From 7f223ff1a12f80e85b5810a6de463421bd218ba1 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 9 Sep 2026 23:14:36 +0100 Subject: [PATCH 1/4] fix(manifests): invoke maintained validators and prove failures --- .github/workflows/code-hygiene-self-test.yml | 34 ++++++++++++++ actions/manifest-check/action.yml | 47 ++++++++++---------- 2 files changed, 58 insertions(+), 23 deletions(-) diff --git a/.github/workflows/code-hygiene-self-test.yml b/.github/workflows/code-hygiene-self-test.yml index 907c789..121a48f 100644 --- a/.github/workflows/code-hygiene-self-test.yml +++ b/.github/workflows/code-hygiene-self-test.yml @@ -9,6 +9,7 @@ on: - 'actions/referencing-check/**' - 'actions/secrets-check/**' - 'actions/boj-cartridge-check/**' + - 'actions/manifest-check/**' - '.github/workflows/code-hygiene-self-test.yml' pull_request: paths: @@ -17,6 +18,7 @@ on: - 'actions/referencing-check/**' - 'actions/secrets-check/**' - 'actions/boj-cartridge-check/**' + - 'actions/manifest-check/**' - '.github/workflows/code-hygiene-self-test.yml' permissions: @@ -39,3 +41,35 @@ jobs: - run: bash actions/referencing-check/test.sh - run: bash actions/secrets-check/test.sh - run: bash actions/boj-cartridge-check/test.sh + - name: Create manifest controls + id: fixtures + shell: bash + run: | + root="$RUNNER_TEMP/manifest-controls" + mkdir -p "$root/valid" "$root/bad-a2ml" "$root/bad-k9" + printf '%s\n' '# SPDX-License-Identifier: MPL-2.0' 'agent-id = "ci-control"' 'version = "1.0.0"' > "$root/valid/control.a2ml" + printf '%s\n' 'K9!' '# SPDX-License-Identifier: MPL-2.0' 'pedigree = {' ' metadata = { name = "ci-control", version = "1.0.0" },' " security = { leash = 'Kennel }," '}' > "$root/valid/control.k9.ncl" + printf '%s\n' 'invalid manifest' > "$root/bad-a2ml/control.a2ml" + printf '%s\n' 'invalid manifest' > "$root/bad-k9/control.k9.ncl" + echo "root=$root" >> "$GITHUB_OUTPUT" + - name: Valid manifests must pass + uses: ./actions/manifest-check + with: + path: ${{ steps.fixtures.outputs.root }}/valid + - name: Invalid A2ML must fail + id: bad-a2ml + continue-on-error: true + uses: ./actions/manifest-check + with: + path: ${{ steps.fixtures.outputs.root }}/bad-a2ml + - name: Invalid K9 Nickel manifest must fail + id: bad-k9 + continue-on-error: true + uses: ./actions/manifest-check + with: + path: ${{ steps.fixtures.outputs.root }}/bad-k9 + - name: Verify both negative controls failed + env: + A2ML_OUTCOME: ${{ steps.bad-a2ml.outcome }} + K9_OUTCOME: ${{ steps.bad-k9.outcome }} + run: test "$A2ML_OUTCOME" = failure && test "$K9_OUTCOME" = failure diff --git a/actions/manifest-check/action.yml b/actions/manifest-check/action.yml index 1f668db..29e1932 100755 --- a/actions/manifest-check/action.yml +++ b/actions/manifest-check/action.yml @@ -1,27 +1,28 @@ +# SPDX-License-Identifier: MPL-2.0 name: 'Manifest Validation Gate' -description: 'Strict parsing of .a2ml and .k9 files to guarantee they align with grammars and are fully populated.' +description: 'Validate A2ML/DEED and K9 manifest structure using the maintained format validators.' +inputs: + path: + description: 'Directory containing manifests to validate.' + required: false + default: '.' + strict: + description: 'Promote validator warnings to failures.' + required: false + default: 'false' runs: using: 'composite' steps: - - name: Run Manifest Check - shell: bash - run: | - echo "Validating A2ML and K9 manifests..." - - # We would use the a2ml-tool or k9-validate here - manifests=$(find . -name "*.a2ml" -o -name "*.k9" 2>/dev/null) - if [ -n "$manifests" ]; then - for m in $manifests; do - echo "Checking $m..." - # Check for unpopulated null points - if grep -qE '""|\[\]|\{\}|null' "$m"; then - echo "::warning::Manifest $m contains empty or null points. Ensure it is fully populated with explicit values or null markers." - fi - - # Placeholder for actual parser invocation - # a2ml-tool validate "$m" || exit 1 - done - echo "Manifest validation passed." - else - echo "No .a2ml or .k9 manifests found." - fi + - name: Validate A2ML and DEED manifests + uses: hyperpolymath/deed-ecosystem/validate-action@f7a40a4d5cc82b2e73f861119baa6818d77a448d + with: + path: ${{ inputs.path }} + strict: ${{ inputs.strict }} + - name: Validate K9 manifests + uses: hyperpolymath/k9-ecosystem/validate-action@347ee5d6a1b77831de56fe8da21a473724e4cac2 + with: + path: ${{ inputs.path }} + strict: ${{ inputs.strict }} +# These validators check manifest structure. Executable Nickel contracts need +# a separate Nickel evaluation step; neither an empty-field grep nor this +# structural check establishes that a contract evaluates or a proof holds. From c7972e885ed5ac47a3bb54842a1b98caa132398d Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 9 Sep 2026 23:38:46 +0100 Subject: [PATCH 2/4] fix(ci): consume the repaired K9 action archive --- actions/manifest-check/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/actions/manifest-check/action.yml b/actions/manifest-check/action.yml index 29e1932..75c14be 100755 --- a/actions/manifest-check/action.yml +++ b/actions/manifest-check/action.yml @@ -19,7 +19,7 @@ runs: path: ${{ inputs.path }} strict: ${{ inputs.strict }} - name: Validate K9 manifests - uses: hyperpolymath/k9-ecosystem/validate-action@347ee5d6a1b77831de56fe8da21a473724e4cac2 + uses: hyperpolymath/k9-ecosystem/validate-action@2ee51eed590b4722efcdca2fe4685ef24600bced with: path: ${{ inputs.path }} strict: ${{ inputs.strict }} From 0500de412dd7693a7650b080b8597ffa91283477 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 10 Sep 2026 00:34:32 +0100 Subject: [PATCH 3/4] test(manifests): give the K9 negative control a contract marker --- .github/workflows/code-hygiene-self-test.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/code-hygiene-self-test.yml b/.github/workflows/code-hygiene-self-test.yml index 121a48f..a90ea23 100644 --- a/.github/workflows/code-hygiene-self-test.yml +++ b/.github/workflows/code-hygiene-self-test.yml @@ -50,7 +50,9 @@ jobs: printf '%s\n' '# SPDX-License-Identifier: MPL-2.0' 'agent-id = "ci-control"' 'version = "1.0.0"' > "$root/valid/control.a2ml" printf '%s\n' 'K9!' '# SPDX-License-Identifier: MPL-2.0' 'pedigree = {' ' metadata = { name = "ci-control", version = "1.0.0" },' " security = { leash = 'Kennel }," '}' > "$root/valid/control.k9.ncl" printf '%s\n' 'invalid manifest' > "$root/bad-a2ml/control.a2ml" - printf '%s\n' 'invalid manifest' > "$root/bad-k9/control.k9.ncl" + # K9-suffixed library modules are outside pedigree validation. Give + # this negative control a real contract marker and omit its pedigree. + printf '%s\n' 'K9!' '# SPDX-License-Identifier: MPL-2.0' 'invalid manifest' > "$root/bad-k9/control.k9.ncl" echo "root=$root" >> "$GITHUB_OUTPUT" - name: Valid manifests must pass uses: ./actions/manifest-check From f2e4f8c98c2b6e1286f6f6f69ec38e70dd4395f1 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 10 Sep 2026 01:57:09 +0100 Subject: [PATCH 4/4] fix(actions): enforce transitive manifest pins in native runner tests --- .github/workflows/actions.lock | 29 ++++++++++ .github/workflows/code-hygiene-self-test.yml | 12 +++-- .github/workflows/label-triage.yml | 1 + .github/workflows/labels.yml | 1 + .github/workflows/main-estate-audit.yml | 56 ++++++++++---------- actions/manifest-check/action.yml | 4 +- 6 files changed, 70 insertions(+), 33 deletions(-) create mode 100644 .github/workflows/actions.lock diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..6c3d63c --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,29 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/code-hygiene-self-test.yml': + - 'actions/checkout@v7.0.1' + - 'hyperpolymath/deed-ecosystem@main' + - 'hyperpolymath/k9-ecosystem@main' + '.github/workflows/main-estate-audit.yml': + - 'actions/checkout@v7.0.1' + - 'hyperpolymath/deed-ecosystem@main' + - 'hyperpolymath/k9-ecosystem@main' +dependencies: + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'hyperpolymath/deed-ecosystem@main': + ref: 'main' + commit: 'sha1-f7a40a4d5cc82b2e73f861119baa6818d77a448d' + owner_id: 6759885 + repo_id: 1275649586 + 'hyperpolymath/k9-ecosystem@main': + ref: 'main' + commit: 'sha1-2155aa26a21758f2ba119f61bc7e0e1981c106fb' + owner_id: 6759885 + repo_id: 1275650185 diff --git a/.github/workflows/code-hygiene-self-test.yml b/.github/workflows/code-hygiene-self-test.yml index a90ea23..a076667 100644 --- a/.github/workflows/code-hygiene-self-test.yml +++ b/.github/workflows/code-hygiene-self-test.yml @@ -1,3 +1,6 @@ +# This workflow is managed by gh actions-lock. + +# SPDX-License-Identifier: MPL-2.0 name: Code Hygiene Self-Test on: @@ -32,8 +35,9 @@ jobs: test: name: Gate controls runs-on: ubuntu-latest + timeout-minutes: 10 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - run: bash actions/code-hygiene-check/test.sh @@ -55,19 +59,19 @@ jobs: printf '%s\n' 'K9!' '# SPDX-License-Identifier: MPL-2.0' 'invalid manifest' > "$root/bad-k9/control.k9.ncl" echo "root=$root" >> "$GITHUB_OUTPUT" - name: Valid manifests must pass - uses: ./actions/manifest-check + uses: $/actions/manifest-check with: path: ${{ steps.fixtures.outputs.root }}/valid - name: Invalid A2ML must fail id: bad-a2ml continue-on-error: true - uses: ./actions/manifest-check + uses: $/actions/manifest-check with: path: ${{ steps.fixtures.outputs.root }}/bad-a2ml - name: Invalid K9 Nickel manifest must fail id: bad-k9 continue-on-error: true - uses: ./actions/manifest-check + uses: $/actions/manifest-check with: path: ${{ steps.fixtures.outputs.root }}/bad-k9 - name: Verify both negative controls failed diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml index 9886e92..814a192 100644 --- a/.github/workflows/label-triage.yml +++ b/.github/workflows/label-triage.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Label Triage diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index c80b676..83ab941 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Labels diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml index b6d474c..edee14f 100755 --- a/.github/workflows/main-estate-audit.yml +++ b/.github/workflows/main-estate-audit.yml @@ -1,3 +1,5 @@ +# This workflow is managed by gh actions-lock. + name: Central Estate CI/CD Audit on: @@ -12,84 +14,84 @@ jobs: steps: # Test the actions from this revision, not the older implementations on # main. The pinned checkout is the only remote action this job needs. - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Required Files Gate - uses: ./actions/required-files-check + uses: $/actions/required-files-check - name: Code Hygiene Gate - uses: ./actions/code-hygiene-check + uses: $/actions/code-hygiene-check - name: Manifest Validation Gate - uses: ./actions/manifest-check + uses: $/actions/manifest-check - name: Idris2 ABI Purity Gate - uses: ./actions/idris2-abi-check + uses: $/actions/idris2-abi-check - name: Zig Hexadeca API Gate - uses: ./actions/zig-hexadeca-check + uses: $/actions/zig-hexadeca-check - name: Contractile Validation Gate - uses: ./actions/contractile-validation-check + uses: $/actions/contractile-validation-check - name: Recipes Set Validation Gate - uses: ./actions/recipes-set-check + uses: $/actions/recipes-set-check - name: Affirmation Document Gate - uses: ./actions/affirmation-check + uses: $/actions/affirmation-check - name: Academic Referencing Gate - uses: ./actions/referencing-check + uses: $/actions/referencing-check - name: Semantic Audit Gate - uses: ./actions/semantic-audit-check + uses: $/actions/semantic-audit-check - name: SPDX License Gate - uses: ./actions/spdx-license-check + uses: $/actions/spdx-license-check - name: Proof Runner Gate - uses: ./actions/proof-runner-check + uses: $/actions/proof-runner-check - name: PRAT Testing Gate - uses: ./actions/prat-check + uses: $/actions/prat-check - name: Panic Attack & Pons Gate - uses: ./actions/custom-tools-check + uses: $/actions/custom-tools-check - name: WWW & Well-Known Compliance Gate - uses: ./actions/www-compliance-check + uses: $/actions/www-compliance-check - name: BoJ Cartridge Validation Gate - uses: ./actions/boj-cartridge-check + uses: $/actions/boj-cartridge-check - name: Formatting Validation Gate - uses: ./actions/formatting-check + uses: $/actions/formatting-check - name: Accreditations & Badges Gate - uses: ./actions/badges-check + uses: $/actions/badges-check - name: Metrics Extraction Gate - uses: ./actions/metrics-check + uses: $/actions/metrics-check - name: Linguist & Banned Languages Gate - uses: ./actions/linguist-check + uses: $/actions/linguist-check - name: Test & Benchmarks Dashboard Gate - uses: ./actions/tests-benches-check + uses: $/actions/tests-benches-check - name: Hosting & Site Status Gate - uses: ./actions/hosting-check + uses: $/actions/hosting-check - name: Git-Sea Analytics Gate - uses: ./actions/gitsea-check + uses: $/actions/gitsea-check - name: Trust & Humans Validation Gate - uses: ./actions/trust-humans-check + uses: $/actions/trust-humans-check - name: Are We UnAPI Gate (Secret Scanning) - uses: ./actions/secrets-check + uses: $/actions/secrets-check - name: Reasonably Good Token Validation Gate - uses: ./actions/vaulted-tokens-check + uses: $/actions/vaulted-tokens-check diff --git a/actions/manifest-check/action.yml b/actions/manifest-check/action.yml index 75c14be..8d74f33 100755 --- a/actions/manifest-check/action.yml +++ b/actions/manifest-check/action.yml @@ -14,12 +14,12 @@ runs: using: 'composite' steps: - name: Validate A2ML and DEED manifests - uses: hyperpolymath/deed-ecosystem/validate-action@f7a40a4d5cc82b2e73f861119baa6818d77a448d + uses: hyperpolymath/deed-ecosystem/validate-action@main with: path: ${{ inputs.path }} strict: ${{ inputs.strict }} - name: Validate K9 manifests - uses: hyperpolymath/k9-ecosystem/validate-action@2ee51eed590b4722efcdca2fe4685ef24600bced + uses: hyperpolymath/k9-ecosystem/validate-action@main with: path: ${{ inputs.path }} strict: ${{ inputs.strict }}