Repository navigation
fix(ci): clear red main checks on standards (detect, kyaml, K9, Hypatia) - #1184
Merged
Merged
Conversation
- ci-pipeline: Haskell is detected only from a ROOT cabal.project or root *.cabal (`:(glob)*.cabal`), the only layout `cabal build` accepts at the repo root (Cabal-7136). Nested cabal/stack/hs trees are reported as an unsupported ecosystem instead of failing the gate (standards#1161). - scripts/kyaml-format.sh: restore the tested implementation (df20618) that 5b56aec overwrote; YAML-POLICY.adoc and kyaml-format-test.sh pin exit 2 = refused, exit 1 = not KYAML (17/17 pass). - kyaml-migrate.sh, test_kyaml_comment_preservation.sh: mktemp instead of hardcoded /tmp paths (10 Hypatia hardcoded_tmp findings). - k9_contract.ncl: restore the `..` open-record tails that #1154 dropped from Signature/Metadata/Security/Pedigree/Component (spec 5.5), keeping #1154's template wording. Fixtures: 6 positive, 21 negative, 0 failures. - allowed-actions.json: add the lower-case swatinem/rust-cache@* spelling the live repo policy already allows (rust-ci-reusable.yml uses it). - apply-baseline.sh: the gate message counts kept findings AT OR ABOVE the threshold, not every kept finding (said 12 when 1 was high). - .hypatia-baseline.json: ACK RE001 on k9-contractile.yml under the #941 pending decision, and the K9-S001 negative-control fixture (exact path). - REGISTRY.a2ml: regenerated by scripts/build-registry.sh (3 source hashes). Ratchet-exception: .hypatia-baseline.json grows by 2 — RE001 k9-contractile.yml joins the #941 pending decision; the K9-S001 negative-control fixture must lack a pedigree Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 46 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configuration
📒 Files selected for processing (8)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/37530700195 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
Contributor
|
Add Carrot credits or activate Agent usage billing to use Autopilot |
hyperpolymath
enabled auto-merge (squash)
October 6, 2026 21:04
|
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/37531214824 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
6 of 13 tasks
hyperpolymath
added a commit
that referenced
this pull request
Oct 6, 2026
## Summary Corrects the Haskell build step's comment, and its guard's error text, in `.github/workflows/ci-pipeline.yml`. Since #1184 both describe a detect probe that no longer exists. #1181 and #1184 merged opposite answers to #1161: - #1181 made the build step generate a `cabal.project` for every tracked package, because detect counted `*.cabal` at any depth. - #1184, merged after it, narrowed detect to a root `cabal.project` or a root `*.cabal`. It reports nested-only Haskell as **unsupported**. On 2026-10-06 the owner ruled that #1184's root-only detect stands. This PR brings the build step's text into line with that ruling. Two pieces of text were false on `main`: - **The comment.** It said the probe "counts `*.cabal` at ANY depth" and that narrowing it "would have hidden nested Haskell instead". - **The `::error::` text.** It said "detected (*.hs or stack.yaml)". Detect no longer counts either. Closes # (none. This follows up #1161, #1181 and #1184.) ## Type of change - [ ] 🐛 Bug fix: no behaviour changes. - [ ] ✨ New feature: none. - [ ] 💥 Breaking change: no. Comment and message text only. - [ ] 🕳️ Soundness fix: no checker logic changes. The text it corrects did misdescribe a gate. - [x] 📖 Documentation (in-workflow comment and error text) - [ ] 🧹 Refactor: nothing is restructured. - [ ] ⚡ Performance: not affected. - [x] 🔧 Build / CI / tooling (the file is the shared CI pipeline) ## 📌 New pins Head SHA: **`949302ecfb4568295c36e6a7dfe9317f0a821ba1`**. No pins are added or changed: no `uses:`, `actions.lock`, lockfile or digest edits. ## How has this been verified? - `git diff --stat origin/main` → 1 file, comment and `::error::` text only. The second commit (`949302ec`) takes CodeRabbit's point: a root `cabal.project` listing only nested packages also turns the job on, so the step does not always have a root package. Every changed line is a `#` comment or the quoted `::error::` string. - `ruby -e 'YAML.load_file(...)'` on the edited workflow parses with rc 0. - `bash scripts/check-lock-sync.sh` → `actions.lock is in sync`. `bash scripts/check-allowed-actions.sh` → rc 0. - I read the new text against `main`'s detect step: - L159 is `N_HASKELL=$(count 'cabal.project' ':(glob)*.cabal')`. - L232–238 probe nested Haskell as unsupported only when `N_HASKELL` is 0. - So the `else` branch runs only with a root `*.cabal`. It then lists `.` plus each nested package directory, which is what the new comment says. ## Checklist - [x] My commits are **signed** (`git commit -S`). `git log --format=%G?` → `G`. - [x] I ran the project's own checks/tests locally and they pass: lock-sync and allowed-actions. The commit-msg hook accepted the message with one length warning. - [ ] New files carry the correct `SPDX-License-Identifier`: no new files. The existing header is unchanged. - [x] Docs are updated, and no public claim now overstates what the code does. That is the whole point of this PR. - [x] I have not introduced a soundness hole: the logic is untouched. ## Deferred red checks Both reds already fail on `main` (`7d51f30f`). This PR does not touch either one: - `Registry + topology in sync`: deferred to #1161 (registry drift on main). - `Repo self-tests`: deferred to #1161. The failing suite is `build-registry-test.sh`, which reports `FAIL: repository ledger drifted`. That is the same drift. ## Notes for reviewers - On `main`, standards' own Haskell is now skipped and listed as unsupported. So the vendored sanctify-php (#1185) is not built here. - Upstream sanctify-php `main` also does not compile: `src/Sanctify/Parser.hs` line 6 is `//! verified alternatives.`. A separate one-line upstream fix PR is being opened. Re-syncing this copy afterwards is a later step. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_012kgrMQRhSmZMBbF9Ui1zBw --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Clears the red checks on
mainof hyperpolymath/standards (runs of 2026-10-06 16:47Z) with one fix for each cause. No gate is weakened: there is nocontinue-on-error, no::warning::downgrade, and no check is deleted. Branch is rebased on0ae8b773(#1170).Error: [Cabal-7136] There is no <pkgname>.cabal package file or cabal.project file.ci-pipeline.ymldetect now counts Haskell only from a rootcabal.projector root*.cabal(:(glob)*.cabal). That is the only layoutcabal buildaccepts at the repo root. Nested cabal/stack/.hstrees (33 files here) are reported as an unsupported ecosystem, not a failed gate (standards#1161).at least one gate above REALLY FAILED … (pipeline debt: 4 repos). The only failing gate wasR_HASKELLFAIL: block YAML fails --check — wanted exit 1 and 'is not KYAML', got exit 2;build-registry regression: 7 passed, 2 failed;Wave-3 scorecard regression: 7 passed, 2 failedscripts/kyaml-format.shis restored to the tested implementation (df20618b).5b56aec0had overwritten it and swapped the exit contract thatYAML-POLICY.adocand the test pin (2 = refused, 1 = not KYAML). The registry is regenerated (next row).DRIFT: .machine_readable/REGISTRY.a2ml is stale — run 'just registry'scripts/build-registry.sh. Threesource_hashvalues changed, after the rebase on0ae8b773. No new.a2mlfile.ERROR K9-N001 [L2] …/valid/extension-fields.k9.ncl: … extra fields 'failure_mode_defenses', 'execution'k9_contract.nclgets back the..open-record tails on Signature/Metadata/Security/Pedigree/Component that #1154 dropped (a stale-base clobber). K9 spec §5.5 requires them. #1154's template wording is kept.GAP swatinem/rust-cache@6323deb1…(rust-ci-reusable.yml:191,239)allowed-actions.jsonadds the lower-caseswatinem/rust-cache@*spelling, which the live repo actions policy already allows.Gate failed: 12 unfiltered finding(s) at or above 'high'.Only 1 finding was actuallyhighapply-baseline.shnow counts only kept findings at or above the threshold in the message (the old text said 12 when 1 blocked).Gate failed: 12 unfiltered finding(s) at or above 'info'.hardcoded_tmpfindings are fixed at source withmktemp(kyaml-format.shrestore,kyaml-migrate.sh,test_kyaml_comment_preservation.sh).RE001onk9-contractile.ymljoins the existing #941 pending decision (ACK,expires_at2026-12-22,tracking_issue#941). The K9 fixture ACK covers the last one.SONAR_TOKEN/project setup, which is an owner decision.Ratchet-exception: .hypatia-baseline.json grows by 2 — RE001 k9-contractile.yml joins the #941 pending decision; the K9-S001 negative-control fixture must lack a pedigree
Closes # (no single issue; #1161 is addressed by the Haskell part)
Type of change
ci-pipeline.ymlpin, and it only stops false failures.📌 New pins
Head SHA: 97238fa
None. No
uses:was added or changed,actions.lockis untouched, and no lockfile or container digest changed.How has this been verified?
All commands were run in the worktree on the rebased head:
bash scripts/run-shell-test-suite.sh→All 77 test file(s) passed.(run before the rebase; after the rebase the targeted tests below were re-run)bash scripts/tests/kyaml-format-test.sh→kyaml-format: 17 passed, 0 failedbash scripts/tests/apply-baseline-test.sh→Total: 32 passed, 0 failedbash scripts/build-registry.sh --check→OK: registry + topology are in sync with the file tree.6 positive, 21 negative, 0 failure(s).K9_VALIDATE_LAYER=all bash .githooks/validate-k9.sh→ rc 0, 14 conforming, 1 grandfathered.origin/maincontract reproducesFAIL extension-fields.k9.ncl should conform(K9-N001).bash scripts/check-allowed-actions.sh→0 not covered(was 1 GAP).apply-baseline.shwith the new baseline.high→ rc 0.info→ only the 10hardcoded_tmpfindings remain, and this PR removes them at source (grep -n '["'"'"'/]tmp/'on the three scripts → 0 hits).mainbaseline, the same input fails at both thresholds, as CI did.foo.cabal→has_haskell=true.sub/foo.cabal→has_haskell=false, listed as unsupported.has_haskell=false,Haskell (33)unsupported.bash scripts/check-exemption-ratchet.sh origin/main→OK (declared) .hypatia-baseline.json: 203 -> 205 [Ratchet-exception present]bash scripts/check-lock-sync.sh→actions.lock is in syncgh actions-lock --verify→ rc 1 with output identical tomain's. It complains about the pre-existing local./refs inci-pipeline.ymlandsigned-push-smoke.yml; nothing comes from this PR.bash .githooks/docstring-scan.sh --range origin/main..HEAD --check→coverage=100.00%(3/3 functions documented).Checklist
git commit -S):git log --format=%G?showsG.cabal.projector root*.cabal".Notes for reviewers
44ca61e2) re-introduced closed K9 records. It also left stalePROTOCOL.k9entries in.machine_readable/k9-contract-debt.txt; they do not fail the gate and are not touched here.5b56aec0overwrote the testedkyaml-format.sh.check-lock-sync.sh(clause 3, transitive closure). Run against this repo it fails on 4 workflows with noactions.lockkey:lock-sync-gate.yml,scorecard.yml,secret-scanner.yml,self-ci.yml. Porting it would add a new red, so it is a follow-up (the lock needs those keys first).REGISTRY.a2mlis regenerated only because the existing gate demands it. Whether to retire the A2ML registry is an owner decision.SONAR_TOKEN), RE001 harden-runner vs ACK (Hypatia RE001: adopt step-security/harden-runner estate-wide, or record WONTFIX (23 instances) #941).🤖 Generated with Claude Code
https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm