Skip to content

fix(ci): restore reachable standards workflow pins - #31

Merged
hyperpolymath merged 1 commit into
mainfrom
fix/restore-reachable-standards-pin
Sep 8, 2026
Merged

fix(ci): restore reachable standards workflow pins#31
hyperpolymath merged 1 commit into
mainfrom
fix/restore-reachable-standards-pin

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Replace the unreachable standards reusable-workflow commit 7fdc2705df74b4e352d2a1cde3e87a5923fdf329 with reachable standards main commit 092dedada188f56c5915f74a5fd40aac093742c3. The old SHA is an intermediate commit from squash-merged standards PR #596: it exists, but GitHub rejects it for cross-repository reusable workflows before creating jobs. This restores Hypatia/SARIF and the other affected workflows without weakening SHA pinning or branch protection. Estate incident: 251 active workflow files across 70 repositories in hyperpolymath and metadatastician.

@coderabbitai

coderabbitai Bot commented Sep 4, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: d55ef3db-14e9-4d39-aa86-e14b9e725fc3

📥 Commits

Reviewing files that changed from the base of the PR and between 8f60594 and 50bee32.

📒 Files selected for processing (3)
  • .github/workflows/governance.yml
  • .github/workflows/hypatia-scan.yml
  • .github/workflows/scorecard.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (20)
  • GitHub Check: governance / Debt ratchet
  • GitHub Check: governance / Licence consistency
  • GitHub Check: governance / Well-Known (RFC 9116 + RSR)
  • GitHub Check: governance / Exemption ratchet
  • GitHub Check: governance / Workflow security linter
  • GitHub Check: governance / Trusted-base reduction policy
  • GitHub Check: governance / Check Workflow Staleness
  • GitHub Check: governance / Language / package anti-pattern policy
  • GitHub Check: scan / Hypatia Neurosymbolic Analysis
  • GitHub Check: governance / Allowlist Preflight
  • GitHub Check: governance / Security policy checks
  • GitHub Check: governance / Actions lockfile verify
  • GitHub Check: governance / Code quality + docs
  • GitHub Check: governance / Guix packaging policy (Nix retired)
  • GitHub Check: governance / Live Actions policy (credentialed advisory)
  • GitHub Check: panic-attack assail
  • GitHub Check: Patch Bridge CVE triage
  • GitHub Check: analyze (javascript-typescript, none)
  • GitHub Check: openssf-compliance
  • GitHub Check: Hypatia neurosymbolic scan
⚠️ CI failures not shown inline (8)

GitHub Actions: Dogfood Gate / 1_Validate eclexiaiser manifest.txt: fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]Run if [ ! -f "eclexiaiser.toml" ]; then
 �[36;1mif [ ! -f "eclexiaiser.toml" ]; then�[0m
 �[36;1m  # Check if repo has a Containerfile — if so, recommend eclexiaiser�[0m
 �[36;1m  if [ -f "Containerfile" ]; then�[0m
 �[36;1m    echo "::warning::Containerfile present but no eclexiaiser.toml. Run \`eclexiaiser init\` to scaffold energy/carbon budgets."�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "has_manifest=false" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mecho "has_manifest=true" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m�[0m
 �[36;1m# Validate TOML structure using pre-installed yq�[0m
 �[36;1m(�[0m
 �[36;1m  PROJECT_NAME=$(yq -e '.project.name // ""' eclexiaiser.toml)�[0m
 �[36;1m  if [ -z "$PROJECT_NAME" ]; then�[0m
 �[36;1m      echo "ERROR: project.name is required" >&2�[0m
 �[36;1m      exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  FUNCTIONS_LEN=$(yq -e '.functions | length' eclexiaiser.toml)�[0m
 �[36;1m  if [ -z "$FUNCTIONS_LEN" ] || [ "$FUNCTIONS_LEN" -eq 0 ]; then�[0m
 �[36;1m      echo "ERROR: at least one [[functions]] entry is required" >&2�[0m
 �[36;1m      exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  for i in $(seq 0 $((FUNCTIONS_LEN - 1))); do�[0m
 �[36;1m      FN_NAME=$(yq -e ".functions[$i].name // \"\"" eclexiaiser.toml)�[0m
 �[36;1m      if [ -z "$FN_NAME" ]; then�[0m
 �[36;1m          echo "ERROR: function name cannot be empty" >&2�[0m
 �[36;1m          exit 1�[0m
 �[36;1m      fi�[0m
 �[36;1m      FN_SRC=$(yq -e ".functions[$i].source // \"\"" eclexiaiser.toml)�[0m
 �[36;1m      if [ -z "$FN_SRC" ]; then�[0m
 �[36;1m          echo "ERROR: function $FN_NAME has no source path" >&2�[0m
 �[36;1m          exit 1�[0m
 �[36;1m      fi�[0m
 �[36;1m  done�[0m
 �[36;1m  echo "Valid: $PROJECT_NAME ($FUNCTIONS_LEN function(s))"�[0m
 �[36;1m) || {�[0m
 �[36;1m  echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"�[0m

GitHub Actions: Dogfood Gate / Validate eclexiaiser manifest: fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]Run if [ ! -f "eclexiaiser.toml" ]; then
 �[36;1mif [ ! -f "eclexiaiser.toml" ]; then�[0m
 �[36;1m  # Check if repo has a Containerfile — if so, recommend eclexiaiser�[0m
 �[36;1m  if [ -f "Containerfile" ]; then�[0m
 �[36;1m    echo "::warning::Containerfile present but no eclexiaiser.toml. Run \`eclexiaiser init\` to scaffold energy/carbon budgets."�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "has_manifest=false" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mecho "has_manifest=true" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m�[0m
 �[36;1m# Validate TOML structure using pre-installed yq�[0m
 �[36;1m(�[0m
 �[36;1m  PROJECT_NAME=$(yq -e '.project.name // ""' eclexiaiser.toml)�[0m
 �[36;1m  if [ -z "$PROJECT_NAME" ]; then�[0m
 �[36;1m      echo "ERROR: project.name is required" >&2�[0m
 �[36;1m      exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  FUNCTIONS_LEN=$(yq -e '.functions | length' eclexiaiser.toml)�[0m
 �[36;1m  if [ -z "$FUNCTIONS_LEN" ] || [ "$FUNCTIONS_LEN" -eq 0 ]; then�[0m
 �[36;1m      echo "ERROR: at least one [[functions]] entry is required" >&2�[0m
 �[36;1m      exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  for i in $(seq 0 $((FUNCTIONS_LEN - 1))); do�[0m
 �[36;1m      FN_NAME=$(yq -e ".functions[$i].name // \"\"" eclexiaiser.toml)�[0m
 �[36;1m      if [ -z "$FN_NAME" ]; then�[0m
 �[36;1m          echo "ERROR: function name cannot be empty" >&2�[0m
 �[36;1m          exit 1�[0m
 �[36;1m      fi�[0m
 �[36;1m      FN_SRC=$(yq -e ".functions[$i].source // \"\"" eclexiaiser.toml)�[0m
 �[36;1m      if [ -z "$FN_SRC" ]; then�[0m
 �[36;1m          echo "ERROR: function $FN_NAME has no source path" >&2�[0m
 �[36;1m          exit 1�[0m
 �[36;1m      fi�[0m
 �[36;1m  done�[0m
 �[36;1m  echo "Valid: $PROJECT_NAME ($FUNCTIONS_LEN function(s))"�[0m
 �[36;1m) || {�[0m
 �[36;1m  echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"�[0m

GitHub Actions: Dogfood Gate / 2_Validate K9 contracts.txt: fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]K9 Configuration Validation
 Scanning . for K9 files (.k9, .k9.ncl)...
 Found 1 K9 file(s)
   Validating: ./container/deploy.k9.ncl
 ##[error]Pedigree block missing 'name' field (in pedigree.metadata.name or pedigree.name)

GitHub Actions: Dogfood Gate / Validate K9 contracts: fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]K9 Configuration Validation
 Scanning . for K9 files (.k9, .k9.ncl)...
 Found 1 K9 file(s)
   Validating: ./container/deploy.k9.ncl
 ##[error]Pedigree block missing 'name' field (in pedigree.metadata.name or pedigree.name)

GitHub Actions: Dogfood Gate / 3_Validate A2ML manifests.txt: fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]A2ML Manifest Validation
 Scanning . for .a2ml files...
 Found 112 .a2ml file(s)
   Validating: ./.machine_readable/6a2/AGENTIC.a2ml
   Validating: ./.machine_readable/6a2/ECOSYSTEM.a2ml
   Validating: ./.machine_readable/6a2/META.a2ml
   Validating: ./.machine_readable/6a2/NEUROSYM.a2ml
   Validating: ./.machine_readable/6a2/PLAYBOOK.a2ml
   Validating: ./.machine_readable/6a2/STATE.a2ml
   Validating: ./.machine_readable/CLADE.a2ml
   Validating: ./.machine_readable/ECOSYSTEM.a2ml
   Validating: ./.machine_readable/ENSAID_CONFIG.a2ml
   Validating: ./.machine_readable/META.a2ml
   Validating: ./.machine_readable/STATE.a2ml
   Validating: ./.machine_readable/agent_instructions/coverage.a2ml
   Validating: ./.machine_readable/agent_instructions/debt.a2ml
   Validating: ./.machine_readable/agent_instructions/methodology.a2ml
   Validating: ./.machine_readable/ai/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/ai/AI.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/anchors/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/anchors/ANCHOR.a2ml
   Validating: ./.machine_readable/configs/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/contractiles/dust/Dustfile.a2ml
   Validating: ./.machine_readable/contractiles/must/Mustfile.a2ml
   Validating: ./.machine_readable/contractiles/trust/Trustfile.a2ml
   Validating: ./.machine_readable/integrations/feedback-o-tron.a2ml
   Validating: ./.machine_readable/integrations/groove.a2ml
   Validating: ./.machine_readable/integrations/proven.a2ml
   Validating: ./.machine_readable/integrations/verisimdb.a2ml
   Validating: ./.machine_readable/integrations/vexometer.a2ml
   Validating: ./.machine_readable/policies/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/policies/MAINTENANCE-AXES.a2ml
   Validating: ./.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml
   Validating: ./.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml
   ...

GitHub Actions: Dogfood Gate / Validate A2ML manifests: fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]A2ML Manifest Validation
 Scanning . for .a2ml files...
 Found 112 .a2ml file(s)
   Validating: ./.machine_readable/6a2/AGENTIC.a2ml
   Validating: ./.machine_readable/6a2/ECOSYSTEM.a2ml
   Validating: ./.machine_readable/6a2/META.a2ml
   Validating: ./.machine_readable/6a2/NEUROSYM.a2ml
   Validating: ./.machine_readable/6a2/PLAYBOOK.a2ml
   Validating: ./.machine_readable/6a2/STATE.a2ml
   Validating: ./.machine_readable/CLADE.a2ml
   Validating: ./.machine_readable/ECOSYSTEM.a2ml
   Validating: ./.machine_readable/ENSAID_CONFIG.a2ml
   Validating: ./.machine_readable/META.a2ml
   Validating: ./.machine_readable/STATE.a2ml
   Validating: ./.machine_readable/agent_instructions/coverage.a2ml
   Validating: ./.machine_readable/agent_instructions/debt.a2ml
   Validating: ./.machine_readable/agent_instructions/methodology.a2ml
   Validating: ./.machine_readable/ai/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/ai/AI.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/anchors/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/anchors/ANCHOR.a2ml
   Validating: ./.machine_readable/configs/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/contractiles/dust/Dustfile.a2ml
   Validating: ./.machine_readable/contractiles/must/Mustfile.a2ml
   Validating: ./.machine_readable/contractiles/trust/Trustfile.a2ml
   Validating: ./.machine_readable/integrations/feedback-o-tron.a2ml
   Validating: ./.machine_readable/integrations/groove.a2ml
   Validating: ./.machine_readable/integrations/proven.a2ml
   Validating: ./.machine_readable/integrations/verisimdb.a2ml
   Validating: ./.machine_readable/integrations/vexometer.a2ml
   Validating: ./.machine_readable/policies/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/policies/MAINTENANCE-AXES.a2ml
   Validating: ./.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml
   Validating: ./.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml
   ...

GitHub Actions: Dogfood Gate / 4_Groove manifest check.txt: fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Dogfood Gate / Groove manifest check: fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m
🔇 Additional comments (3)
.github/workflows/governance.yml (1)

27-27: LGTM!

.github/workflows/hypatia-scan.yml (1)

23-23: LGTM!

.github/workflows/scorecard.yml (1)

16-16: LGTM!


📝 Summary

Summary by CodeRabbit

  • Chores
    • Updated automated governance, security scanning and supply-chain checks to use newer approved workflow revisions.
    • Maintains current validation and security-monitoring processes for future changes.

Walkthrough

The governance, Hypatia, and Scorecards workflows now reference the pinned revision 092dedada188f56c5915f74a5fd40aac093742c3 of their shared reusable workflows.

Changes

Reusable workflow pin updates

Layer / File(s) Summary
Update reusable workflow revisions
.github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/scorecard.yml
The three workflows now use the newer pinned revision 092dedada188f56c5915f74a5fd40aac093742c3.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to 50bee

The workflow callers now use the reachable pinned standards revision, restoring reusable workflow execution without changing caller permissions or workflow structure. The change is ready to merge.

Poem

A rabbit checks the workflow trail
New pins march in a tidy line
Governance hops ahead
Hypatia scans with care
Scorecards guard the burrow fine

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description explains the change, cause, impact, and intended outcome, but it does not follow the repository template. It omits the required Summary, Changes, RSR Quality Checklist, Testing, and Sc… Rewrite the description using the repository template. Add the required headings, list the workflow pin changes, complete the applicable checklist items, describe testing or state that no tests were required, and include screenshots or term…
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the CI change: restoring reachable pins for the standards reusable workflows.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Description check

Explanation

The description explains the change, cause, impact, and intended outcome, but it does not follow the repository template. It omits the required Summary, Changes, RSR Quality Checklist, Testing, and Screenshots sections.

Resolution

Rewrite the description using the repository template. Add the required headings, list the workflow pin changes, complete the applicable checklist items, describe testing or state that no tests were required, and include screenshots or terminal output when applicable.

  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@sonarqubecloud

sonarqubecloud Bot commented Sep 4, 2026

Copy link
Copy Markdown

@hyperpolymath
hyperpolymath merged commit 4475d52 into main Sep 8, 2026
27 of 33 checks passed
@hyperpolymath
hyperpolymath deleted the fix/restore-reachable-standards-pin branch September 8, 2026 04:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant