fix(ci): restore reachable standards workflow pins by hyperpolymath · Pull Request #54 · hyperpolymath/typell

hyperpolymath · 2026-09-04T16:35:03Z

Replace the unreachable standards reusable-workflow commit 7fdc2705df74b4e352d2a1cde3e87a5923fdf329 with reachable standards main commit 092dedada188f56c5915f74a5fd40aac093742c3. The old SHA is an intermediate commit from squash-merged standards PR #596: it exists, but GitHub rejects it for cross-repository reusable workflows before creating jobs. This restores Hypatia/SARIF and the other affected workflows without weakening SHA pinning or branch protection. Estate incident: 251 active workflow files across 70 repositories in hyperpolymath and metadatastician.

coderabbitai · 2026-09-04T16:35:55Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 37a0e555-d121-4546-81eb-84b545183507

📥 Commits

Reviewing files that changed from the base of the PR and between e73b931 and 92e8855.

📒 Files selected for processing (6)

.github/workflows/governance.yml
.github/workflows/hypatia-scan.yml
.github/workflows/mirror.yml
.github/workflows/rust-ci.yml
.github/workflows/scorecard.yml
.github/workflows/secret-scanner.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

GitHub Check: Bench — Type System Performance

⚠️ CI failures not shown inline (10)

GitHub Actions: Proof Gate / 0_idris2 --check (ABI proof modules).txt: fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]Run nix shell nixpkgs#idris2 -c ./scripts/check-idris2-proofs.sh
 �[36;1mnix shell nixpkgs#idris2 -c ./scripts/check-idris2-proofs.sh�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 /home/runner/work/_temp/65c02cde-0570-41cc-b560-e9857512ce9c.sh: line 1: nix: command not found
 ##[error]Process completed with exit code 127.

GitHub Actions: Proof Gate / idris2 --check (ABI proof modules): fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]Run nix shell nixpkgs#idris2 -c ./scripts/check-idris2-proofs.sh
 �[36;1mnix shell nixpkgs#idris2 -c ./scripts/check-idris2-proofs.sh�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 /home/runner/work/_temp/65c02cde-0570-41cc-b560-e9857512ce9c.sh: line 1: nix: command not found
 ##[error]Process completed with exit code 127.

GitHub Actions: Rust CI / 3_rust-ci _ Cargo check + clippy + fmt.txt: fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]Run cargo fmt --all -- --check
 �[36;1mcargo fmt --all -- --check�[0m
 shell: /usr/bin/bash -e {0}
 env:
   CARGO_HOME: /home/runner/.cargo
   CARGO_INCREMENTAL: 0
   CARGO_TERM_COLOR: always
   CACHE_ON_FAILURE: false
 ##[endgroup]
 Diff in /home/runner/work/typell/typell/crates/typell-affinescript/src/bridge.rs:32:
  use serde::{Deserialize, Serialize};
  use typell_core::types::{
 -    Effect, Predicate, PrimitiveType, Term, TermOp, Type, TypeDiscipline,
 -    TypeVar, UnifiedType, UsageQuantifier,
 +    Effect, Predicate, PrimitiveType, Term, TermOp, Type, TypeDiscipline, TypeVar, UnifiedType,
 +    UsageQuantifier,
  };
  /// An AffineScript quantity annotation in serialized form.
 Diff in /home/runner/work/typell/typell/crates/typell-affinescript/src/bridge.rs:62:
  #[derive(Debug, Clone, Serialize, Deserialize)]
  #[serde(tag = "type_kind")]
  pub enum AffineType {
 -    Var { id: u32 },
 -    Con { name: String },
 -    App { con: Box<AffineType>, args: Vec<AffineType> },
 +    Var {
 +        id: u32,
 +    },
 +    Con {
 +        name: String,
 +    },
 +    App {
 +        con: Box<AffineType>,
 +        args: Vec<AffineType>,
 +    },
      Arrow {
          param: Box<AffineType>,
          ret: Box<AffineType>,
 Diff in /home/runner/work/typell/typell/crates/typell-affinescript/src/bridge.rs:76:
          ret_type: Box<AffineType>,
          effect: AffineEffect,
      },
 -    Tuple { elements: Vec<AffineType> },
 -    Record { fields: Vec<AffineRowField> },
 -    Variant { fields: Vec<AffineRowField> },
 -    ForAll { var: u32, kind: AffineKind, body: Box<AffineType> },
 -    Exists { var: u32, kind: AffineKind, body: Box<AffineType> },
 -    Ref { inner: Box<AffineType> },
 -    Mut { inner: Box<AffineType> },
 -    Own { inner: Box<AffineType> },
 -    Refined { base: Box<AffineType>, predicate: AffinePredicate },
 -    Nat { expr: AffineNatExpr },
 +    Tuple {
 +        elements: Vec<AffineType>,
 +    },
 +    Record {
 +        fie...

GitHub Actions: Rust CI / rust-ci _ Cargo check + clippy + fmt: fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]Run cargo fmt --all -- --check
 �[36;1mcargo fmt --all -- --check�[0m
 shell: /usr/bin/bash -e {0}
 env:
   CARGO_HOME: /home/runner/.cargo
   CARGO_INCREMENTAL: 0
   CARGO_TERM_COLOR: always
   CACHE_ON_FAILURE: false
 ##[endgroup]
 Diff in /home/runner/work/typell/typell/crates/typell-affinescript/src/bridge.rs:32:
  use serde::{Deserialize, Serialize};
  use typell_core::types::{
 -    Effect, Predicate, PrimitiveType, Term, TermOp, Type, TypeDiscipline,
 -    TypeVar, UnifiedType, UsageQuantifier,
 +    Effect, Predicate, PrimitiveType, Term, TermOp, Type, TypeDiscipline, TypeVar, UnifiedType,
 +    UsageQuantifier,
  };
  /// An AffineScript quantity annotation in serialized form.
 Diff in /home/runner/work/typell/typell/crates/typell-affinescript/src/bridge.rs:62:
  #[derive(Debug, Clone, Serialize, Deserialize)]
  #[serde(tag = "type_kind")]
  pub enum AffineType {
 -    Var { id: u32 },
 -    Con { name: String },
 -    App { con: Box<AffineType>, args: Vec<AffineType> },
 +    Var {
 +        id: u32,
 +    },
 +    Con {
 +        name: String,
 +    },
 +    App {
 +        con: Box<AffineType>,
 +        args: Vec<AffineType>,
 +    },
      Arrow {
          param: Box<AffineType>,
          ret: Box<AffineType>,
 Diff in /home/runner/work/typell/typell/crates/typell-affinescript/src/bridge.rs:76:
          ret_type: Box<AffineType>,
          effect: AffineEffect,
      },
 -    Tuple { elements: Vec<AffineType> },
 -    Record { fields: Vec<AffineRowField> },
 -    Variant { fields: Vec<AffineRowField> },
 -    ForAll { var: u32, kind: AffineKind, body: Box<AffineType> },
 -    Exists { var: u32, kind: AffineKind, body: Box<AffineType> },
 -    Ref { inner: Box<AffineType> },
 -    Mut { inner: Box<AffineType> },
 -    Own { inner: Box<AffineType> },
 -    Refined { base: Box<AffineType>, predicate: AffinePredicate },
 -    Nat { expr: AffineNatExpr },
 +    Tuple {
 +        elements: Vec<AffineType>,
 +    },
 +    Record {
 +        fie...

GitHub Actions: Dogfood Gate / 1_Validate eclexiaiser manifest.txt: fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]Run if [ ! -f "eclexiaiser.toml" ]; then
 �[36;1mif [ ! -f "eclexiaiser.toml" ]; then�[0m
 �[36;1m  # Check if repo has a Containerfile — if so, recommend eclexiaiser�[0m
 �[36;1m  if [ -f "Containerfile" ]; then�[0m
 �[36;1m    echo "::warning::Containerfile present but no eclexiaiser.toml. Run \`eclexiaiser init\` to scaffold energy/carbon budgets."�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "has_manifest=false" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mecho "has_manifest=true" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m�[0m
 �[36;1m# Validate TOML structure using Python 3.11+ tomllib�[0m
 �[36;1mpython3 -c "�[0m
 �[36;1mimport tomllib, sys�[0m
 �[36;1mwith open('eclexiaiser.toml', 'rb') as f:�[0m
 �[36;1m    data = tomllib.load(f)�[0m
 �[36;1mproject = data.get('project', {})�[0m
 �[36;1mif not project.get('name', '').strip():�[0m
 �[36;1m    print('ERROR: project.name is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfunctions = data.get('functions', [])�[0m
 �[36;1mif not functions:�[0m
 �[36;1m    print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfor fn in functions:�[0m
 �[36;1m    if not fn.get('name', '').strip():�[0m
 �[36;1m        print('ERROR: function name cannot be empty', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1m    if not fn.get('source', '').strip():�[0m
 �[36;1m        print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1mprint(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')�[0m
 �[36;1m" || {�[0m
 �[36;1m  echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"�[0m

GitHub Actions: Dogfood Gate / Validate eclexiaiser manifest: fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]Run if [ ! -f "eclexiaiser.toml" ]; then
 �[36;1mif [ ! -f "eclexiaiser.toml" ]; then�[0m
 �[36;1m  # Check if repo has a Containerfile — if so, recommend eclexiaiser�[0m
 �[36;1m  if [ -f "Containerfile" ]; then�[0m
 �[36;1m    echo "::warning::Containerfile present but no eclexiaiser.toml. Run \`eclexiaiser init\` to scaffold energy/carbon budgets."�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "has_manifest=false" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mecho "has_manifest=true" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m�[0m
 �[36;1m# Validate TOML structure using Python 3.11+ tomllib�[0m
 �[36;1mpython3 -c "�[0m
 �[36;1mimport tomllib, sys�[0m
 �[36;1mwith open('eclexiaiser.toml', 'rb') as f:�[0m
 �[36;1m    data = tomllib.load(f)�[0m
 �[36;1mproject = data.get('project', {})�[0m
 �[36;1mif not project.get('name', '').strip():�[0m
 �[36;1m    print('ERROR: project.name is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfunctions = data.get('functions', [])�[0m
 �[36;1mif not functions:�[0m
 �[36;1m    print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfor fn in functions:�[0m
 �[36;1m    if not fn.get('name', '').strip():�[0m
 �[36;1m        print('ERROR: function name cannot be empty', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1m    if not fn.get('source', '').strip():�[0m
 �[36;1m        print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1mprint(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')�[0m
 �[36;1m" || {�[0m
 �[36;1m  echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"�[0m

GitHub Actions: Dogfood Gate / 3_Groove manifest check.txt: fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Dogfood Gate / Groove manifest check: fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Dogfood Gate / 4_Validate K9 contracts.txt: fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]K9 Configuration Validation
 Scanning . for K9 files (.k9, .k9.ncl)...
 Found 7 K9 file(s)
   Validating: ./.machine_readable/svc/k9/examples/ci-config.k9.ncl
   Validating: ./.machine_readable/svc/k9/examples/project-metadata.k9.ncl
   Validating: ./.machine_readable/svc/k9/examples/setup-repo.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-hunt.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-kennel.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-yard.k9.ncl
   Validating: ./container/deploy.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'

GitHub Actions: Dogfood Gate / Validate K9 contracts: fix(ci): restore reachable standards workflow pins

Conclusion: failure

View job details

##[group]K9 Configuration Validation
 Scanning . for K9 files (.k9, .k9.ncl)...
 Found 7 K9 file(s)
   Validating: ./.machine_readable/svc/k9/examples/ci-config.k9.ncl
   Validating: ./.machine_readable/svc/k9/examples/project-metadata.k9.ncl
   Validating: ./.machine_readable/svc/k9/examples/setup-repo.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-hunt.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-kennel.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-yard.k9.ncl
   Validating: ./container/deploy.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'

🔇 Additional comments (6)

.github/workflows/governance.yml (1)

30-30: LGTM!

Also applies to: 35-35

.github/workflows/hypatia-scan.yml (1)

22-22: LGTM!

Also applies to: 29-29

.github/workflows/mirror.yml (1)

10-10: LGTM!

Also applies to: 15-15

.github/workflows/rust-ci.yml (1)

17-17: LGTM!

.github/workflows/scorecard.yml (1)

13-13: LGTM!

.github/workflows/secret-scanner.yml (1)

25-25: LGTM!

📝 Summary

Summary by CodeRabbit

Chores
- Updated the pinned versions of shared governance, scanning, mirroring, supply-chain security, and secret-scanning workflows.
- Added read access for workflow actions where required.
- Workflow triggers, concurrency settings, and other behaviour remain unchanged.

Walkthrough

Six GitHub Actions workflows now reference reusable workflows at commit fad242d35291de1898242d6737ba02b74a59a2f2. Governance, Hypatia, and mirror workflows also grant actions: read.

Changes

Workflow maintenance

Layer / File(s)	Summary
Update reusable workflow pins `.github/workflows/governance.yml`, `.github/workflows/hypatia-scan.yml`, `.github/workflows/mirror.yml`, `.github/workflows/rust-ci.yml`, `.github/workflows/scorecard.yml`, `.github/workflows/secret-scanner.yml`	The reusable workflow references now use the pinned commit `fad242d35291de1898242d6737ba02b74a59a2f2`.
Grant actions read permission `.github/workflows/governance.yml`, `.github/workflows/hypatia-scan.yml`, `.github/workflows/mirror.yml`	The workflows add `actions: read` to their permissions blocks.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 92e88

This updates shared workflow pins and grants read-only Actions access where required, restoring reusable workflow execution without broadening write permissions. No merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the cause and intended outcome, but it does not follow the repository template. It omits the Changes, quality checklist, Testing, and Screenshots sections. It also names SHA 0…	Update the description to use the required template sections, complete or mark the checklist items, document testing, and state whether screenshots are not applicable. Correct the referenced target SHA so it matches the files changed in thi…

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarises the main change: restoring reachable pinned references for standards workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the cause and intended outcome, but it does not follow the repository template. It omits the Changes, quality checklist, Testing, and Screenshots sections. It also names SHA 092dedada188f56c5915f74a5fd40aac093742c3, while the changed files use SHA fad242d35291de1898242d6737ba02b74a59a2f2.

Resolution

Update the description to use the required template sections, complete or mark the checklist items, document testing, and state whether screenshots are not applicable. Correct the referenced target SHA so it matches the files changed in this pull request.

Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks each workflow pin
Six fresh hashes settle in
Three workflows read actions with care
Rust and scans align their share
The pipeline hops through clean air}

_{Comment @coderabbitai help to get the list of available commands.}

Every hyperpolymath/standards reusable-workflow pin on this branch now points at standards main HEAD (fad242d35291de1898242d6737ba02b74a59a2f2). Callers of reusables that request `actions: read` at that revision (governance, hypatia-scan, mirror) are granted it, because a pin bump alone startup-fails when the caller grants only `contents: read`. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

fix(ci): restore reachable standards workflow pins

e73b931

coderabbitai Bot approved these changes Sep 4, 2026

View reviewed changes

hyperpolymath merged commit 0a65f73 into main Sep 8, 2026
35 of 40 checks passed

hyperpolymath deleted the fix/restore-reachable-standards-pin branch September 8, 2026 04:51

hyperpolymath mentioned this pull request Sep 8, 2026

chore(ci): bump governance-reusable pin to standards main #55

Closed

Navigation Menu

fix(ci): restore reachable standards workflow pins - #54

fix(ci): restore reachable standards workflow pins#54
hyperpolymath merged 2 commits into
mainfrom
fix/restore-reachable-standards-pin

hyperpolymath commented Sep 4, 2026

Uh oh!

coderabbitai Bot commented Sep 4, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

hyperpolymath commented Sep 4, 2026

Uh oh!

coderabbitai Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Sep 4, 2026 •

edited

Loading