Repository navigation
fix(hypatia-reusable): really run panic-attack, and never record a skip as a pass - #1256
Merged
Merged
Conversation
…ip as a pass
The "Run panic-attack assail" step was a silent no-op. Nothing installed
panic-attack, so every run took the else branch and wrote a bare `[]` to
panic-attack-findings.json, which reads exactly like a clean scan (the CRG
"panic-attack assail passes" evidence). The installed branch was broken too.
`assail .` without --output prints a human banner, not JSON. And `2>&1 || true`
mixed stderr into the file and swallowed any failure.
Owner ruling: do both. Install it, and make every non-result explicit.
It stays advisory, because this reusable is called estate-wide.
* Install panic-attack v2.5.5 from source at a pinned commit:
`cargo install --git … --rev <sha> --locked`, the same pattern self-test.yml
uses for ijson-jcs. There is no release binary to checksum instead. The
binary is cached by commit, and a restored binary is used only when cargo's
.crates.toml names the pinned commit. The build is capped at 10 minutes and
the scan at 5, and the job timeout rises by those 15 minutes, so neither
can fail the job.
* panic-attack-findings.json becomes a status envelope:
{status: ran|not_run|error, tool, ref, reason, exit_code, counts, report}.
A skip, a failed build, a crash, a timeout or a missing or invalid report
each gives an explicit status, a ::warning and a step-summary line saying
it is not a pass. A real run embeds panic-attack's own report and counts
the unsuppressed findings by severity.
* The scan runs before the standards checkout, so it scans the caller's tree
and not .standards-checkout/scripts.
* hypatia-blocking-gate-test.sh now executes both new steps (Ruby and awk
extraction) against fixtures: the skip path, clean, findings, crash, the
5-minute cap, no report, a bad severity, no cargo, a stale cache, a valid
cache, a failed build, an empty build and a pinned build.
* The CRG Immaculate-Guide evidence bullet says what counts: status "ran"
with zero critical and high.
No action is added, so actions.lock is unchanged (check-lock-sync.sh passes).
Nothing in standards, gitbot-fleet or hypatia reads panic-attack-findings.json,
so no consumer needs the new shape handled.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N6my4F3ohjwFReLW8cYYqC
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 37 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/38556818501 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
#1249 added two jobs to governance-reusable.yml, "JS runtimes — environment provisions Bun first" and "JS runtimes — ${{ matrix.runtime }}". It did not add them to the frozen context list in tests/test_governance_reusable_shape.sh. That turned Repo self-tests red on main and on every PR based on it ("job names drifted from the frozen list"). Adding a job is allowed (gates.json context_freeze: "Adding a job is allowed"). This adds both names, so they are frozen from now on like the rest. Both are blocking jobs, not advisory, so neither belongs in never_required_contexts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N6my4F3ohjwFReLW8cYYqC
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/38557102702 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
|
hyperpolymath
marked this pull request as ready for review
October 14, 2026 11:31
hyperpolymath
pushed a commit
that referenced
this pull request
Oct 14, 2026
…1255/#1256) Self Test has been red on main since #1249 added the js-runtimes jobs to governance-reusable.yml without adding their names to the frozen context list. This is the identical change carried by #1255 and #1256, ported so this PR's Self Test can go green; it no-ops once either lands. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LiQzWJdcPfRU6YMDGRG8Xi
hyperpolymath
added a commit
that referenced
this pull request
Oct 14, 2026
…n bumpers (#1254) ## Why `scripts/apply-workflow-pins-remote.sh`, the scheduled pin applier, fetches and commits only `*.yml`. The local `propagate-workflow-pins.sh` has the same gap. Both re-point `uses: hyperpolymath/standards/...@SHA` and leave `actions.lock` keyed to the old commit. `check-lock-sync.sh` rejects that state, and its own header records GitHub refusing such runs at startup. The ledger census in `apply-workflow-pins.yml` counts 200 of 368 governance callers with an `actions.lock`. A fix-mode run would therefore have opened PRs that stop those repos' reusable-calling workflows. This came up while fixing a stale `da2c748` pin, whose unpinned `gh-actions-lock` fails Actions lockfile verify. That fix landed in [resource-algebra#6](hyperpolymath/resource-algebra#6) and [rsr-template-repo#237](hyperpolymath/rsr-template-repo#237), and both needed this relock done by hand. ## What - **`scripts/relock-standards-pin.sh`** (new) moves a consumer's lock to the target standards commit: - re-keys the per-workflow entries; - rebuilds the standards dependency record from what the reusables called with a full pin use at the target; - copies the records those need verbatim from standards' own lock; - prunes only records the old standards record alone kept alive; - keeps `gh-actions-lock`'s record order. - **Short pins.** A short pin of 7 or more hex that prefixes the target is current. This matches the applier, which counts it FRESH and leaves it as written. It keeps its own short-keyed record, untouched. - **It is fail-closed.** It leaves the lock untouched and exits 1 when: - a workflow pins another standards commit, or a pin under 7 hex; - a reusable is absent at the target; - the old record is missing; - a needed record is in neither lock; - a workflow's standards entries would not name exactly the refs it pins. - **The applier** fetches `actions.lock` with the workflows and relocks it in the same verified commit. A repo whose lock can't follow is reported `LOCK-REFUSED` and not landed. In fix mode it fetches the target commit if the CI checkout lacks it, and a new known-answer control fails the run if the relock is missing. - **The propagator** relocks before staging and reports `RELOCKED` / `LOCK-REFUSED`. On a refusal it restores the workflows it rewrote, uncommitted edits included, stages nothing, and leaves the branch alone. Any refusal makes it exit 1. - **Ported:** the frozen job-name fix that #1255 and #1256 also carry. Self Test is red on main without it. ## Evidence - **Known answers.** On resource-algebra and rsr-template-repo, re-pinned from `da2c748` to `ae36881`, the relock reproduces byte for byte the locks verified by hand there. Both pass `check-lock-sync.sh`. resource-algebra's lock relocked to `934b879` passes the governance gate's own `update-actions-lock.sh --verify-local` with gh-actions-lock v0.2.0. - **`scripts/tests/relock-standards-pin-test.sh`**, offline, 16 checks: - the known answer, and idempotence; - eight refusals that leave the lock byte-identical; - the no-lock no-op; - short pins at 7, 12 and 39 hex, each passing `check-lock-sync.sh`. - **`scripts/tests/propagate-workflow-pins-test.sh`**: 29 of 29. - **Mutants**, all killed: - from the first round: no iteration, no pruning, no record copying, no stale-pin refusal, over-pruning, no sorting; - from the review round: exact-match only, every pin feeding the record, no 7-hex minimum, no consistency guard, no restore, no early return. - **Existing suites.** `check-lock-sync-test.sh` 13 of 13, and the applier's `--self-test`. The review round built on CodeRabbit's autofix commits (`cccec83`, `5fd1373`) and kept their tests. Not exercised: a live fix-mode applier run. It needs the dedicated App credential, and it is the owner's dispatch. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01LiQzWJdcPfRU6YMDGRG8Xi --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The "Run panic-attack assail" step in
.github/workflows/hypatia-scan-reusable.ymldid nothing. Nothing in the job installed panic-attack. On main's Hypatia run at 7d2041a (run 38484072239, job 115593368840) the log sayspanic-attack not available in CI — skipping. The step then wrote a bare[]topanic-attack-findings.json, and that reads exactly like a clean scan. The CRG Immaculate-Guide evidence bullet (COMPONENT-READINESS-GRADES.adoc, the "panic-attack assailpasses (no Critical/High findings)" line) treats that file as a pass.The "installed" branch was broken too:
panic-attack assail .without--outputprints a human-readable banner, not JSON.2>&1mixed stderr into the file.|| trueswallowed any failure.Change (owner ruling: both (a) and (b); stays advisory)
(a) Install from a pinned source commit. The job builds panic-attack v2.5.5 at commit
2dc1393cwithcargo install --git … --rev <sha> --locked.self-test.ymlalready installsijson-jcsthe same way.v2.5.5asset returns 404, and upstream'srelease.ymlpackagesREADME.md,ROADMAP.mdandSECURITY.md, which the repo does not have.actions/cachepin already in use. A restored binary is used only when cargo's.crates.tomlnames the pinned commit.~/.panic-attack, so nothing half-built gets cached.(b) Make every non-result explicit.
panic-attack-findings.jsonis now a status envelope and never a bare array:::warning, and a step-summary section saying the scan is not a pass: tool missing, cargo missing, build failure, crash, the 5-minute cap, or a missing or invalid report..standards-checkout/scripts.Docs. The CRG evidence bullet now says what counts in CI:
status: "ran"with zero critical and zero high.Also in this PR: a fix for main's red Repo self-tests
hyperpolymath/standards#1249 added two jobs to
governance-reusable.yml:JS runtimes — environment provisions Bun firstandJS runtimes — ${{ matrix.runtime }}. It did not add them to the frozen job-name list intests/test_governance_reusable_shape.sh. As a result, Repo self-tests fails on main and on every PR based on it, including hyperpolymath/standards#1255, with "job names drifted from the frozen list".gates.jsoncontext_freezeallows adding a job, so commit b1d9cb3 adds both names to the list, and they are frozen from now on. Both are blocking jobs, so neither belongs innever_required_contexts. The test now passes 14 of 14.Consumers
Nothing in this repo,
gitbot-fleetorhypatiareadspanic-attack-findings.jsonor thehypatia-scan-findingsartifact.panicbotruns panic-attack itself. No consumer needs changes for the new shape.Verification
scripts/tests/hypatia-blocking-gate-test.shnow extracts and runs both new steps against fixtures, through Ruby and through the awk fallback (mawk and gawk), with 46 PASS on each. The new cases are:not_run, never[])--rev <sha>and--locked[].status: ran, 10 critical, 1 high and 23 medium (unsuppressed), step exit 0.cargo installcommand builds v2.5.5 in about 3 minutes, and.crates.tomlrecords?rev=<sha>#<sha>, which is what the cache check relies on.scripts/check-lock-sync.shpasses. No newuses:was added.scripts/check-workflow-duplicate-keys.shandscripts/check-inline-python.shpass.test_governance_reusable_shape.shcome from this container lackingijson-jcs, bun, deno and mikefarah'syq. CI, which has those tools, failed only ontest_governance_reusable_shape.sh, which the commit above fixes.Note
Once merged, every estate caller's Hypatia run will show the real panic-attack counts as an advisory warning. This repo alone has 10 critical and 1 high.
🤖 Generated with Claude Code
https://claude.ai/code/session_01N6my4F3ohjwFReLW8cYYqC