Repository navigation
fix(ci): read workflows as KYAML as well as block YAML (S4 prerequisites) - #436
Merged
hyperpolymath merged 1 commit intoOct 14, 2026
Conversation
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 23 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
marked this pull request as ready for review
October 14, 2026 09:12
hyperpolymath
added this pull request to stack #434
October 14, 2026 09:13
…tes)
Workflows move to KYAML (YAML-POLICY §3.4) once the standards#1025 gate
is met. Three local checks read workflows line by line and give wrong
answers on the KYAML that `yq -o kyaml` writes:
- check-workflow-duplicate-keys.sh flagged every KYAML workflow. KYAML
marks a sequence item with `{`, not `- `, so sibling steps looked like
duplicates. A bare `{` now opens a fresh scope. `}`/`]` lines name no
key, and a quoted scalar item ("echo: hi",) is no longer read as a key.
- check-allow-fail-expiry.sh counted `continue-on-error: false,` as an
allow-fail unit (trailing comma) and missed a quoted key. Both are
handled. yq keeps the same-line `# allow-fail:` mark through the
conversion.
- test-issue-regressions.sh tested `^permissions:`. KYAML indents
top-level keys inside the root `{`. Top-level `permissions` is now read
with yq. The script refuses any yq but mikefarah v4: the `yq` on this
container's PATH is the Python jq wrapper, which D293 rules out.
New KYAML fixtures cover a duplicate `with`, a clean multi-step file,
quoted scalar items, allow-fail units, top-level permissions, and a
job-level `permissions` that must not count. Against the old checkers
the suite fails, and with the new ones it passes. Every real workflow
passes both as committed and as rendered by `yq -o kyaml`, with 35 clean
files and 14 allow-fail units each.
Not in this change: the governance-reusable pin bump. It needs
`gh actions-lock` to regenerate actions.lock, which needs an
authenticated GitHub token this session lacks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
hyperpolymath
force-pushed
the
claude/new-session-th4e9w-s4
branch
from
October 14, 2026 10:37
bbdd4c2 to
a4c54e2
Compare
hyperpolymath
added a commit
that referenced
this pull request
Oct 14, 2026
…w, owner norms [stack 3/3] (#435) ## Summary Stack 3 of 3. #432 and #433 have merged, so this PR now targets `main`. It holds the ECH-05 follow-ups the owner decided after #430 merged, plus the owner's norms written down where agent sessions read them. **History rebuilt, 2026-10-14 (owner decision: force-with-lease).** The branch used to carry the pre-squash copies of #432 and #433. Rebase-merge replayed them onto `main`, which already had the squash commits, and conflicted on `.hypatia-baseline.json`. The branch is now this PR's own four commits on current `main` (5583c70), so it rebase-merges cleanly. Its tree is byte-identical to the old head (75288e7) merged with `main`. ## Changes - **`tests/fixtures/arbitration_regression.json` → JCS** (RFC 8785) I-JSON plus a final LF. - It is re-serialised, not regenerated. All 327 numbers, and the whole document, compare equal to the fixture recorded at `29b18ea`; only spellings change (`0.0` → `0`). This is the source of the large deletion count. - The regenerator now writes JCS. - A new test, `fixture_is_jcs_canonical`, keeps it canonical. A pretty-printed fixture fails it; I ran that negative control. - **ROADMAP stage 6 and the gap-analysis pair table:** HOL4 ↔ HOL Light through OpenTheory is the first target (owner decision, 2026-10-14). Lean 4 ↔ Rocq through Dedukti is the next candidate. - **`issues/README.md`:** ECH-05 is #431, closed as completed by #430, and is the arbiter-typing slice of #429, which stays open. - **`.claude/CLAUDE.md`, owner norms:** - decisions are asked with the selector tool; - work lands as stacked PRs; - findings are fixed at source. The exemption ratchet admits ledger growth only with a `Ratchet-exception:` line naming the ledger. - The format standards point at their normative source in standards: `YAML-POLICY.adoc` (KYAML, `.kyaml`; D280/D307/D293), the workflow gate in standards#1025, `JSON-POLICY.adoc` (I-JSON as JCS; D306) and ADR-008 (UUID v8; D305/D305b/D320). - The UUID rule is scoped until the `ids.rs` migration lands. `ids.rs` still mints v7 records and v8 content ids without a domain. This is the wording the owner accepted on proof-burrower#111. ## RSR Quality Checklist ### Required - [x] Tests pass (`cargo test --test arbitration_regression_test`: 2 passed, 1 ignored) - [x] Code is formatted (`cargo fmt --all -- --check`) - [x] Linter is clean - [x] No banned language patterns - [x] No `unsafe` blocks - [x] No banned functions - [x] SPDX license headers present on all new/modified source files - [x] No secrets, credentials, or `.env` files included ### As Applicable - [x] `docs/ROADMAP.adoc` updated (stage 6 first target) - [x] Documentation updated - [ ] Others: n/a ## Testing ``` $ cargo test --test arbitration_regression_test test numeric_fusion_unchanged_and_level_is_belief ... ok test fixture_is_jcs_canonical ... ok negative control: pretty-printed fixture → fixture_is_jcs_canonical FAILED ("fixture must be JCS (RFC 8785) canonical") jq: 327 numbers equal, documents equal (29b18ea fixture vs JCS fixture) ``` ## Stack 1. #432: `quinn-proto` lockfile bump (merged) 2. #433: Hypatia findings fixed at source, baseline → JCS (merged) 3. **This PR**: ECH-05 follow-ups and owner norms 4. #436: workflow checkers read KYAML (S4), stacked on this PR 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This is stack PR 4, on #435. It covers the prerequisites that let workflows move to KYAML (YAML-POLICY §3.4) without breaking the repo's own checks. It converts no workflow. The conversion waits on the standards#1025 gate.
History rebuilt, 2026-10-14 (owner decision: force-with-lease). This PR is now one commit on #435's rebuilt branch, with no merge commits, so it rebase-merges cleanly. Its tree is byte-identical to the old head (bbdd4c2) merged with
main. On that tip, which also has #437's linter change, the checks pass:test-issue-regressions.sh, the duplicate-key check (35 files clean) and the allow-fail check (14 units).Changes
Three local scripts read workflows line by line. Each one was wrong on the KYAML that
yq -o kyamlwrites:check-workflow-duplicate-keys.sh{lines with no-, so sibling steps looked like duplicate keys.{opens a fresh scope.}/]lines name no key. A quoted scalar item ("echo: hi",) is not a key.check-allow-fail-expiry.shcontinue-on-error: false,as an allow-fail unit because of the trailing comma. Missed"continue-on-error":.# allow-fail:mark through the conversion.test-issue-regressions.sh^permissions:cannot see a top-level key indented inside the root{.permissionswith yq. Refuses any yq but mikefarah v4, because theyqon PATH can be the Python jq wrapper (D293).Verification
test-issue-regressions.sh:with(must fail);with:scalar items (must pass);false,not counted while a quoted key is counted;yq -o kyaml, with 35 files clean and 14 allow-fail units each time.yqis the Python wrapper.Not here
@571cc734still testsgrep -q "^permissions:". It has to move to a standards ref that reads workflows with yq before any workflow is converted. That bump has to regenerate the tool-ownedactions.lock.gh actions-lockwrites GitHub owner and repo ids and needs an authenticated token, which this session doesn't have.🤖 Generated with Claude Code
https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
Generated by Claude Code