fix(ci): the pinning check accepts refs that actions.lock resolves by hyperpolymath · Pull Request #81 · hyperpolymath/network-ambulance

hyperpolymath · 2026-10-19T22:10:03Z

Why

Workflow Security Linter's "Check SHA-Pinned Actions" step requires an inline 40-hex SHA on every uses: line. This repository pins its actions with tag refs that actions.lock resolves, so the step rejects every one of them. That keeps the linter red on main whatever else it finds. This is the second failing step, after the SPDX check that #80 fixes.

What

The step now runs scripts/check-action-pinning.js, copied unchanged from rsr-template-repo (ec33724). A ref passes when it is an inline SHA or when actions.lock resolves it.
The script runs under Bun 1.4.2, the estate pin. A new "Install verified Bun 1.4.2" step downloads it from the release archive and checks its sha256, as ci(workflow-linter): install Bun 1.4.2 verified, not via setup-bun rsr-template-repo#249 now does in the template.
- bf2a196 first used the template's oven-sh/setup-bun@v2.2.0 with bun-version: latest. SonarCloud failed this PR on that tag-pinned third-party action ("C Security Rating"), and the runtime was unpinned. 9d13eba replaces it, on the owner's call.
- actions.lock is unchanged from main.
One change from the template: the example in the error message now labels actions/checkout@3d3c42e… as v7.0.1, which is what this repository's lock records. The template says v6.0.1.

Tested

The script passes on this branch's workflows: "all action refs are pinned".
It fails on a planted uses: some-org/unlocked-action@v1.
I extracted the Bun step from the workflow and ran it with a scratch RUNNER_TEMP whose path contains a space. The checksum printed OK and bun --version prints 1.4.2.
standards' validate-actions-lock.sh (75bd599) passes on the lock.

Merge order

The owner's order is #79 → #82 → #80 → #81 → #78. This PR and #80 change different steps of the same workflow, so they don't conflict. The linter goes fully green only once both are in. scan and hypatia also need the estate re-pin to standards 75bd599.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t

"Check SHA-Pinned Actions" required an inline 40-hex SHA on every `uses:` line. This repository pins with tag refs that actions.lock resolves, so the step rejected all of them and Workflow Security Linter was red on main whatever else it found. The step now runs scripts/check-action-pinning.js, copied unchanged from rsr-template-repo (ec33724). A ref passes if it is an inline SHA or if the lock resolves it. The workflow gains the template's "Set up Bun" step, and actions.lock gains the oven-sh/setup-bun@v2.2.0 record with the template's commit, owner and repo ids. One change from the template: the example in the error text labels the checkout SHA v7.0.1, which is what this repository's lock records; the template says v6.0.1. Checked: the script passes on main's workflows (15 refs resolve through the lock) and fails on a planted unlocked ref; standards' validate-actions-lock.sh passes on the new lock. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t

coderabbitai · 2026-10-19T22:10:13Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 91662308-8c54-402e-a2c9-824b7a6da826

📥 Commits

Reviewing files that changed from the base of the PR and between 695948f and fa6a38f.

📒 Files selected for processing: 2

.github/workflows/workflow-linter.yml
scripts/check-action-pinning.js

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector · 2026-10-19T22:12:58Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-19T22:12:52.889252Z	`bf2a196`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-10-19T22:13:01Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

hyperpolymath · 2026-10-19T22:46:58Z

CI on bf2a196, check by check:

lint-workflows stops at "Check SPDX Headers", which reports all 21 workflows. Their licence line sits under the actions-lock banner, and the step only reads line 1. The pinning step this PR changes never runs. fix(ci): SPDX check accepts the licence after the actions-lock banner #80 fixes the SPDX check at its source. Once fix(ci): SPDX check accepts the licence after the actions-lock banner #80 is in main, this job reaches the pinning step.
Unit Tests, ShellCheck, Integration Tests, the distro matrix, Docker Build Test fail on main's SCRIPT_DIR bug (src/utils/utils/privileges.sh: No such file or directory), fixed by fix: sourced modules no longer overwrite the caller's SCRIPT_DIR #79. The distro package installs are fixed by fix(ci): distro jobs install their packages again #82.
scan / *, hypatia stop at startup with "invalid lockfile pin" on the standards reusables. They need the estate re-pin to standards 75bd599, which waits on the owner.
SonarCloud fails "C Security Rating on New Code" on one finding: workflow-linter.yml:67, "Use full commit SHA hash for this dependency", for oven-sh/setup-bun@v2.2.0. actions.lock pins that action to commit 0c5077e5, but Sonar reads only the workflow. The template's linter has the same step, so the fix belongs there first. I've put the options to the owner.

None of these is a flake, so nothing was re-run.

Generated by Claude Code

Port of rsr-template-repo#249. SonarCloud failed this PR's quality gate ("C Security Rating") on oven-sh/setup-bun@v2.2.0, a third-party action pinned by tag, and bun-version: latest left the runtime unpinned. The linter now downloads the Bun 1.4.2 release archive and checks its sha256. The setup-bun lock edge and record this PR added go with it, so actions.lock is unchanged from main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t

) ## Summary The workflow linter installed Bun with `oven-sh/setup-bun@v2.2.0` and `bun-version: latest`, so its runtime was unpinned. SonarCloud also gives a third-party action pinned by tag a "C" Security Rating ("Use full commit SHA hash for this dependency"), even though `actions.lock` pins its commit. hyperpolymath/network-ambulance#81 copied the step and fails its quality gate on exactly that finding. Per the owner's call, the fix goes in here first and is then ported. The linter now downloads the Bun 1.4.2 release archive (the estate pin) and checks its sha256, the way Estate Rules installs nickel, just and yq. ## Changes - `workflow-linter.yml`: the "Set up Bun" step is replaced by "Install verified Bun 1.4.2": an HTTPS-only `curl`, then `sha256sum --check --strict`, `unzip`, and the directory appended to `$GITHUB_PATH`. The digest is the same one gv-clade-index's worker CI uses, and I recomputed it from the release archive. - `actions.lock`: the linter's edge to `oven-sh/setup-bun@v2.2.0` is removed. The `setup-bun@v2.2.0` dependency record stays, because the commented Bun steps in `e2e.yml.template` say they resolve through it. `check-lock-sync.sh` notes it as unreferenced, which it calls harmless. The SHA-keyed setup-bun leaf under the standards reusables is untouched. - `CHANGELOG.adoc`: entry under Unreleased / Changed. ## RSR Quality Checklist ### Required - [x] Tests pass (`just test` or equivalent): see Testing - [ ] Code is formatted (`just fmt` or equivalent): not run, YAML step only - [x] Linter is clean (no new warnings or errors) - [x] No banned language patterns (no Python, Go, TypeScript or ReScript; JavaScript runs Bun > Deno > pnpm > npm) - [x] No `unsafe` blocks without `// SAFETY:` comments - [x] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`, `Admitted`, `sorry`) - [x] SPDX license headers present on all new/modified source files (no headers changed) - [x] No secrets, credentials, or `.env` files included ### As Applicable - [x] `CHANGELOG` or release notes updated ## Testing - I extracted the new step from the workflow and ran it with a scratch `RUNNER_TEMP` whose path contains a space. The checksum printed `OK` and the step added `bun-linux-x64` to `GITHUB_PATH`. `bun --version` there prints `1.4.2`, and `bun scripts/check-action-pinning.js` under it prints "all action refs are pinned". - `scripts/check-lock-sync.sh .github/workflows` passes, with one "unreferenced, harmless" note for the kept record. - Standards' `validate-actions-lock.sh` at `75bd599` passes. - `tests/workflows/archetype_lock_merge_test.sh` and `tests/workflows/validate_workflows_test.sh` pass. - `scripts/check-adoc-renders.sh .` passes: all 160 tracked `.adoc` files render clean under asciidoctor 2.0.26. - Not run here: the linter job on GitHub's runner. This PR's own CI covers that. --- _Generated by [Claude Code](https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t)_ Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>

coderabbitai · 2026-10-20T00:36:32Z

Add Carrot credits or activate Agent usage billing to use Autofix

## Summary On main, `network-repair --help` exits 1 on every distribution in Distribution Matrix Tests and in Tests: ``` src/main.sh: line 17: .../src/utils/utils/privileges.sh: No such file or directory ``` Every module that `src/main.sh` sources starts by assigning the global `SCRIPT_DIR` to its own directory. That covers `utils/logging.sh` and everything in `diagnostics/` and `repairs/`. Once main.sh has sourced `utils/logging.sh`, `SCRIPT_DIR` is `src/utils`, so main.sh's next `source` resolves under `src/utils/utils/`. ## Changes - **8800119.** Each sourced module resolves the directory it needs into its own name and leaves `SCRIPT_DIR` to `main.sh`: - `NR_UTILS_DIR` is always `src/utils`, whichever module sets it. - `repairs/routing.sh` sets `NR_REPAIRS_DIR`, because two of its functions re-source `interfaces.sh` at run time. - **7895d9c** (CodeRabbit): - Diagnostics that find issues no longer abort `diagnose` under `set -e`. - The safe-mode test reads `diagnose`'s output once. - The colour test accepts empty colours when stdout is not a terminal. - Two ShellCheck warnings are fixed. - **45da73d** (CodeRabbit): comments in `repairs/routing.sh`. - **4270e56:** a regression test. Sourcing any module from a fresh shell must leave the caller's `SCRIPT_DIR` alone. The test fails on main. ## Testing | Check | main | this PR | |---|---|---| | `./network-repair --help` / `--version` | exit 1 | exit 0 | | `tests/run-tests.sh` | 20/25 | 25/25 | | `tests/test-utils.sh` | fails | passes | | `shellcheck -S warning` on `src/` | 2 warnings | clean | | CI: Unit Tests, ShellCheck, Integration (ubuntu 20.04/22.04/24.04, debian:12), most distro jobs | red | green | ## Still red here, fixed elsewhere - `lint-workflows`: fixed by #80 (SPDX) and #81 (pinning). - Debian 11, Rocky/Alma 9 and openSUSE installs: fixed by #82. - `scan / *` and `hypatia`: these need the estate re-pin of the standards workflows (75bd599). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

sonarqubecloud · 2026-10-20T12:36:45Z

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

hyperpolymath mentioned this pull request Oct 19, 2026

fix: sourced modules no longer overwrite the caller's SCRIPT_DIR #79

Merged

hyperpolymath marked this pull request as ready for review October 19, 2026 22:12

hyperpolymath enabled auto-merge (squash) October 19, 2026 22:12

This was referenced Oct 19, 2026

fix(ci): SPDX check accepts the licence after the actions-lock banner #80

Merged

fix(ci): distro jobs install their packages again #82

Merged

hyperpolymath mentioned this pull request Oct 19, 2026

ci(workflow-linter): install Bun 1.4.2 verified, not via setup-bun hyperpolymath/rsr-template-repo#249

Merged

8 of 9 tasks

Merge branch 'main' into claude/new-session-ywdrth-pin-check

fa6a38f

hyperpolymath disabled auto-merge October 20, 2026 12:36

hyperpolymath enabled auto-merge (squash) October 20, 2026 12:36

hyperpolymath disabled auto-merge October 20, 2026 12:36

hyperpolymath merged commit 230b18e into main Oct 20, 2026
36 of 40 checks passed

hyperpolymath deleted the claude/new-session-ywdrth-pin-check branch October 20, 2026 12:37

Navigation Menu

Repository navigation

fix(ci): the pinning check accepts refs that actions.lock resolves - #81

fix(ci): the pinning check accepts refs that actions.lock resolves#81
hyperpolymath merged 3 commits into
mainfrom
claude/new-session-ywdrth-pin-check

hyperpolymath commented Oct 19, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 19, 2026 •

edited

Loading

Review limit reached

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026

Uh oh!

hyperpolymath commented Oct 19, 2026

Uh oh!

coderabbitai Bot commented Oct 20, 2026

Uh oh!

sonarqubecloud Bot commented Oct 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

hyperpolymath commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What

Tested

Merge order

Uh oh!

coderabbitai Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026

Uh oh!

hyperpolymath commented Oct 19, 2026

Uh oh!

coderabbitai Bot commented Oct 20, 2026

Uh oh!

sonarqubecloud Bot commented Oct 20, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hyperpolymath commented Oct 19, 2026 •

edited

Loading

coderabbitai Bot commented Oct 19, 2026 •

edited

Loading