Repository navigation
🔧 CodeRabbit CI Fix: Fix seven failing GitHub Actions CI checks - #1277
coderabbitai[bot] wants to merge 1 commit into
Conversation
|
Important Review skippedThis PR was authored by the user configured for CodeRabbit reviews. CodeRabbit does not review PRs authored by this user. It's recommended to use a dedicated user account to post CodeRabbit review feedback. ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f869520137
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| - count: 40 | ||
| - ceiling: 40 | ||
| - description: Unpinned `uses:` refs inside `rhodium-standard-repositories/**` -- the vendored mirror of the RSR canon (gitlab.com/hyperpolymath/rhodium-standard-repositories). These are OTHER repositories' workflows reproduced here as templates, and this repo's own CI lock gate (.github/workflows/actions-lock-gate.yml -> .githooks/validate-actions-lock.sh) covers only the root .github tree, so `.githooks/validate-sha-pins.sh` matches that scope and skips the mirror rather than silently passing it. Re-pinning the mirror here fixes no live runner and desynchronises the copy; it is fixed upstream, or the mirror retires. MEASURED 2026-09-21 by the probe. | ||
| - probe: n=$(git ls-files 'rhodium-standard-repositories' | grep -E '/\.github/(workflows|actions)/.*\.ya?ml$' | xargs -r grep -hE '^[[:space:]]*(-[[:space:]]*)?uses:[[:space:]]+[A-Za-z0-9]' | grep -vcE '@[0-9a-f]{40}([^0-9a-f]|$)' || true); echo "${n:-0}" |
There was a problem hiding this comment.
The reviewed tree contains no workflow/action YAML under rhodium-standard-repositories—only two allowlist files—while the actual mirror remains under 9-archive/rhodium-standard-repositories. Consequently this probe reports 0 instead of the 40 unpinned references the previous probe finds, and the scheduled run-debtfile.sh --write pass will falsely lower both the recorded count and ceiling to zero.
Useful? React with 👍 / 👎.
| - description: Unpinned `uses:` refs inside `rhodium-standard-repositories/**` -- the vendored mirror of the RSR canon (gitlab.com/hyperpolymath/rhodium-standard-repositories). These are OTHER repositories' workflows reproduced here as templates, and this repo's own CI lock gate (.github/workflows/actions-lock-gate.yml -> .githooks/validate-actions-lock.sh) covers only the root .github tree, so `.githooks/validate-sha-pins.sh` matches that scope and skips the mirror rather than silently passing it. Re-pinning the mirror here fixes no live runner and desynchronises the copy; it is fixed upstream, or the mirror retires. MEASURED 2026-09-21 by the probe. | ||
| - probe: n=$(git ls-files 'rhodium-standard-repositories' | grep -E '/\.github/(workflows|actions)/.*\.ya?ml$' | xargs -r grep -hE '^[[:space:]]*(-[[:space:]]*)?uses:[[:space:]]+[A-Za-z0-9]' | grep -vcE '@[0-9a-f]{40}([^0-9a-f]|$)' || true); echo "${n:-0}" | ||
| - count: 42 | ||
| - ceiling: 42 |
There was a problem hiding this comment.
In every PR containing this change against its parent, the pull-request-only Debt ratchet in .github/workflows/governance-reusable.yml compares this ceiling with the previous value of 40. Because the commit messages contain no Debt-exception naming vendored-mirror-unpinned-actions, check-debt-ratchet.sh reports RAISED ... 40 -> 42 and fails the required governance job.
Useful? React with 👍 / 👎.
| - severity: medium | ||
| - policy: remediable | ||
| - tri: eliminate | ||
| - accepted-until: 2026-10-01 |
There was a problem hiding this comment.
For any debt measurement run after 2026-10-01, including one at this commit's 2026-10-17 date, run-debtfile.sh marks this newly added entry expired and exits 1 even though its probe reports zero. The weekly .github/workflows/debt-measure.yml job propagates that result as a failed workflow, so this entry immediately introduces a persistent scheduled CI failure.
Useful? React with 👍 / 👎.
1 participant
CI failure fixes was requested by @hyperpolymath.
The following files were modified:
.machine_readable/Debtfile.a2ml