Repository navigation
ci: restore the changelog entry #7 dropped; run its two workflow tests in Estate Rules - #9
Merged
Merged
Conversation
The merge of main into this branch (497e37f) dropped main's "minted, and the estate checks made green" entry from CHANGELOG.adoc in favour of this PR's re-pin entry. That re-pin landed on main first (9240142, #8), so the entry now describes what this PR still adds over main: - the Scorecard calling job's `actions: read` grant (43b7040); - the four SHA-keyed lock leaves recording their SHA as `ref`; - tests/workflows/actions_lock_sha_refs_test.sh (2108dd7), which checks those leaves with negative controls. That test ran nowhere, so it is now a step in Estate Rules, next to the other lock test. Locally: check-lock-sync.sh passes, the test passes (4 dependencies), and the 934b879 lock gate (gh-actions-lock v0.2.0) passes on this lock. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
…corecard job permissions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
…lock test 68f026d added two tests that nothing ran. scorecard_permissions_test.sh checks something new: that the Scorecard calling job's own permissions map grants actions: read, with ten mutants rejected. It is now an Estate Rules step. actions_lock_pins_test.sh checks the same four SHA-keyed lock records as actions_lock_sha_refs_test.sh, which merged with #7, so it is not added. Locally, all three passed before the duplicate was removed. The CHANGELOG entry names both tests that remain. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 39 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This is a follow-up to #7, which merged at
5d8b5c1. It fixes two problems that merge left onmain.1. A changelog entry was lost.
CHANGELOG.adocis missing the "2026-10-14 — minted, and the estate checks made green" entry. The merge ofmaininto #7's branch (497e37f) resolved the conflict by keeping #7's entry in its place. #7's entry also describes the governance re-pin, but that re-pin had already landed in #8 (9240142).2. Two tests run nowhere. CodeRabbit added workflow tests on #7, and no workflow calls them.
Changes
CHANGELOG.adoc:The "minted" entry is back, unchanged.
The ci: governance pin da2c748 → 934b879; close actions.lock at the new pin #7 entry now describes what ci: governance pin da2c748 → 934b879; close actions.lock at the new pin #7 actually added:
actions: readgrant;ref;It also notes that the re-pin came from fix(ci): clear the two governance checks still red after #6 #8.
.github/workflows/estate-rules.ymlgains two steps next to the existing lock test:tests/workflows/actions_lock_sha_refs_test.sh(merged in ci: governance pin da2c748 → 934b879; close actions.lock at the new pin #7, unwired until now);tests/workflows/scorecard_permissions_test.sh(CodeRabbit,68f026d, pushed after ci: governance pin da2c748 → 934b879; close actions.lock at the new pin #7 merged). It checks that the job's own permissions map grantsactions: read, with ten mutants rejected.tests/workflows/actions_lock_pins_test.sh(also68f026d). It checks the same four lock records asactions_lock_sha_refs_test.sh. If you'd rather keep both, it is onegit revertof the last commit's deletion.RSR Quality Checklist
Required
unsafeblocks without// SAFETY:commentsscorecard_permissions_test.shcarries MPL-2.0).envfiles includedAs Applicable
CHANGELOGor release notes updatedTesting
Run with mikefarah yq v4.44.3:
🤖 Generated with Claude Code
https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
Generated by Claude Code