Repository navigation
CI: pin the estate audit to cicd-suite 376898b - #32
Merged
Merged
Conversation
The estate audit was called at cicd-suite@main, so any change there ran here on the next push, unreviewed. cicd-suite #50 (merged 2026-10-14) makes the pinned thin caller the estate's way of consuming the audit: its README says to pin a full SHA, never @main, and this file is now its templates/estate-audit-caller.yml with the SHA filled in. The pin is 376898b, cicd-suite main and the #50 merge. It runs the same 24 gates as 4f54042, which every run here used until today: both pin the gate composites at 1aa6bfb, and actions/ is identical between the two. The difference is shape. The audit now reports five checks (governance, hygiene, manifests, languages, advisory), and a failing gate no longer hides the gates after it. None of these checks is required by a ruleset here, so the renamed checks need no ruleset change. The caller grants contents: read, the only permission the called workflow declares. actions.lock keeps the file as [], as for secret-scanner.yml: a cross-repository reusable call recorded in the lock fails at startup. actionlint is clean, the documentation guard and the 27 tests pass, and the 25 locally runnable gates at 1aa6bfb pass on this tree (manifest needs external validators). This PR's own run of the audit is the check on the new pin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV
Contributor
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
📒 Files selected for processing: 1
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Owner
Author
|
OSSF Scorecard / Run Scorecard PR is red, and the cause is not this PR. It is not a required check.
Everything this PR changes ran green:
Generated by Claude Code |
hyperpolymath
marked this pull request as ready for review
October 14, 2026 13:34
8 of 13 tasks
hyperpolymath
added a commit
that referenced
this pull request
Oct 19, 2026
…rd) (#34) ## Summary **`main` is currently broken.** Since 16 Oct, any job that resolves a lock record repeating its SHA as `ref` dies at "Set up job" with: > Unable to resolve action `actions/checkout@3d3c42e5…`: invalid lockfile pin That covers two required checks, the Agda proof gate and `scan / gitleaks`. A manual run of `proofs.yml` on `main` at `f5a4177` failed this way today ([39251522875](https://github.com/hyperpolymath/choreographic-types/actions/runs/39251522875)); the same commit passed on 15 Oct. Until this merges, no PR can pass its required checks. The scheduled OSSF Scorecard runs (16 to 19 Oct) fail with the same error, on `upload-sarif`. What job setup now refuses is a **tagged action whose lock record repeats the SHA as `ref`**. `gh actions-lock` records the release tag there. The check applies in two places: - **This repository's lock.** The `actions/checkout` record has had the SHA as `ref` since #33, which changed it from `v7.0.1`. The `github/codeql-action` record has had it since #31. - **The called repository's lock, for the actions a reusable workflow uses.** At `94572e6`, the commit the Secret Scanner was pinned to, the standards lock has the same SHA form. By `75bd599` standards had fixed its lock. ## Type of change - [x] 🐛 Bug fix - [ ] ✨ New feature - [ ] 🕳️ Soundness fix - [ ] 📖 Documentation - [x] 🔧 Build / CI / tooling - [ ] ♻️ Refactor - [x] 🔒 Security - [ ] 🧪 Tests only ## 📌 New pins - `hyperpolymath/standards` at `75bd5994470661a099df562d6d5ad2fe744dbd66` for both `scorecard-reusable.yml` (was `@main`) and `secret-scanner-reusable.yml` (was `94572e6`). Between `94572e6` and `75bd599` the scanner workflow changed only in its header. - Lock records copied from the standards lock: `actions/upload-artifact@cf430e03…` (v7.0.2) and `ossf/scorecard-action@2d114668…` (v2.4.4). ## What changes - **`actions.lock`:** - `actions/checkout` gets `ref: 'v7.0.1'` back, and `github/codeql-action` gets `ref: 'v4.38.0'`. `git ls-remote` confirms both tags. - Untagged workflow pins (cicd-suite, standards) keep the SHA as `ref`, as the standards lock does. - One `standards@75bd599` record, listing the actions both workflows use, replaces `standards@main` and `standards@94572e6`. - The header states the rule as observed. It no longer claims "36 workflows" or cites a script this repository doesn't have. - **`secret-scanner.yml`:** - Pinned at `75bd599`. - Drops `secrets: inherit`. The scanner workflow's header at that commit says callers must not pass it: the workflow declares and reads no secrets, and `inherit` forwards every secret the caller can see (CWE-250, standards#1108 §6b). - The caller's comment calling `inherit` required is corrected. - **`scorecard.yml`:** pinned at `75bd599`. ## How has this been verified? - **Lock and workflows:** keys sorted, no dangling or unused entries. actionlint is clean on both workflows. - **Repository checks:** `node scripts/check-repository.mjs` passes, and all 27 tests pass. - **On this PR, step by step:** - Fixing the two refs let the Agda gate and CodeQL get past setup, and CodeQL passed. - Repinning the scanner let `scan / gitleaks` pass. - Scorecard (PR job) and the five estate-audit jobs pass. - **The scheduled Scorecard run is confirmed only after merge.** It happens only on `main`, and Scorecard refuses manual runs on other branches ("Only the default branch main is supported"). The first 04:10 UTC run after merge settles it. ## Checklist - [x] Commits are signed (SSH, verified by GitHub) - [x] Local checks pass - [x] SPDX headers untouched - [x] Docs do not overstate: the lock header's false claims are removed - [x] No soundness hole: workflow configuration only ## Notes for reviewers - Four commits, in the order the diagnosis went. Commit 3 (a `uses:` list on the 94572e6 record) did not fix the scanner, and commit 4 removes that record. Squash on merge. - Branch restarted from `main` at `f5a4177` after #32 merged. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The estate audit called
hyperpolymath/cicd-suite/.github/workflows/main-estate-audit.yml@main. So any change to cicd-suite ran here on the next push, with this repository's token and without review. This PR pins it by full SHA, which you decided after #31.cicd-suite #50, merged today, makes a pinned thin caller the estate's way of consuming the audit. Its README says "Pin a full SHA, never
@mainor a tag".main-estate-audit.ymlis now itstemplates/estate-audit-caller.yml, with the SHA filled in.Type of change
📌 New pins
hyperpolymath/cicd-suite/.github/workflows/main-estate-audit.yml@376898bbe872226866ccbc7648d43123b8bb21b9: cicd-suitemain, the #50 merge. It is reachable frommain, which matters because a PR-head-only commit is refused at job creation.What changes in practice
4f54042, which every audit run here used until today. Both pin the gate composites at1aa6bfb, andactions/is identical between the two commits. The two stub gates (prat,semantic-audit) are no longer run.estate / governance,hygiene,manifests,languagesandadvisory. A failing gate no longer hides the gates after it. No ruleset requires the old check, so nothing in Settings needs changing.contents: read, the only permission the called workflow declares. Asking for more than the caller grants is what stopped Scorecard before CI: CodeQL and OSSF Scorecard start again #31.actions.lockunchanged. It keeps this file as[], the same shape assecret-scanner.yml. cicd-suite records that a cross-repository reusable call written into the lock fails at startup with zero jobs.templates/track-estate-audit.ymlcan open those PRs weekly, but it needs anAUTOMATION_TOKENsecret, so it is not added here.How has this been verified?
node scripts/check-repository.mjspasses, and all 27 tests pass.1aa6bfbpass on this tree.manifestneeds external validators.estate / *checks rather than one, all green except possiblyadvisory, which cannot fail.Checklist
[]lock entry are neededNotes for reviewers
actions.lock, while cicd-suite and the startup behaviour require them left out. The two estate rules disagree; this PR does not change that.mainate997664after CI: CodeQL and OSSF Scorecard start again #31 merged.🤖 Generated with Claude Code
https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV
Generated by Claude Code
Summary by CodeRabbit