hypatia-scan.yml and scorecard.yml failed at plan time with zero jobs and no name, while every workflow that only checks the repository out (secret-scanner, k9's checkout, the verdict-grid renderer) kept working, because git and the REST API do follow it. So the scanners that call a standards reusable were dark and the ones that check it out were not - and a run that fails with no jobs does not appear in a per-workflow status summary at all. Repoint every reference at metadatastician/standards, keeping the same pinned SHAs: they resolve in the new location with the same commit subjects, so no new code is trusted and only the name used to reach those commits has changed. The governance contract now fails if any workflow names the pre-transfer owner, or if the Scorecard reusable stops being the pinned file, and the mutation test carries a case for each, so a partial migration cannot pass. The incident, its detection (gh api repos/<owner>/<repo> --jq .full_name) and why the two kinds of reference behave differently are recorded in docs/maintenance/repository-hygiene.md. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
|
Caution Review failedThe pull request is closed. Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
…ow policy The repaired references still fail, and the annotation on the run says why: all reusable workflows must come from a repository owned by hyperpolymath, so metadatastician/standards is refused whatever the workflow file names. Record the error verbatim and the three ways out, smallest first: permit the new owner in Settings -> Actions, move the repository back, or inline DEED conformance from a checkout. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
hyperpolymath
changed the title
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4784a67a48
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| deed: | ||
| name: DEED syntax | ||
| uses: hyperpolymath/standards/.github/workflows/deed-conformance.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 | ||
| uses: metadatastician/standards/.github/workflows/deed-conformance.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 |
There was a problem hiding this comment.
Under the repository's current Actions policy, this new cross-owner uses: reference is rejected before any jobs are created. The incident documentation added in this same commit records the exact rejection and explicitly states that repointing the reference alone is insufficient (docs/maintenance/repository-hygiene.md:253-268); the Scorecard call at .github/workflows/scorecard.yml:23 is affected as well. Unless the Actions allowlist is updated as part of the rollout (or these checks are made local), Governance and Scorecard remain entirely dark after this purported fix.
Useful? React with 👍 / 👎.
hyperpolymath
force-pushed
the
arena/088fd6f8-metamanifold-webui
branch
from
October 25, 2026 11:40
3006edd to
4784a67
Compare
|
Add Carrot credits or activate Agent usage billing to use Autofix |
|
4 tasks done
hyperpolymath
added a commit
that referenced
this pull request
Oct 25, 2026
…es both) (#293) ## Change and reason `Governance (fork)` and `OpenSSF Scorecard` have been **dark since 10:13 UTC**, and #291 could not fix them. This does, and it is the only route available from here. ### Why #291 wasn't enough The run's annotation names an **Actions policy**, not the rename: > The reusable workflow `metadatastician/standards/…@75bd5994…` is **not allowed** … because all reusable workflows must be from a repository owned by `hyperpolymath` or match the pattern: `arena-ai-coding-agent[bot]`. So the failure is architectural: editing `uses:` strings cannot cross the owner boundary. And this session's identity is an **App installation** — it reports `admin: true` on the repo but `GET /repos/{owner}/{repo}/actions/permissions` returns **403**, so the Settings change is not reachable from here either. Of the three ways out (permit the owner / move the repo back / fork-local copies), only the third needs no owner action. It is also the option this repository already chose for three of its five reusables: `k9-conformance-reusable.yml`, `hypatia-scan-reusable.yml` and `secret-scanner-reusable.yml` are all fork-local copies. ### What this does | Lane | Caller before | Caller now | Still pinned to | | --- | --- | --- | --- | | `DEED syntax / lint` | `metadatastician/standards/…/deed-conformance.yml@75bd5994` | `./.github/workflows/deed-conformance-reusable.yml` | the linter, fetched from `standards` at `75bd5994` — a **checkout**, which cross-owner is allowed | | `OpenSSF Scorecard` | `metadatastician/standards/…/scorecard-reusable.yml@c6d78606` | `./.github/workflows/scorecard-reusable.yml` | reconciler helper at `5a0891e9`, `ossf/scorecard-action@fa7117db` | Neither copy re-implements anything: - **DEED** is the upstream *caller path* only. The upstream self-test, fixture-corpus, uuid-v8 and Rust-generator steps are gated on `github.repository == 'hyperpolymath/standards'` and never executed here — not copied. The lint step is the same `find … *.deed | xargs bun deed_lint.js`, plus an `::error::` annotation so a failure is readable from the checks API. - **Scorecard** is the `scorecard` job **verbatim** from `c6d78606`, comments included, because those comments record two separate freezes of this repository's Security tab (a deleted SARIF upload in PR #393, and a reconciler failure that could skip the upload). Reading them is the difference between maintaining it and reintroducing the outage. Its `pull-request` job is not copied: `scorecard.yml` has no PR trigger and the contract fails if one is added, so the job is unreachable here. ### The durable part A new contract rule, for the next time *any* repository moves: > every reusable workflow must be fork-local or owned by the repository owner because a cross-owner call fails **at plan time with zero jobs and no error line in any check summary** — which is precisely why this went unnoticed for two hours and survived a review of #286 and #291. Per-lane guards too: each copy must record its source commit, the DEED caller must stay local with `require-files: true`, and the Scorecard copy must keep its SARIF upload, its `continue-on-error: true` reconciler and its final fail-the-run step. **Seven new mutations** prove each check can fail (`deed-remote`, `scorecard-remote`, `cross-owner-reusable`, `deed-source-sha`, `scorecard-source-sha`, `scorecard-no-upload`, `scorecard-quiet-reconcile`). The stale-owner check was narrowed to `uses:`/`repository:` fields, so a comment may still explain the transfer — the previous version flagged the new DEED header. ## Validation ``` bash scripts/check-governance-contract.sh # 83 checks passed (was 72) bash scripts/tests/test-governance-contract.sh # all mutations rejected, incl. 7 new bash scripts/tests/test-triage-branches.sh # 24 passed, 0 failed bash scripts/tests/test-check-pr-freshness.sh # 12 passed, 0 failed bash scripts/tests/test-scanner-boundaries.sh # ok bash scripts/tests/test-ci-logging.sh # ok ``` All eleven workflow files parse as YAML; the two new copies' embedded shell was extracted and passed `bash -n`; the linter (`1-formats/deed/tools/deed_lint.js`, 20 KB) and the reconciler (10 KB) were confirmed to exist at their pinned commits; this repository has exactly one `.deed` file for the lane to lint. **The real test is this PR's own `Governance (fork)` run** — it goes from `startup_failure`/0 jobs to four jobs (`Advisory scan contract`, `DEED syntax / lint`, `K9 conformance`, `Hypatia verdict grid`). **Scorecard cannot be exercised from a pull request** (push/schedule/dispatch only, by design), so its first run is the next push to `main`; its YAML and its guards are contract-checked in the meantime. ## Scope - Pins unchanged: the linter, the reconciler, `ossf/scorecard-action` and every action SHA are the same commits as before. No new code is trusted. - The **Settings fix is still worth doing** (Settings → Actions → allow `metadatastician`) — not because these two lanes need it now, but because it makes the *next* transfer a non-event. The copies can then be dropped in favour of the remote again, and the contract will not object to either arrangement. - No Julia, R or frontend change; no lockfile change. ## Contribution checks - [x] I followed [CONTRIBUTING.md](../CONTRIBUTING.md). - [x] This branch starts at `main`'s tip and has no merge commits from it. - [x] CI has run; `Governance (fork)` now has jobs. - [x] Existing licensing, citation and acknowledgement text is unchanged. Co-authored-by: Arena Agent <agent@arena.ai> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change and reason
main's governance lanes went dark at 10:13 UTC today. This PR contains the code half of the fix; the other half is a repository setting only the owner can change. Read the Decision section before merging.What happened
hyperpolymath/standards— the source of the DEED, K9, Hypatia, Scorecard and secret-scanner reusables — was transferred tometadatastician/standards. From the next run onward, the two workflows that call a standards reusable failed, and the ones that only check it out kept working:Governance (fork),OpenSSF Scorecardhypatia-scan.ymlon a pull requesthypatia-scan.yml,scorecard.ymlon the push tomainSecret Scanner(local reusables only)Evidence that this is a transfer and not a different repository:
gh api repos/hyperpolymath/standardsreturnsfull_name: metadatastician/standards, id 1116521501, and all three pinned SHAs resolve there with identical commit subjects.What this PR does
metadatastician/standards, keeping the same pinned SHAs — no new code is trusted, only the name used to reach the same commits.scripts/check-governance-contract.sh: fails if any workflow names the pre-transfer owner, and the Scorecard reusable must still be the pinned file. The bypass guard covers both names so a revert cannot slip through. 72 checks (was 70).scripts/tests/test-governance-contract.sh: two new mutations (stale-standards-owner,scorecard-owner).docs/maintenance/repository-hygiene.md: the incident, the detection command, and why the two kinds of reference behave differently.The repaired references still failed, and the run's annotation says exactly why:
So an Actions policy, not the rename, is the proximate block: reusable workflows may only come from
hyperpolymath-owned repositories. Editing workflow files cannot fix that. The options, smallest first:metadatastician(or any repository). Then merge this PR and the lanes come back on the next push. This is the recommended path.standardsback underhyperpolymath— then the files work unchanged and this PR should be closed, not merged.uses:, as the K9/Hypatia/secret-scanner lanes already do. Correct but copies someone else's steps into this repository, where they will drift.I am deliberately not merging this: under option 2 the change is wrong, and under option 1 it is inert until you change the setting. Merge it after (1), close it after (2).
Meanwhile: the six required contexts are all in
ci.yml, so merges are not blocked andmain's required checks are green. The governance lanes are a silent gap, not a stopped pipeline — a plan-time failure produces no jobs and therefore no line in a per-workflow check summary, which is exactly why this went unnoticed on #286.Validation
All ten workflow files parse as YAML;
hypatia-scan.yml'sdeedjob andscorecard.yml's job resolve tometadatastician/standards/…at the unchanged SHAs.Not provable from here: that the lanes come back — that needs the policy change above. The startup failure with the annotation is the current, reproducible evidence.
Scope
No change to any pinned SHA, to
.github/workflows/ci.yml, or to Julia/R/frontend code. The pre-transfer name stays rejected by the contract so this cannot half-migrate.Contribution checks
main.