Repository navigation
fix(ci): check out the workflow file in security-status before the self-check - #939
Merged
Merged
Conversation
…lf-check
The "Self-check — no orphan jobs" step runs awk/sed over
.github/workflows/security-policy.yml, but the Security Status job had no
checkout step, so awk exited 2 ("cannot open file") and the aggregator
failed on main and every PR regardless of the scan results.
Add a sparse checkout of just that file as the first step, using the same
actions/checkout@v7.0.1 ref the sibling jobs use, so the per-workflow
entry in actions.lock is unchanged. needs:/if: always() are untouched.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SYkPCGtUuCvgyns6KgzyMX
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 17 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Owner
Author
|
As far as I can find, no fix PR exists for that baseline. I'm not widening this PR to cover it. I'll re-run the failed governance job once. Generated by Claude Code |
hyperpolymath
marked this pull request as ready for review
October 20, 2026 12:09
hyperpolymath
enabled auto-merge (squash)
October 20, 2026 12:09
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
5 of 6 tasks
hyperpolymath
added a commit
that referenced
this pull request
Oct 20, 2026
…940) ## Summary PR 1 of a stack that triages the 30 findings `governance / Validate Hypatia Baseline` reports on every PR (e.g. #938 job 118601725176, #939 job 118615176756). The gate doesn't run this repo's scanner. It builds hypatia at the reusable's default `hypatia-ref`, **`51ab649`**. That commit's `ActionsLock` parser accepts only v0.0.2, so this repo's tool-owned v0.0.3 `actions.lock` fails closed as 2 high findings: ``` invalid_actions_lock (workflow_audit) {:line, 4, {:unsupported_version, "v0.0.3"}} invalid_actions_lock (workflow_hardening) actions.lock failed closed: {:line, 4, ...} ``` The parser was already fixed by #938 (`aa34a4c`). This PR passes `hypatia-ref: aa34a4c…` to both standards reusables (`governance.yml`, `hypatia-scan.yml`). - `uses:` refs are unchanged, so `actions.lock` is untouched. - The value matches hyperpolymath/standards#1315, which moves the estate default to the same SHA. - Once the standards callers are re-pinned past #1315 (a `gh actions-lock` run), this input is redundant and should be dropped. ## Type of change - [x] 🔧 Build / CI / tooling ## How has this been verified? - Both reusables at the pinned `333b06a0` declare a `hypatia-ref` string input (`git show 333b06a0:.github/workflows/{governance,hypatia-scan}-reusable.yml`). - `yq` reads `hypatia-ref: aa34a4c…` from both callers. `actionlint` 1.7.7 is clean on both files, before and after. - The blast radius at `aa34a4c` was measured in standards#1315 by replaying the baseline step: on this repo it removes the 2 `invalid_actions_lock` findings and adds nothing. **The gate stays red on this PR** because of the 28 other findings. The stacked PRs fix those at their source: - WH013 rule precision for PAT-authenticated writes, plus the `inbox-steward-intake.yml` repair (masked pushes, and appended text that corrupts `.hypatia-baseline.json`); - RE005 rule precision for `trap` cleanup, plus two real masks removed; - RE004 digest pins; - RE001 harden-runner in block mode, which needs an owner `gh actions-lock` run. ## Checklist - [ ] My commits are **signed**. The session's signing shim is platform-mediated; GitHub signs the squash merge. - [x] I ran the project's own checks/tests locally and they pass (actionlint; no Elixir change). - [x] New files carry the correct SPDX (no new files). - [x] Docs are updated, and no public claim now overstates what the code does. - [x] I have not introduced a soundness hole. ## Notes for reviewers The pin now lives in two places (here and the standards default) until the re-pin. The comment in `governance.yml` says when to drop it. --- _Generated by [Claude Code](https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM)_ Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath
pushed a commit
that referenced
this pull request
Oct 20, 2026
Brings in #938 (ActionsLock v0.0.3 per-dependency hostname), #939 (security-status checks out the workflow file before its self-check) and #940 (hypatia-ref aa34a4c passed to the standards scanner reusables). Conflicts: - lib/rules/actions_lock.ex: this branch and #938 each added v0.0.3 hostname handling; the textual merge kept both, leaving this branch's clauses unreachable behind #938's. #938's parser is taken whole (it checks the hostname grammar, the version and duplicates), and this branch's one other addition, workflow_refs/2 (PI004 per workflow), is re-applied on top. - test/rules/actions_lock_test.exs: a hostname line in a v0.0.2 lock is {:hostname_not_in_version, "v0.0.2"} under #938, not :malformed_dependency_entry. - .github/workflows/hypatia-scan.yml: #940's `with: hypatia-ref` input and this branch's secrets comment, both kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8
This was referenced Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Security Status(security-statusin.github/workflows/security-policy.yml) fails onmainand on every PR: for example main runs 39357599189, 39339043314, 39323370164 and 39276944530, and job 118603122869 on #938.Its first step, "Self-check — no orphan jobs", runs
awk/sedover.github/workflows/security-policy.yml, but the job has no checkout step. So the step exits 2 withawk: fatal: cannot open file '.github/workflows/security-policy.yml', and the job fails whatever the scans found.Change
sparse-checkout: .github/workflows/security-policy.yml,sparse-checkout-cone-mode: false,persist-credentials: false).actions/checkout@v7.0.1, the same ref every sibling job in this file uses. That ref is already in this workflow'sactions.lockentry, so the lockfile is unchanged and did not need regenerating.needs:andif: always()alone.Validation (local)
jobs in workflow: 9and thenok: every non-aggregator job is named in the aggregator's needs.actionlint1.7.7 on the file before and after the change: no findings either time.Done when, on this PR: Security Status is green, its self-check log shows the
ok:line, andgovernance / Actions lockfile verifystays green.Generated by Claude Code