Repository navigation
fix(ci): clear the two governance checks still red after #6 - #8
Merged
Merged
Conversation
…iteral
The standards re-pin brings governance's `UUID v7 conformance` job, which
since owner ruling D320 runs check-uuid-v8.sh --strict: version 8 only. It
failed on CLAUDE.md alone ("non-v8 UUID literal 241f1c29-..."): the arrival
pack printed the repo uuid as computed hex, a uuidv5. The deed itself never
stores that hex; it stores the typed literal
#u5"github.com/hyperpolymath/resource-algebra".
extract.sh now hands the pack that typed literal. It says what the
identifier is, as ADR-008 asks of legacy ids, and becomes #u8"..." without
another change once the deed grammar admits version 8 and gv-clade-index
moves to profile C (ADR-008, D320). A :repo-uuid that is not a typed
literal stops the generator. Verified: check-uuid-v8.sh --strict passes on
this tree; verify.sh reports the pack in sync. The same change goes to
rsr-template-repo, whose own CLAUDE.md carries the same literal class.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LiQzWJdcPfRU6YMDGRG8Xi
…v0.0.3 At ae36881 the Actions lockfile verify job installs gh-actions-lock v0.1.6, which cannot read this lockfile: "lockfile version v0.0.3 is newer than this binary supports (v0.0.2)" (exit 2). Dependabot (#5) regenerates actions.lock as format v0.0.3. Standards main since #1249 pins v0.2.0 and keeps sha-as-ref advisory, so the pins move to 934b879 (standards main, 2026-10-14). Done with standards' propagate-workflow-pins.sh as patched in hyperpolymath/standards#1254, which now relocks actions.lock itself (RELOCKED): the six entries re-keyed, the standards record rebuilt for 934b879, and the two records its reusables newly need (denoland/setup-deno@22d081f v2.0.5, oven-sh/setup-bun@0c5077e v2.2.0) copied from standards' own lock. Both scripts/check-lock-sync.sh and standards main's copy pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LiQzWJdcPfRU6YMDGRG8Xi
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 54 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
hyperpolymath
marked this pull request as ready for review
October 14, 2026 11:23
hyperpolymath
added a commit
that referenced
this pull request
Oct 14, 2026
…s in Estate Rules (#9) ## Summary This is a follow-up to #7, which merged at `5d8b5c1`. It fixes two problems that merge left on `main`. **1. A changelog entry was lost.** `CHANGELOG.adoc` is missing the "2026-10-14 — minted, and the estate checks made green" entry. The merge of `main` into #7's branch (`497e37f`) resolved the conflict by keeping #7's entry in its place. #7's entry also describes the governance re-pin, but that re-pin had already landed in #8 (`9240142`). **2. Two tests run nowhere.** CodeRabbit added workflow tests on #7, and no workflow calls them. ## Changes - **`CHANGELOG.adoc`**: - The "minted" entry is back, unchanged. - The #7 entry now describes what #7 actually added: - the Scorecard calling job's `actions: read` grant; - the four SHA-keyed lock leaves that record their SHA as `ref`; - the tests that check both. It also notes that the re-pin came from #8. - **`.github/workflows/estate-rules.yml`** gains two steps next to the existing lock test: - `tests/workflows/actions_lock_sha_refs_test.sh` (merged in #7, unwired until now); - `tests/workflows/scorecard_permissions_test.sh` (CodeRabbit, `68f026d`, pushed after #7 merged). It checks that the job's own permissions map grants `actions: read`, with ten mutants rejected. - **Not added:** `tests/workflows/actions_lock_pins_test.sh` (also `68f026d`). It checks the same four lock records as `actions_lock_sha_refs_test.sh`. If you'd rather keep both, it is one `git revert` of the last commit's deletion. ## RSR Quality Checklist ### Required - [x] Tests pass (see Testing) - [x] Code is formatted - [x] Linter is clean - [x] No banned language patterns - [x] No `unsafe` blocks without `// SAFETY:` comments - [x] No banned functions - [x] SPDX license headers present on all new/modified source files (`scorecard_permissions_test.sh` carries MPL-2.0) - [x] No secrets, credentials, or `.env` files included ### As Applicable - [x] `CHANGELOG` or release notes updated ## Testing Run with mikefarah yq v4.44.3: ``` scripts/check-lock-sync.sh actions.lock is in sync and transitively closed tests/workflows/actions_lock_sha_refs_test.sh PASS: actions.lock SHA-ref regression controls (4 dependencies) tests/workflows/scorecard_permissions_test.sh PASS: Scorecard caller grants; 10 invalid permission controls rejected; equivalent YAML accepted tests/workflows/actions_lock_pins_test.sh PASS: 4 immutable action records; 24 invalid metadata controls rejected (before removal) yq . estate-rules.yml parses ``` 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t --- _Generated by [Claude Code](https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t)_
hyperpolymath
added a commit
to hyperpolymath/rsr-template-repo
that referenced
this pull request
Oct 14, 2026
…fs through the mint (#238) ## Summary Follow-up to [#237](#237). After #237 merged, main still failed two governance jobs, the same two its child [resource-algebra#8](hyperpolymath/resource-algebra#8) fixes. Minting resource-algebra also exposed one more defect in the mint recipe. | Check / defect | Cause | Fix | |---|---|---| | governance / Actions lockfile verify | standards `ae36881` installs gh-actions-lock v0.1.6, which refuses lock format v0.0.3 | re-pin to standards `6a92510`, which installs v0.2.0; relocked | | governance / UUID v7 conformance | the strict v8 gate rejected the uuid5 hex in `CLAUDE.md` and in the deed comment, and the Julia `[extras]` registry UUIDs in `Project.toml.in` | print the deed's typed `#u5"…"` literal and drop the hex from the comment; `6a92510` includes [standards#1258](hyperpolymath/standards#1258), which scans `Project.toml.in` as `Project.toml` | | self-name pass | rewrote `rsr-template-repo#N` (the template's own issues) into `<child>#N` | keep issue references as they are, with a test | ## Changes - **`fix(repo-init)`**: the self-name pass keeps `rsr-template-repo#N`. - The rewrite program moves into `SELF_NAME_SED`. - The new `tests/workflows/self_name_pass_test.sh` runs that program, as the recipe defines it, on fixtures. Estate Rules runs the test. - **`fix(arrival-pack)`**: `extract.sh` prints `:repo-uuid` as the deed's typed literal. - A deed whose uuid isn't typed stops generation with exit 2. - CLAUDE.md is regenerated, and the deed comment no longer spells out the hex. - Per review, the literal is read at any indentation and spacing. A space inside the literal is still refused: the deed ABNF defines `%s"#u5" string`, with no space allowed between them. - **`fix(ci)`**: the six standards reusables are pinned to `6a92510`. `actions.lock` was relocked by standards' `propagate-workflow-pins.sh` ([standards#1254](hyperpolymath/standards#1254)). - **`docs(changelog)`**. ## RSR Quality Checklist ### Required - [x] Tests pass (below) - [x] No banned language patterns - [x] SPDX license headers present on all new files - [x] No secrets, credentials, or `.env` files included ### As Applicable - [x] Documentation updated (CLAUDE.md regenerated) - [x] `CHANGELOG` updated under [Unreleased] / Fixed ## Testing Run locally on this tree: - `check-uuid-v8.sh --strict .`, using standards main's scanner: exit 0. - The lock gates all pass: - `check-lock-sync.sh`, both the repo's copy and standards main's; - the governance gate's `update-actions-lock.sh --verify-local`, run with the checksum-verified gh-actions-lock v0.2.0 and mikefarah yq v4. - `self_name_pass_test.sh`: 8 of 8. With the old program, 3 of the 8 cases fail. - Also passing: - `archetype_lock_merge_test.sh` and `non_interactive_mint_test.sh`; - placeholders, root shape and the render check (160 files); - repository-map freshness and determinism; - `deed_clause_test.sh` and the arrival-pack `verify.sh`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01LiQzWJdcPfRU6YMDGRG8Xi --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
resource-algebra#6 was merged at
b0e4189, before its last two commits were pushed. Main (768068f) therefore still fails two governance jobs. This PR carries those two commits, rebased onto main.ae36881installsgh-actions-lockv0.1.6, which refuses lock format v0.0.3 ("newer than this binary supports")934b879, whose governance job pins v0.2.0check-uuid-v8.sh --strictrejects non-v8 hex#u5"github.com/hyperpolymath/resource-algebra"insteadChanges
fix(arrival-pack):extract.shtakes:repo-uuidas the typed#u<n>"…"literal, as the deed writes it, rather than as hex. A deed whose uuid is not a typed literal stops generation (exit 2) instead of printing an empty field. CLAUDE.md is regenerated.fix(ci): the sixhyperpolymath/standardsreusables are re-pinned to934b879(standards main).actions.lockis re-keyed with standards'propagate-workflow-pins.sh, using the relock step proposed in hyperpolymath/standards#1254. The lock gains the two records the new pin reaches (denoland/setup-deno,oven-sh/setup-bun).RSR Quality Checklist
Required
bash scripts/check-agda.sh(unchanged by this PR).envfiles includedAs Applicable
Testing
On this tree:
standards/scripts/check-uuid-v8.sh --strict .: exit 0. On main it fails on./CLAUDE.md.scripts/check-lock-sync.sh: exit 0, with 0 dangling edges and a lock key for every workflow. Standards main's copy also passes..machine_readable/arrival-pack/verify.sh: CLAUDE.md matches the generator.I can't run the
gh actions-lock --verify-localhalf of the lockfile job locally, so CI is the evidence for it.🤖 Generated with Claude Code
https://claude.ai/code/session_01LiQzWJdcPfRU6YMDGRG8Xi
Generated by Claude Code