Repository navigation
fix(js-runtimes): make the crate its own Cargo workspace root - #1296
Conversation
Governance's "JS runtimes — environment provisions Bun first" job checks standards out at .standards-js/ inside the calling repository and runs `cargo install --path .standards-js/tools/js-runtimes`. When the caller is itself a Cargo workspace, cargo refuses the nested package: error: current package believes it's in a workspace when it's not Measured on hyperpolymath/proof-burrower#116 (job 118046337412), the first caller re-pinned to 75bd599; echidna and echidnabot are Cargo workspaces too. An empty [workspace] table, cargo's own suggested fix, keeps the crate out of any enclosing workspace. Standards has no root Cargo.toml, so its own build is unchanged. Reproduced locally: proof-burrower main with tools/js-runtimes at .standards-js/ — `cargo metadata --manifest-path` exits 101 with the CI error before, 0 after. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Important Review skippedWe couldn't safely recover the incremental review. No full review was started, and the last reviewed checkpoint was preserved. Retry later, or explicitly request a full review by commenting You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Summary
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly and concisely summarises the main change: making the js-runtimes crate its own Cargo workspace root. |
| Description check | |
The description directly explains the Cargo workspace failure, the applied fix, and the verification results. It is relevant to the changeset. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Warning
CI annotation context is incomplete: annotation collection unavailable or limited
Comment @coderabbitai help to get the list of available commands.
|
Add Carrot credits or activate Agent usage billing to use Autofix |
## Summary GitHub now enforces the actions lockfile for reusable-workflow callers. This repo's `actions.lock` had no record for `hyperpolymath/standards`, so every standards caller failed at startup with "invalid lockfile pin". The local gates pass on the broken main, so they cannot see this failure mode. CI on this PR is the proof. This is the same repair as hyperpolymath/proof-burrower#116, where every reusable caller went green, and hyperpolymath/echidnabot#185. ## Changes - Re-pins six standards reusables from `571cc734` to `75bd5994470661a099df562d6d5ad2fe744dbd66`: governance, hypatia-scan, mirror, scorecard, secret-scanner, spark-theatre-gate. - Regenerates `.github/workflows/actions.lock` with the estate repair chain. The lock is not hand-edited. The chain is `relock-sha-keys` → `complete-job-refs` → `close-lock` → `prune-stale`, and `complete-job-refs` includes the case fix from hyperpolymath/standards#1294. - The standards record now carries the 13 nested `uses:` its reusables reach. ### Known open: two job-level refs without leaf records These two refs were already dangling on main. The lock now lists them under their workflows, but `close-lock` could not write their records: - `slsa-framework/slsa-github-generator@f7dd8c54…` (v2.1.0), used by `generator-generic-ossf-slsa3-publish.yml`; - `hyperpolymath/panic-attack@b689a74d…`, used by `security-scan.yml`. `close-lock` needs GitHub API reads of each repository for the numeric owner and repo IDs and the nested refs' commits. This session has git-only access to them, and I did not invent records. Expect those two workflows to keep failing until someone with API access closes them. With `gh` authenticated, run `GH_BIN=gh bash scripts/close-lock.sh` from the repo root using standards' scripts, then `prune-stale.sh`. That is a mechanical follow-up commit on this branch. The "JS runtimes" job inside the governance reusable also stays red until hyperpolymath/standards#1296 merges and the pin moves past it. That job fails on a nested Cargo workspace, a separate bug. ## RSR Quality Checklist ### Required - [x] Tests pass: CI-only change, no code touched - [x] Code is formatted: n/a - [x] Linter is clean: lock gates below - [x] No banned language patterns - [x] No `unsafe` blocks without `// SAFETY:` comments - [x] No banned functions - [x] SPDX license headers present on all new/modified source files: none added; existing headers untouched - [x] No secrets, credentials, or `.env` files included ## Testing - `check-lock-sync.sh .github/workflows`: in sync. - `check-actions-lock-gate.sh` with `update-actions-lock.sh --verify-local`: "Immutable direct and transitive lockfile coverage verified." - `close-lock.sh`: rc 3, for the two refs above only. --- _Generated by [Claude Code](https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
2 participants
What
Adds an empty
[workspace]table totools/js-runtimes/Cargo.toml.Why
The governance reusable checks standards out at
.standards-js/inside the calling repository. When the caller is itself a Cargo workspace (proof-burrower, echidna, echidnabot), cargo walks up the tree, finds the caller's workspace root, and refuses to build:This is the failure in the "JS runtimes — environment provisions Bun first" job on hyperpolymath/proof-burrower#116 (job 118046337412). Every reusable caller is green there once the lock is repaired. This job is the only one left red.
Verification
In a proof-burrower worktree with standards checked out at
.standards-js/, I rancargo metadata --no-deps --offline --manifest-path .standards-js/tools/js-runtimes/Cargo.toml:The fix is at source. No consumer needs an
excludeentry.Generated by Claude Code