Repository navigation
test(baseline): use [[ ]] in the invalid_actions_lock ledger guard - #1305
Merged
Merged
Conversation
SonarCloud reported one new issue on #1239. The proxy in the session that wrote #1239 could not reach sonarcloud.io, so the finding itself was never read. The only conditional #1239 added is `if [ "$got" = "0" ]` in scripts/tests/apply-baseline-test.sh, and this repo already answers that Sonar rule with Bash `[[ ... ]]` (#1291). Behaviour is unchanged. The suite passes 52/52. With an invalid_actions_lock ack put back into a copy of the baseline, the guard still fails (2 FAIL, exit 1). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TbbnKqskQA5mj5gfMniPzi
Contributor
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 52 minutes. View limit details
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Owner
Author
|
No re-run: the failure is deterministic and already reproduces on Generated by Claude Code |
hyperpolymath
marked this pull request as ready for review
October 19, 2026 16:55
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
hyperpolymath
enabled auto-merge (squash)
October 19, 2026 17:24
|
Contributor
|
Add Carrot credits or activate Agent usage billing to use Autofix |
This was referenced Oct 19, 2026
hyperpolymath
added a commit
that referenced
this pull request
Oct 20, 2026
… support) (#1315) ## Problem `governance / Validate Hypatia Baseline` is red on `main` (`b3ce78e`, run 39340237981) and on every open PR, including #1309, #1310 and #1311. The only blocking findings are: ``` invalid_actions_lock (workflow_audit, high): {:line, 4, {:unsupported_version, "v0.0.3"}} invalid_actions_lock (workflow_hardening, high): actions.lock failed closed: {:line, 4, {:unsupported_version, "v0.0.3"}} ``` The baseline job does not build Hypatia HEAD. Both `governance-reusable.yml` and `hypatia-scan-reusable.yml` default `hypatia-ref` to the vetted SHA `51ab6496…` (2026-10-01), and that commit's lockfile parser accepts only `v0.0.2`. `gh actions-lock` now writes `v0.0.3`. The lockfile is tool-owned, and this finding is deliberately not baselinable (#1239, #1305), so the scanner pin is what has to move. ## Change Both `hypatia-ref` defaults move from `51ab6496bf47e30a0576d503df31fec30f3cfe56` to `aa34a4cc6ba39d873710ff39763fdb9cde715f9d`. They move together, as their descriptions require. `aa34a4cc` is hypatia `main` after hyperpolymath/hypatia#938, which adds proper `v0.0.3` support, including the one field `v0.0.3` introduces (the optional per-dependency `hostname`). Unknown versions still fail closed. No `uses:` ref changes, so `actions.lock` is untouched. ## Blast radius (measured, not assumed) The bump carries every Hypatia commit since `51ab6496` (23 of them, including the `research_extensions` rules and hyperpolymath/hypatia#922's finding-shape change), and a pin move broke every caller once before (hyperpolymath/hypatia#895). So I replayed the `validate-hypatia-baseline` step locally at both pins on three repos: scan, path relativisation, then `apply-baseline.sh` with `BLOCKING_THRESHOLD=info`. | Repo | Kept at `51ab6496` | Kept at `aa34a4cc` | Change | |---|---|---|---| | standards (`d55304a`) | 2 × `invalid_actions_lock` | **0** | gate passes | | echidna | 2 × `invalid_actions_lock`, 1 `DependencyPinning` | same 3 | none* | | hypatia | 2 × `invalid_actions_lock` + 28 pre-existing (RE001/4/5, WH013) | the 28 | −2 | (The table leaves out `GS002`/`GS005`, which come from my detached local checkouts.) - On all three repos the raw findings only *lose* `invalid_actions_lock` and the derived `DependencyPinning`. There is no new finding type and no severity change. - All emitted severities stay inside `hypatia-scan-reusable.yml`'s accepted set. The new `support`/`evidence`/`level` finding fields are additive, and the only `.level` the reusable reads is the SARIF one. - \*echidna's lockfile now parses, but it has two real dangling edges (`slsa-framework/slsa-github-generator@f7dd8c54…` and `hyperpolymath/panic-attack@b689a74d…` are listed under `workflows:` with no top-level record, the startup-failure case `scripts/close-lock.sh` documents). That is an echidna repair, not something this PR changes. ## Checks run locally - `scripts/tests/governance-reusable-contract-test.sh`: PASS - `scripts/tests/hypatia-blocking-gate-test.sh`: PASS - `scripts/tests/apply-baseline-test.sh`: 52 passed, 0 failed - `scripts/tests/check-workflow-duplicate-keys-test.sh`: 17 passed, 0 failed with mikefarah yq v4.47.2 (checksum-verified). It fails 13/4 on `main` too when only the Python `yq` is on PATH. `scripts/check-workflow-duplicate-keys.sh` on both files: clean. - `actionlint` 1.7.7 on both files: output identical to `main`. - `yq '.on.workflow_call.inputs."hypatia-ref".default'` → `aa34a4cc…` in both files. ## After merge Open PRs (#1309, #1310, #1311) need `main` merged into them. Re-running their failed jobs won't help, because a re-run reuses the PR's old merge commit, which still carries `51ab6496`. --- _Generated by [Claude Code](https://claude.ai/code/session_01KUZiEB43T3E9fJAXqwbSDm)_ Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath
pushed a commit
that referenced
this pull request
Oct 20, 2026
SonarCloud reported 13 new issues on #1318. Its issue list is not reachable from here, but every test the PR adds uses [ ], which is the finding #1291 and #1305 cleared the same way. All twelve such lines are now [[ ]]. Lines this PR does not touch keep their [ ]. close-lock-test 34/34, lock-selfcheck-test 9/9. --check still exits 0, 1 and 2 for a closed lock, a dangling one and a missing one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TbbnKqskQA5mj5gfMniPzi
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #1239. SonarCloud's quality gate passed on #1239 but reported 1 new issue. The session that wrote #1239 could not open the finding, because its proxy blocks sonarcloud.io.
The only conditional #1239 added is
if [ "$got" = "0" ]inscripts/tests/apply-baseline-test.sh, the guard that keeps aninvalid_actions_lockack out of the shipped baseline. #1291 answered the same Sonar rule elsewhere in this repo with Bash[[ ... ]], so this PR does the same to this one line:The rest of the file is unchanged.
Testing
bash scripts/tests/apply-baseline-test.shinvalid_actions_lockack restored to a copy of.hypatia-baseline.json.githooks/pre-commitandcommit-msgUnconfirmed: I could not read the Sonar finding itself, so this PR's Sonar run is the confirmation. If Sonar still reports a new issue here, it was something else and I'll follow up.
Generated by Claude Code