From e3bebe51bab49a7581a78c6424fed6df2ea4a62b Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 12:34:23 +0000 Subject: [PATCH 1/4] ci: re-pin every standards caller to 75bd599 and rebuild the lock closure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rust CI has been red on every run since 2026-10-16 (run 38846539059 and each one after it), dying in `rust-ci / Detect Cargo.toml` at Set up job: Unable to resolve action `actions/checkout@3d3c42e5…`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile Nothing in this repository changed between the last green run (60e8f7a, 2026-10-15) and the first red one. GitHub began validating a called reusable workflow against the CALLEE repository's actions.lock at the called SHA, and rejects a dependency record whose `ref:` is the bare commit SHA rather than the tag it was resolved from. The standards lock at 8f2ee50 and da2c748 records `actions/checkout@3d3c42e5…` with `ref: '3d3c42e5…'`; at 75bd599 (standards main, 2026-10-19) the same record reads `ref: 'v7.0.1'`, and callers pinned there create jobs again (hyperpolymath/hypatia#929 witnessed it first). Governance, Mirror, Secret Scanner, Hypatia Scan, Scorecard and the standards pipeline were dying the same way for the same reason, so all seven callers move to 75bd599 together. The pipeline caller passes no inputs, so the inputs ci-pipeline.yml dropped since ed5e3f6 do not affect it. The lockfile is rebuilt rather than patched: one `hyperpolymath/standards @75bd599` record whose `uses:` is the union of what the seven called reusables use at that commit, and every third-party record copied verbatim from standards' own lock at 75bd599, which GitHub accepts. The two records this repository pins directly by SHA (actions/attest-build-provenance, softprops/action-gh-release) now carry the tag that resolves to their commit (v4.2.2, v3.0.3) instead of the SHA repeated as the ref. Records nothing references any more are pruned. scripts/check-lock-sync.sh: in sync, transitively closed. Also resynced two Dependabot bumps that had left the lock behind (push-email-notify.yml → smtp-notify-action v0.5.0; static-analysis- gate.yml → upload-artifact v7.0.2, download-artifact v8.0.2), which scripts/check-lock-sync.sh had been reporting on main since #133. Two rustdoc fixes in squabble-core for the strict Rust gate's warnings-denied doc build (cicd-suite#54): public docs linked the private items `step_concluded` and `propose_for`; they are code spans now. Verified locally: fmt, clippy -D warnings, doctests, `cargo +1.85 check --locked` (the declared MSRV) and `cargo doc` with RUSTDOCFLAGS=-D warnings all pass. Not in this commit: calling cicd-suite's Rust and SPARK gates from here. This repository's lock-sync gate requires every called reusable's transitive closure in actions.lock, and that closure needs lockfile records for EmbarkStudios/cargo-deny-action and alire-project/setup-alire, whose numeric repository ids are not obtainable from this session. The adoption follows once cicd-suite's gates are keyed in cicd-suite's own lock (or those ids are supplied). Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8 --- .github/workflows/actions.lock | 131 +++++++++++------------ .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- .github/workflows/standards-pipeline.yml | 4 +- crates/squabble-core/src/lib.rs | 4 +- crates/squabble-core/src/polarity.rs | 2 +- 10 files changed, 72 insertions(+), 81 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 1414f87..34079dd 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -17,17 +17,17 @@ workflows: '.github/workflows/estate-rules.yml': - 'actions/checkout@v7.0.1' '.github/workflows/governance.yml': - - 'hyperpolymath/standards@8f2ee50841e216cd8c192eeb68953118190f105c' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/guix-policy.yml': - 'actions/checkout@v7.0.1' '.github/workflows/hypatia-scan.yml': - - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/instant-sync.yml': [] '.github/workflows/label-triage.yml': [] '.github/workflows/labels.yml': [] '.github/workflows/lock-sync-gate.yml': [] '.github/workflows/mirror.yml': - - 'hyperpolymath/standards@8f2ee50841e216cd8c192eeb68953118190f105c' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/openssf-compliance.yml': - 'actions/checkout@v7.0.1' '.github/workflows/pages.yml': @@ -35,7 +35,7 @@ workflows: - 'actions/deploy-pages@v5.0.1' - 'actions/upload-pages-artifact@v5.0.0' '.github/workflows/push-email-notify.yml': - - 'hyperpolymath/smtp-notify-action@v0.3.0' + - 'hyperpolymath/smtp-notify-action@v0.5.0' '.github/workflows/quality.yml': - 'actions/checkout@v7.0.1' - 'editorconfig-checker/action-editorconfig-checker@v3.0.0' @@ -51,20 +51,20 @@ workflows: '.github/workflows/runtime-policy.yml': - 'actions/checkout@v7.0.1' '.github/workflows/rust-ci.yml': - - 'hyperpolymath/standards@8f2ee50841e216cd8c192eeb68953118190f105c' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/scorecard.yml': - - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/secret-scanner.yml': - - 'hyperpolymath/standards@8f2ee50841e216cd8c192eeb68953118190f105c' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/security-policy.yml': - 'actions/checkout@v7.0.1' '.github/workflows/squabble-action.yml': [] '.github/workflows/standards-pipeline.yml': - - 'hyperpolymath/standards@ed5e3f651305dd1ce0d0b5d2d08b97a963634632' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/static-analysis-gate.yml': - 'actions/checkout@v7.0.1' - - 'actions/download-artifact@v8.0.1' - - 'actions/upload-artifact@v7.0.1' + - 'actions/download-artifact@v8.0.2' + - 'actions/upload-artifact@v7.0.2' - 'erlef/setup-beam@v1.24.1' '.github/workflows/wellknown-enforcement.yml': - 'actions/checkout@v7.0.1' @@ -72,7 +72,7 @@ workflows: - 'actions/checkout@v7.0.1' dependencies: 'actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8': - ref: '4d101475d8b20a2381f78447822ac1eab6504dd8' + ref: 'v4.2.2' commit: 'sha1-4d101475d8b20a2381f78447822ac1eab6504dd8' owner_id: 44036562 repo_id: 760702757 @@ -84,12 +84,12 @@ dependencies: owner_id: 44036562 repo_id: 760701061 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9': - ref: '55cc8345863c7cc4c66a329aec7e433d2d1c52a9' + ref: 'v6.1.0' commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' owner_id: 44036562 repo_id: 215566462 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': - ref: '3d3c42e5aac5ba805825da76410c181273ba90b1' + ref: 'v7.0.1' commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' owner_id: 44036562 repo_id: 197814629 @@ -108,16 +108,11 @@ dependencies: commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' owner_id: 44036562 repo_id: 192626254 - 'actions/download-artifact@v8.0.1': - ref: 'v8.0.1' - commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c' + 'actions/download-artifact@v8.0.2': + ref: 'v8.0.2' + commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' owner_id: 44036562 repo_id: 192626254 - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a': - ref: '043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' - commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' - owner_id: 44036562 - repo_id: 192625955 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f': ref: 'v7.0.0' commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' @@ -128,9 +123,9 @@ dependencies: commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' owner_id: 44036562 repo_id: 192625955 - 'actions/upload-artifact@v7.0.1': - ref: 'v7.0.1' - commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' + 'actions/upload-artifact@v7.0.2': + ref: 'v7.0.2' + commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' owner_id: 44036562 repo_id: 192625955 'actions/upload-pages-artifact@v5.0.0': @@ -140,6 +135,11 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed': + ref: 'v2.0.5' + commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' + owner_id: 42048915 + repo_id: 356423100 'dependabot/fetch-metadata@v3.1.0': ref: 'v3.1.0' commit: 'sha1-25dd0e34f4fe68f24cc83900b1fe3fe149efef98' @@ -150,13 +150,13 @@ dependencies: commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8' owner_id: 1940490 repo_id: 260749683 - 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772': - ref: '6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' - commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' + 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f': + ref: 'v1' + commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f' owner_id: 1940490 repo_id: 260749683 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393': - ref: '51f63319f592f97930c73d9c46184d20bd206393' + ref: 'v3.0.0' commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393' owner_id: 26415196 repo_id: 297874902 @@ -166,7 +166,7 @@ dependencies: owner_id: 26415196 repo_id: 297874902 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124': - ref: '54075bcc5e249e4758d363f27d099f55d843f124' + ref: 'v1.24.1' commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' owner_id: 47606891 repo_id: 331103973 @@ -175,9 +175,9 @@ dependencies: commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' owner_id: 47606891 repo_id: 331103973 - 'github/codeql-action@cdf488f595d80d6e07e03d4674febd5ab45fa938': - ref: 'cdf488f595d80d6e07e03d4674febd5ab45fa938' - commit: 'sha1-cdf488f595d80d6e07e03d4674febd5ab45fa938' + 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63': + ref: 'v4.38.0' + commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' owner_id: 9919 repo_id: 259445878 'github/codeql-action@v4.39.0': @@ -186,83 +186,74 @@ dependencies: owner_id: 9919 repo_id: 259445878 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406': - ref: 'abea47f85e598557f500fa1fd2ab7464fcb39406' + ref: 'v2.2.1' commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406' owner_id: 1006268 repo_id: 212984112 - 'haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d': - ref: '6037f33647c3f17758a2356c80fc4a53d7e0685d' - commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' + 'haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d': + ref: 'v2.12.1' + commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d' owner_id: 75048950 repo_id: 623796603 - 'hyperpolymath/smtp-notify-action@v0.3.0': - ref: 'v0.3.0' - commit: 'sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be' + 'hyperpolymath/smtp-notify-action@v0.5.0': + ref: 'v0.5.0' + commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef' owner_id: 6759885 repo_id: 1352485172 - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd': - ref: '571cc734cd69fb846032ec77a662aa8ee4fc32cd' - commit: 'sha1-571cc734cd69fb846032ec77a662aa8ee4fc32cd' - owner_id: 6759885 - repo_id: 1116521501 - 'hyperpolymath/standards@8f2ee50841e216cd8c192eeb68953118190f105c': - ref: '8f2ee50841e216cd8c192eeb68953118190f105c' - commit: 'sha1-8f2ee50841e216cd8c192eeb68953118190f105c' + 'hyperpolymath/standards@427eb35c40552d912d8c757518e8326f0d20f597': + ref: '427eb35c40552d912d8c757518e8326f0d20f597' + commit: 'sha1-427eb35c40552d912d8c757518e8326f0d20f597' owner_id: 6759885 repo_id: 1116521501 uses: - - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' - - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393' - - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' + - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f' - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406' - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' - 'hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540': - ref: 'da2c748aad55c1a1dcba00b60fe4a35017bc6540' - commit: 'sha1-da2c748aad55c1a1dcba00b60fe4a35017bc6540' + 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': + ref: '75bd5994470661a099df562d6d5ad2fe744dbd66' + commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66' owner_id: 6759885 repo_id: 1116521501 uses: - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' + - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' + - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' + - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393' - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' - - 'github/codeql-action@cdf488f595d80d6e07e03d4674febd5ab45fa938' + - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' + - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406' + - 'haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d' + - 'hyperpolymath/standards@427eb35c40552d912d8c757518e8326f0d20f597' - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' - 'hyperpolymath/standards@ed5e3f651305dd1ce0d0b5d2d08b97a963634632': - ref: 'ed5e3f651305dd1ce0d0b5d2d08b97a963634632' - commit: 'sha1-ed5e3f651305dd1ce0d0b5d2d08b97a963634632' - owner_id: 6759885 - repo_id: 1116521501 - uses: - - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d' - - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd' - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6' + - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': - ref: '2d1146689b8cda280b9bc96326124645441f03bc' + ref: 'v2.4.4' commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' owner_id: 67707773 repo_id: 421101922 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6': - ref: '0c5077e51419868618aeaa5fe8019c62421857d6' + ref: 'v2.2.0' commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6' owner_id: 108928776 repo_id: 512644635 'softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64': - ref: 'efb35369e0ad2afab669f228072c1b0d510eae64' + ref: 'v3.0.3' commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64' owner_id: 2242 repo_id: 204253808 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6': - ref: '6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + ref: 'v2.9.2' commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' owner_id: 580492 repo_id: 298565987 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555': - ref: 'e83874834305fe9a4a2997156cb26c5de65a8555' + ref: 'v0.10.0' commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555' owner_id: 135788 repo_id: 208510314 diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index a543403..c9605f7 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -18,7 +18,7 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 permissions: actions: read contents: read diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index efcf77c..d7b0447 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -27,4 +27,4 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 805b98e..c6adc7b 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -13,7 +13,7 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 secrets: inherit permissions: actions: read diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index c41879d..a6ff8b7 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -16,7 +16,7 @@ permissions: contents: read jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 permissions: actions: read contents: read diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 8dfa29b..941aade 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -16,7 +16,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 permissions: actions: read contents: read diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 16a3eaf..4ebb72e 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -22,7 +22,7 @@ permissions: # .github/workflows/README.adoc. jobs: scan: - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 secrets: inherit permissions: actions: read diff --git a/.github/workflows/standards-pipeline.yml b/.github/workflows/standards-pipeline.yml index e9bf8c8..64e8f43 100644 --- a/.github/workflows/standards-pipeline.yml +++ b/.github/workflows/standards-pipeline.yml @@ -33,10 +33,10 @@ permissions: jobs: pipeline: - # hyperpolymath/standards @ ed5e3f65 — ci-pipeline.yml blob ea87c43a. + # hyperpolymath/standards @ 75bd5994 (standards main 2026-10-19; see actions.lock). # # NO `secrets:` block, deliberately. ci-pipeline.yml declares # `workflow_call.inputs` only, has no `secrets:` block and references no # `secrets.*` anywhere; `secrets: inherit` would hand the whole store to a # workflow that consumes none of it. - uses: hyperpolymath/standards/.github/workflows/ci-pipeline.yml@ed5e3f651305dd1ce0d0b5d2d08b97a963634632 + uses: hyperpolymath/standards/.github/workflows/ci-pipeline.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 diff --git a/crates/squabble-core/src/lib.rs b/crates/squabble-core/src/lib.rs index c1ab68b..4e95851 100644 --- a/crates/squabble-core/src/lib.rs +++ b/crates/squabble-core/src/lib.rs @@ -81,12 +81,12 @@ fn propose_for(required_context: &str) -> Move { /// /// `diagnose` is deliberately name-only: [`gate::Gate`] carries nothing about /// *why* a check is unsatisfied, so its default proposal falls back to -/// [`propose_for`]'s heuristics. A host with more context (fetched workflow +/// `propose_for`'s heuristics. A host with more context (fetched workflow /// source, a check's own failure history, known-bad reusable-workflow /// patterns — see `hyperpolymath/hypatia#566`) can supply a `hints` map from /// `required_context` to the specific [`Move`] it has already classified, /// and this function uses that instead of guessing. Contexts absent from -/// `hints` fall back to [`propose_for`], so this is a strict refinement of +/// `hints` fall back to `propose_for`, so this is a strict refinement of /// `diagnose`, never a divergence from it. pub fn diagnose_with_hints( gate: &Gate, diff --git a/crates/squabble-core/src/polarity.rs b/crates/squabble-core/src/polarity.rs index eafe953..a4252c0 100644 --- a/crates/squabble-core/src/polarity.rs +++ b/crates/squabble-core/src/polarity.rs @@ -167,7 +167,7 @@ pub struct ScannerSignature { /// So the set quantifies with `any`: a job is vacuous if it matches ANY /// scanner's signature, having matched that scanner's steps in full. /// -/// The disjunction cannot leak across scanners. [`step_concluded`] returns +/// The disjunction cannot leak across scanners. `step_concluded` returns /// `false` for a step that is absent from the list, so signature A cannot /// match a job that never recorded A's steps — the panic-attack job cannot be /// judged by the hypatia signature. That is asserted in the tests, not From 27da5aaf04ad72219fe4731b3673330da0fbc93c Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2026 15:16:54 +0000 Subject: [PATCH 2/4] fix(ci): exclude the standards runtime checker from the Cargo workspace and sync the ESTATE UUID v8 identity --- .machine_readable/descriptiles/CLADE.a2ml | 3 ++- .machine_readable/descriptiles/STATE.a2ml | 2 +- CLAUDE.md | 6 +++--- Cargo.toml | 3 +++ 4 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.machine_readable/descriptiles/CLADE.a2ml b/.machine_readable/descriptiles/CLADE.a2ml index 4234703..b497269 100644 --- a/.machine_readable/descriptiles/CLADE.a2ml +++ b/.machine_readable/descriptiles/CLADE.a2ml @@ -3,7 +3,8 @@ # See: https://github.com/hyperpolymath/gv-clade-index [identity] -uuid = "38bec2ed-bb12-44ee-9fb4-08872370c27b" # PROVISIONAL — owner ratifies via gv-clade-index +# ESTATE-UUID-V8 profile C: gv-clade-index:github.com/hyperpolymath/cicd-squabbler +uuid = "02d29e41-94bc-80c5-b741-09a9d39b858c" # PROVISIONAL — owner ratifies via gv-clade-index primary-forge = "github" primary-owner = "hyperpolymath" canonical-name = "cicd-squabbler" diff --git a/.machine_readable/descriptiles/STATE.a2ml b/.machine_readable/descriptiles/STATE.a2ml index 2492683..bebc964 100644 --- a/.machine_readable/descriptiles/STATE.a2ml +++ b/.machine_readable/descriptiles/STATE.a2ml @@ -49,7 +49,7 @@ actions = [ "Add the squabble-app GitHub App webhook leg (check_run.requested_action + octocrab — the \"Squabble!\" button) so a fight can be triggered from a PR, not only from the CLI; still honestly absent (no webhook route registered).", "Live-fire --summon against a running boj-server with the expert backends up (hypatia :7701, panic-attack, echidna) — today's verification proves the wiring + fail-closed degradation; the experts themselves are not yet deployed.", "Extend the SPARK invariant to cover the licence-policy gate class (v0.2; v0.1 moves are Rust-only for that class).", - "Register the CLADE (uuid 38bec2ed-bb12-44ee-9fb4-08872370c27b) into hyperpolymath/gv-clade-index (owner action).", + "Register the CLADE (uuid 02d29e41-94bc-80c5-b741-09a9d39b858c) into hyperpolymath/gv-clade-index (owner action).", ] [maintenance-status] diff --git a/CLAUDE.md b/CLAUDE.md index 6bb5a6f..ce7dd0f 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -6,7 +6,7 @@ SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell - + # You are in the hyperpolymath estate — orient before acting @@ -61,7 +61,7 @@ Deny: **Guix, Node/npm, TypeScript, Python, Go, AGPL**. (Guix, not Guix.) `just claude-md` — it needs `nickel`. The identity block below was hand-synced to the descriptiles on 2026-07-01; regenerate when `nickel` is available.) -- **Identity** — uuid `38bec2ed-bb12-44ee-9fb4-08872370c27b`; clade `UNASSIGNED` (pending gv-clade-index ratification); born 2026-06-29; forge `hyperpolymath/cicd-squabbler`. +- **Identity** — uuid `02d29e41-94bc-80c5-b741-09a9d39b858c`; clade `UNASSIGNED` (pending gv-clade-index ratification); born 2026-06-29; forge `hyperpolymath/cicd-squabbler`. - **IS** — A standalone, per-repo CI/CD **fighter**: drives a stuck branch-protection gate to a *legitimately-satisfied* green by satisfying its required checks — Rust fight engine + a SPARK-proved gate invariant. Operationalises Doctrine #5 ("squabble, don't bypass") as a detachable tool. - **IS-NOT** — a bypass tool · hypatia-dependent · a red→green code-fixer (deferred past v0.1) · a merge-commit lander (linear history only). - **Where it sits** — pipeline position **CI/CD tooling**; standalone (operationalises a doctrine, not a sibling of a larger system); coordination = `standards`. @@ -69,4 +69,4 @@ to the descriptiles on 2026-07-01; regenerate when `nickel` is available.) - **Golden path** (ANCHOR) — `just test && just quality` → Core tests pass; Quality gates pass; No unresolved critical security findings. - **State** — phase implementation; maturity beta; ~85% complete; status active. Engine + SPARK invariant + CLI real; GitHub App webhook is an honest stub. - + diff --git a/Cargo.toml b/Cargo.toml index ec0b967..bc8d186 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -9,6 +9,9 @@ members = [ "crates/squabble-app", "crates/squabble-forge", ] +# Governance builds this checker from a temporary sparse standards checkout. +# It is an independent package, not a member of the application workspace. +exclude = [".standards-js/tools/js-runtimes"] [workspace.package] version = "0.1.0" From 9f1aef00d63604c0ec7d28440804dc1ba680c173 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 16:20:46 +0000 Subject: [PATCH 3/4] ci: pass reusables only their declared secrets; make the pin check lock-aware MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * mirror.yml names the seven forge keys mirror-reusable declares, and secret-scanner.yml passes none (it declares none); `secrets: inherit` handed every repository secret to both (WH008, CodeRabbit). * workflow-linter's "Check SHA-Pinned Actions" step accepted only a 40-hex SHA in the workflow text, so every tag-pinned action that is pinned by a commit-bearing actions.lock record failed it — red on main since the lock landed. It now accepts a `uses:` whose `owner/repo@ref` has a lock record with a `commit:` line; an unlocked tag still fails (planted control verified locally). * Cargo.toml: keep standards' staged js-runtimes checkout out of the workspace (merged with the autofix's narrower exclude; the parent directory covers the sub-path). Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8 --- .github/workflows/mirror.yml | 12 ++++++- .github/workflows/secret-scanner.yml | 5 ++- .github/workflows/workflow-linter.yml | 47 +++++++++++++++++++++------ Cargo.toml | 9 +++-- 4 files changed, 58 insertions(+), 15 deletions(-) diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index c6adc7b..9d0e5cd 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -14,7 +14,17 @@ permissions: jobs: mirror: uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 - secrets: inherit + # Only the seven forge keys the callee declares (standards#1108 §6b); + # `secrets: inherit` forwarded every repository secret (WH008, zizmor + # secrets-inherit) to a workflow that asks for exactly these. + secrets: + GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} + BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} + CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }} + SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }} + DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }} + GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }} + RADICLE_KEY: ${{ secrets.RADICLE_KEY }} permissions: actions: read contents: read diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 4ebb72e..40a0e44 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -23,7 +23,10 @@ permissions: jobs: scan: uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 - secrets: inherit + # No `secrets:` block, deliberately: secret-scanner-reusable.yml @75bd5994 + # declares no caller secrets and reads no `secrets.*` context, so + # `secrets: inherit` only forwarded every repository secret to a workflow + # that never asked for one (WH008, zizmor secrets-inherit). permissions: actions: read contents: read diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 92e738b..e9b550c 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -68,21 +68,48 @@ jobs: - name: Check SHA-Pinned Actions run: | echo "=== Checking Action Pinning ===" - # Find any uses: lines that don't have @SHA format - # Pattern: uses: owner/repo@<40-char-hex> - unpinned=$(grep -rnE "^[[:space:]]+uses:" .github/workflows/ | \ - grep -v "@[a-f0-9]\{40\}" | \ - grep -v "uses: \./\|uses: docker://\|uses: actions/github-script" || true) + # Every `uses:` must resolve to a commit. Two forms count: + # 1. `owner/repo[/path]@<40-hex>` in the workflow itself; + # 2. `owner/repo[/path]@` whose `owner/repo@` record in + # .github/workflows/actions.lock carries a `commit: 'sha1-…'` + # line — that record IS the pin, and the runner resolves the + # tag through it ("Using locked action versions from the + # workflow's lockfile"). This repository is managed by + # gh actions-lock, whose convention is tag refs in YAML and + # SHAs in the lock; a lock record whose ref is itself a bare + # SHA is what GitHub rejects as an invalid lockfile pin. + # An unlocked tag ref is still unpinned and still fails. The lock's + # sync with the YAML is a separate gate (scripts/check-lock-sync.sh). + lock=.github/workflows/actions.lock + unpinned="" + while IFS= read -r line; do + ref=$(printf '%s' "$line" | sed -E 's/^[^:]+:[0-9]+:[[:space:]]*(-[[:space:]]+)?uses:[[:space:]]*//; s/[[:space:]]*#.*$//; s/^["'"'"']//; s/["'"'"']$//') + case "$ref" in + ./*|docker://*) continue ;; + esac + if printf '%s' "$ref" | grep -qE '@[a-f0-9]{40}$'; then + continue + fi + # owner/repo@ref, sub-path stripped, compared case-insensitively + # (GitHub owner and repository names are case-insensitive). + key=$(printf '%s' "$ref" | sed -E 's#^([^/@]+/[^/@]+)(/[^@]*)?@(.+)$#\1@\3#' | tr '[:upper:]' '[:lower:]') + if [ -f "$lock" ] && awk -v key="$key" ' + /^ '"'"'/ { rec = tolower($0); sub(/^ '"'"'/, "", rec); sub(/'"'"':[[:space:]]*$/, "", rec); inrec = (rec == key); next } + inrec && /^ commit: '"'"'sha1-[0-9a-f]{40}'"'"'$/ { found = 1 } + END { exit found ? 0 : 1 }' "$lock"; then + continue + fi + unpinned="${unpinned}${line}"$'\n' + done < <(grep -rnE "^[[:space:]]+(-[[:space:]]+)?uses:" .github/workflows/ --include='*.yml' --include='*.yaml') if [ -n "$unpinned" ]; then - echo "ERROR: Found unpinned actions:" - echo "$unpinned" + echo "ERROR: Found unpinned actions (neither a 40-hex SHA in the workflow nor a commit-bearing record in $lock):" + printf '%s' "$unpinned" echo "" - echo "Replace version tags with SHA pins, e.g.:" - echo " uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.1" + echo "Pin with a SHA, or lock the tag: run gh actions-lock and commit $lock." exit 1 fi - echo "All actions are SHA-pinned" + echo "All actions are pinned: by SHA in the workflow, or by a commit-bearing actions.lock record" - name: Check for Duplicate Workflows run: | diff --git a/Cargo.toml b/Cargo.toml index bc8d186..e03d63f 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -9,9 +9,12 @@ members = [ "crates/squabble-app", "crates/squabble-forge", ] -# Governance builds this checker from a temporary sparse standards checkout. -# It is an independent package, not a member of the application workspace. -exclude = [".standards-js/tools/js-runtimes"] +# standards' governance "JS runtimes" job checks its js-runtimes crate out at +# .standards-js/ inside this checkout and `cargo install`s it from there. It is +# an independent package, not a member of this workspace; without this cargo +# refuses to build it (governance run 39253292198, 2026-10-19; root fix is +# hyperpolymath/standards#1299, after which this is harmless). +exclude = [".standards-js"] [workspace.package] version = "0.1.0" From 63e29367963a33e3b6a8aa7454efad04c6042a9e Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 16:38:45 +0000 Subject: [PATCH 4/4] docs(CLAUDE.md): date the identity block's hand-sync to this revision Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8 --- CLAUDE.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CLAUDE.md b/CLAUDE.md index ce7dd0f..e4794a6 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -59,7 +59,8 @@ Deny: **Guix, Node/npm, TypeScript, Python, Go, AGPL**. (Guix, not Guix.) (This file is generated by the arrival-pack from `.machine_readable/` a2ml via `just claude-md` — it needs `nickel`. The identity block below was hand-synced -to the descriptiles on 2026-07-01; regenerate when `nickel` is available.) +to the descriptiles on 2026-10-19 (uuid moved to its ADR-008 profile C value); +regenerate when `nickel` is available.) - **Identity** — uuid `02d29e41-94bc-80c5-b741-09a9d39b858c`; clade `UNASSIGNED` (pending gv-clade-index ratification); born 2026-06-29; forge `hyperpolymath/cicd-squabbler`. - **IS** — A standalone, per-repo CI/CD **fighter**: drives a stuck branch-protection gate to a *legitimately-satisfied* green by satisfying its required checks — Rust fight engine + a SPARK-proved gate invariant. Operationalises Doctrine #5 ("squabble, don't bypass") as a detachable tool.