Repository navigation
fix(rules): accept gh actions-lock format v0.0.3 (adds optional dependency hostname) - #927
Open
hyperpolymath wants to merge 6 commits into
Open
hyperpolymath wants to merge 6 commits into
hyperpolymath wants to merge 6 commits into
Conversation
…mmar Dependabot #926 regenerated .github/workflows/actions.lock as `version: 'v0.0.3'`. Hypatia.Rules.ActionsLock accepted only v0.0.2, so the repository's own lock stopped parsing: {:line, 4, {:unsupported_version, "v0.0.3"}}. That failed "parses the repository's authoritative generated lockfile" and turned E2E and Integration red on main from 5173ca7 on. The v0.0.3 file has exactly the v0.0.2 line shapes; only the version line and the pins changed. So v0.0.3 is accepted under the same grammar, and the parser stays fail-closed: any line shape v0.0.3 might add is still refused until the grammar is extended with a fixture. The parsed struct now records which version it read. Tests: v0.0.3 accepted and associated per workflow; a malformed or unknown line in a v0.0.3 lock still fails closed; v0.0.4 is refused (negative control); a second version line is refused even when both are supported. With the old parser, 4 of these 17 tests fail. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0165rGu3tsKmJtevmrdMVyfJ
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 59 minutes. View limit details
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Summary
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description check |  |
The description clearly explains the v0.0.3 parsing issue, the implemented fix, test coverage, validation results, and known out-of-scope failures. |
| Title check | |
The title clearly and concisely identifies the main change: support for GitHub Actions lockfile format v0.0.3 using the existing v0.0.2 grammar. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files. (1 skipped: 1 unsupported.)
✨ Finishing Touches
-
📝 Generate docstrings
-
- 🤖 Coding Agent task started for docstring generation.
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Owner
Author
|
CI on 8c70197. The target of this PR passes: E2E — Elixir Scanner Pipeline is green (it was red on main from 5173ca7). The red checks below don't come from this diff, which touches only 1. Every job that calls a shared workflow from
2.
3. Rust License & Ban Check / Rust Dependency Audit: these were already red on main ( I haven't re-run anything. All three are deterministic: the job-setup lockfile check, a cache hit on the stale build, and the cargo-deny/audit findings. The first already fails the same way on main. Generated by Claude Code |
hyperpolymath
marked this pull request as ready for review
October 19, 2026 12:13
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
hyperpolymath
enabled auto-merge (squash)
October 19, 2026 15:06
Contributor
|
Add Carrot credits or activate Agent usage billing to use Autofix |
Contributor
|
ℹ️ No failing CI checks found. No CI/CD pipeline failures were detected for the current commit. If other checks (security scans, code quality, etc.) are failing, those require separate attention. |
…-codegen-drift.txt, GitHub Actions: Hypatia Security Scan / 0_hypatia _ Hypatia Neurosymbolic Analysis.txt, GitHub Actions: Secret Scanner / 0_scan _ shell-secrets.txt, GitHub Actions: Secret Scanner / 1_scan _ gitleaks.txt, GitHub Actions: Secret Scanner / 2_scan _ rust-secrets.txt, GitHub Actions: Security / 3_Rust License & Ban Check.txt, GitHub Actions: Security / 5_Rust Dependency Audit.txt, GitHub Actions: Governance / 1_governance _ Trusted-base reduction policy.txt, GitHub Actions: Governance / 2_governance _ Debt ratchet.txt, GitHub Actions: Governance / 3_governance _ Actions lockfile verify.txt, GitHub Actions: Governance / 4_governance _ Licence consistency.txt, GitHub Actions: Governance / 5_governance _ Live Actions policy (credentialed advisory).txt, GitHub Actions: Governance / 6_governance _ Exemption ratchet.txt, GitHub Actions: Governance / 7_governance _ Workflow security linter.txt, GitHub Actions: Governance / 8_governance _ Well-Known (RFC 9116 + RSR).txt, GitHub Actions: Governance / 9_governance _ Allowlist Preflight.txt, GitHub Actions: Governance / 10_governance _ Code quality + docs.txt, GitHub Actions: Governance / 11_governance _ Security policy checks.txt, GitHub Actions: Governance / 12_governance _ Guix packaging policy (Nix retired).txt, GitHub Actions: Governance / 13_governance _ Language _ package anti-pattern policy.txt, GitHub Actions: Governance / 14_governance _ Check Workflow Staleness.txt Co-Authored-By: CodeRabbit <noreply@coderabbit.ai>
Contributor
hyperpolymath
added a commit
that referenced
this pull request
Oct 19, 2026
## What broke `ubuntu-latest` moved to the 26.04 image. The cached `~/.idris2` holds an `idris2.so` compiled by the previous image's Chez Scheme, and a fasl-object only loads under the Chez that wrote it. Every cache hit now dies: ``` Exception: incompatible fasl-object version 0.0.0-pre-release.73 found in /home/runner/.idris2/bin/idris2_app/idris2.so ##[error]Process completed with exit code 255. ``` So `abi-codegen-drift` (a required check) is red on every PR, e.g. [#927](#927), job 118048140403. The cache key did not name Chez, so the stale build kept being restored. ## The fix The installed `chezscheme` package version is now part of the key, in both workflows that deliberately share one cache entry: - `.github/workflows/abi-codegen-drift.yml` - `.github/workflows/verify-proofs.yml` An image or package change now rebuilds Idris 2 once (~20 min on the first run) instead of loading a stale build. `verify-proofs.yml` has the same latent failure; it just hasn't run on the new image yet (it only runs for PRs targeting main touching its paths, and on schedule). ## Verification - Both files parse as YAML; no new action is introduced, so `actions.lock` is unaffected. - **Not verified locally:** this is a CI-only change. The first run on this PR rebuilds Idris 2 from source, which is the real test. If `abi-codegen-drift` is green on this PR, the fix works. Separate from #927 on purpose, which only touches the lockfile parser. --- _Generated by [Claude Code](https://claude.ai/code/session_0165rGu3tsKmJtevmrdMVyfJ)_ Co-authored-by: Claude <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e9040f00a6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ed deny.toml Codex review of #927 was right: the published v0.0.3 schema (github/actions-lockfile, schema/lockfile-v0.0.3.json) is the v0.0.2 shape plus an optional dependency-level `hostname`, written for pins that are not on the lock's home host (GHE.com data residency). I had inferred the grammar from one lockfile that happens not to use it, so a valid generated lock with a hostname line was refused as malformed. The parser now accepts `hostname: '<host>'` in v0.0.3 only, and only as github.com or a lowercase <tenant>.ghe.com (the schema's pattern); a malformed, repeated, or v0.0.2 hostname still fails closed. The value is recorded on the dependency. pinned?/3 and the identity checks still ignore the host, which the moduledoc states. Also removes deny.toml, which CodeRabbit's autofix added to this PR. It is outside this change, and its `unmaintained = "none"` silences unmaintained advisories entirely instead of keeping them advisory-only (Codex's second finding). The cargo-deny job fix belongs in its own change. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0165rGu3tsKmJtevmrdMVyfJ
hyperpolymath
changed the title
Codex review of #927 was right: the published v0.0.3 schema (github/actions-lockfile, schema/lockfile-v0.0.3.json) is the v0.0.2 shape plus an optional dependency-level `hostname`, written for pins that are not on the lock's home host (GHE.com data residency). I had inferred the grammar from one lockfile that happens not to use it, so a valid generated lock with a hostname line was refused as malformed. The parser now accepts `hostname: '<host>'` in v0.0.3 only, and only as github.com or a lowercase <tenant>.ghe.com (the schema's pattern); a malformed, repeated, or v0.0.2 hostname still fails closed. The value is recorded on the dependency. pinned?/3 and the identity checks still ignore the host, which the moduledoc states. (The previous commit, cce739d, only removed the bot-added deny.toml; the parser change was left unstaged by mistake and is in this commit.) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0165rGu3tsKmJtevmrdMVyfJ
Owner
Author
|
Correction to my two review replies above: they said the Generated by Claude Code |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e1b7f514f4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…cy host Codex review of #927: the v0.0.3 schema defines owner_id and repo_id "on the recorded hostname", but the identity checks compared every dependency regardless of host. A valid GHE lock with the same owner name on a tenant and on github.com (different IDs, or coincident repo IDs) was rejected as an identity mismatch, invalidating the whole lock. The checks now compare only among dependencies recorded on the same host; an omitted hostname is its own scope. Test: the same owner with different IDs is a mismatch on one host and accepted across hosts (fails without the change). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0165rGu3tsKmJtevmrdMVyfJ
This was referenced Oct 19, 2026
Merged
Merged
Merged
hyperpolymath
added a commit
to hyperpolymath/standards
that referenced
this pull request
Oct 19, 2026
…1303) ## What this is Follow-up to #1298, which merged the work orders at v1.2.0 plus CodeRabbit's agent edit (`c932c96e`). Fifteen findings were posted on that PR after its last reviewed head and before the merge: three by CodeRabbit (applied by its agent in `c932c96e`, refined here) and twelve by Codex across three rounds. Each was verified against the tree before being written in. Same file, same authority (applied-unless-struck, D113; prose, CC-BY-SA-4.0). The branch is the designated one restarted after the squash; a clean restart needed a force-push this session may not make, so `7406ac7d` merges `main` and keeps v1.3.0 where both sides added the file. The diff against `main` is the v1.3.0 to v1.4.3 deltas alone: one file. ## Dispositions (v1.3.0) | Finding | Where | Disposition | |---|---|---| | Pre-push gate requires post-push states (Codex P1, line 54) | Session mechanics | The gate is the locally runnable part of an acceptance block; "after push", "On the PR", "after merge" lines are recorded as they land. | | Root-level touches make the scoped guard the repo-wide run, which exits 1 at the baseline (Codex P1, line 51) | Session mechanics | Exit 1 at the 443 baseline is accepted; see v1.4.0 below for the set-based gate that replaced count equality. | | Keep the repo-wide link-rot check (CodeRabbit, line 51) | Session mechanics | Kept, with the expected result stated. | | Archive README: the scoped guard on `9-archive/` scans the archive and reports 272 (Codex P1, line 366) | WO-4 | Never run the guard on the archive alone; the repo-wide run from a checkout named `standards` is the gate, plus the new file's links by eye. 272 verified. | | Empty pathspec from the default input breaks every other caller (Codex P1, line 386) | WO-4 | Append only when non-empty (bash array), prove the default arm locally. | | `check-package-policy.sh` walks the archive; ten manifests there could satisfy the policy (Codex P2, line 337) | WO-4 | Added as the eleventh validator; `find_first` noted. Verified: ten `manifest.scm`/`guix.scm`/`Containerfile` under the archive. | | `files = 1136` goes stale (Codex P2, line 366) | WO-4 | Raise to 1137; Gate D does not count files, the map must still be true. | | Fallback test must run under `bun test` (Codex P2, line 456) | WO-5 | Done; the file imports from `bun:test`. | | All seven drafts call themselves draft/to-do/in-progress (Codex P2, line 494) | WO-6 | The owner disposes of each ("file" or "discard"); silence means they stay; new owner item. Verified status lines. | | `TOPOLOGY.adoc` is a frozen snapshot (Codex P2, line 545) | WO-7 | Moved to bucket C (archived by P2.4); count becomes 440; the one remaining manifest link is TOPOLOGY's. | | `ROADMAP.adoc` 103 describes the AI Gatekeeper Protocol (Codex P2, line 541) | WO-7 | Moved to bucket B (D338). | | Zero-reference loop exits 1 in the desired state (Codex P2, line 586; CodeRabbit, lines 252–253 and others) | Acceptance blocks | CodeRabbit's agent rewrote them in `c932c96e`; kept. | | Plan README line 69 says "Deno and Python banned" outside any row (Codex P2, line 115) | WO-8 | Rewritten in place; both prose files grepped. | | GitLab's `could not be found` is ambiguous (CodeRabbit, lines 226–230; Codex P1 earlier) | WO-2 | The probe is a diagnostic only, never a skip: a deploy key cannot tell absent from forbidden, and the `*_MIRROR_ENABLED` variable is the one legitimate skip. CodeRabbit's "forge-specific evidence" rewrite is withdrawn too: it needs a second credential per forge for a question the variable already answers. | ## Review rounds on this PR v1.4.0 (`559d3a8e`): Codex posted five findings on `7406ac7d`; all five verified and taken. | Finding | Disposition | |---|---| | Both reusables pin `hypatia-ref` to a vetted SHA; the upstream fix clears nothing by itself (P1) | The known-red paragraph now gives the two steps: hypatia#927 or #928 merges, then both `hypatia-ref` defaults advance past it (a two-line PR here, no `uses:` change). New owner item. My "resolves at HEAD" claim was wrong and is corrected on #1298 too. | | Count equality with `origin/main` blocks WO-7's intended reduction (P1) | The gate compares sets: save the guard's output before the first edit, require no new BROKEN line; repairs show as removals. A touched file may keep its old broken links (ai-instruction's README has six others). | | A bare `-o -name 9-archive` in `check-package-policy.sh` weakens every caller (P2) | One opt-in input, `policy_exclude_dir`, feeds the language block's pathspec and a `PKG_PRUNE_DIRS` hook in the script; the shared copy is unchanged by default; four default-arm runs required. | | `test ! -d .github/ISSUES` fails in the supported silence case (P2) | Out of the pre-push gate; while drafts wait, the gate is that the directory is untouched. | | WO-8's plan check cannot pass with the historical Deno rows (P2) | Only live claims are forbidden; issue-triage rows keep their titles with the dated note. | v1.4.1 (`5d5c7bbc`): Codex posted one finding on `559d3a8e`, verified and taken: `diff … | grep '^>'` exits 1 in the desired state, so the three gate lines now read `! diff "$before" <(…) | grep -q '^>'` (exit 0 when no new BROKEN line), proved on synthetic output. v1.4.2 (`15fb14d9`): Codex posted one finding on `5d5c7bbc`, verified and taken: under `set -o pipefail`, diff's own exit 1 (the outputs differ) replaced grep's verdict as the pipeline status, so the inverted gate passed a new BROKEN line, and WO-7's count printed 3 but returned 1. All four uses now wrap diff as `{ diff "$before" <(…) || true; }` so grep alone decides; proved with and without pipefail (unchanged 0, repairs 0 with count 3 and exit 0, added 1, mixed 1). The revision line, which v1.4.1 had left at v1.4.0, now reads v1.4.2. v1.4.3 (`8aa2e177`): Codex posted two findings on `15fb14d9`; both verified and taken. | Finding | Disposition | |---|---| | WO-7's raw `link-rot-guard.sh . \| grep '0-AI-MANIFEST'` returns 1 under pipefail, the guard exiting 1 at 440 (P2) | Wrapped as `{ … \|\| true; } \| grep`; proved on the tree (old form 1, new form 0). No other line pipes the guard raw. | | An enabled forge whose `*_SSH_KEY` secret is empty hits a notice-only "Skipped" step and stays green, so "skipped by its variable or red" was false (P2) | Retained as the second legitimate skip: all seven forge jobs carry the step, the reusable's Radicle comment calls the secret the second switch, and the regularisation design (line 107) counts 142 estate callers skipping this way with the question marked `OWNER?`. WO-2 records the facts, keeps the seven steps (`grep -c 'not configured)' -> 7`) and names three honest outcomes. New owner item: red is labelled the elegant arm, with the reasons the order departs from it. | Found while re-reading WO-2's block: `grep -c 'continue-on-error'` would have counted the comment at line 121, which the order keeps because it names the owner action. The check is now anchored to the key (`^[[:space:]]*continue-on-error:`): 2 on the tree today, 0 after the order. ## A third known red on `main`, recorded for the executor `scan / Hypatia Neurosymbolic Analysis` and `governance / Validate Hypatia Baseline` are red on `main` at every commit since #1300 regenerated `actions.lock` in `gh actions-lock` format v0.0.3 (`version:` line 4, plus `commit`/`owner_id`/`repo_id` on dependencies). Hypatia's `lib/rules/actions_lock.ex` accepts v0.0.2 only, so the gate sees two `invalid_actions_lock` findings at severity high. The fix takes two steps: hyperpolymath/hypatia#927 or #928 merges, then the `hypatia-ref` defaults in `governance-reusable.yml` and `hypatia-scan-reusable.yml` (vetted SHAs that the local callers do not override) advance past it. This PR shows the same red on its head, as its base `a85aa8e7` does on `main`. The work orders say so, and say never to acknowledge it in the baseline. ## Acceptance (local, on `8aa2e177`) ``` bash scripts/link-rot-guard.sh docs/reorg/2026-10-14-tidy -> all internal links resolve bash scripts/check-launcher-standard-currency.sh --root . -> no stale references bash scripts/check-canonical-names.sh origin/main -> no deprecated names reintroduced bash scripts/check-standards-map.sh -> GATE D PASSED git diff --check -> clean { bash scripts/link-rot-guard.sh 9-archive || true; } | grep -c '^BROKEN' -> 272 (the figure the order quotes) ``` Known reds that are not this PR's: the Debtfile `deno-residue` breach (WO-8 retires it) and the Hypatia gate above. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7 --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What broke
Dependabot #926 regenerated
.github/workflows/actions.lockasversion: 'v0.0.3'.Hypatia.Rules.ActionsLockaccepted onlyv0.0.2, so the repository's own lockfile stopped parsing ({:unsupported_version, "v0.0.3"}). That one failing test made E2E — Elixir Scanner Pipeline and Integration Tests red on main from5173ca7.The fix
The published v0.0.3 schema (github/actions-lockfile
schema/lockfile-v0.0.3.json) is the v0.0.2 line shape plus one optional dependency field,hostname, written for pins that are not on the lock's home host (GHE.com data residency).@supported_versions ["v0.0.2", "v0.0.3"]); the struct records which version it read.hostname: '<host>'is accepted in v0.0.3 only, and only asgithub.comor a lowercase<tenant>.ghe.com(the schema's pattern). Malformed, repeated, or v0.0.2 hostnames fail closed. (An earlier revision of this PR assumed no new fields; Codex caught that.)pinned?/3and the repo-identity checks key onowner/repo@refand ignore the host.Tests
describe "format v0.0.3": accepted and associated per workflow; malformed/unknown lines still fail closed;v0.0.4refused (negative control); a second version line refused; hostname accepted/recorded, and malformed/repeated/v0.0.2 hostname refused. With the old parser, 6 of the 19 tests intest/rules/actions_lock_test.exsfail.mix test:1831 tests, 0 failures, 242 excluded(main: 1825 tests, 1 failure)bash tests/e2e.sh:PASS=9 FAIL=0 SKIP=0What this does not fix
hyperpolymath/standardsgovernance-reusable.yml(HYPATIA_PIN=0e913426…, 153 commits behind main), not this code. It stays red until standards moves that pin past this fix, for every caller repo whose lock is v0.0.3.invalid lockfile pinforactions/checkout@3d3c42e…(allgovernance /,scan /,hypatia /jobs, and OSSF Scorecard since 2026-10-16) fails inside GitHub's runner. Regenerateactions.lockwithgh actions-lock.HYPATIA_DISPATCH_PATsweeps are red on main for unrelated reasons.docs/rules/catalogue.adocstill says "v0.0.2 files"; it is generated and regenerating it picks up unrelated drift.