fix(ci): resolve the safely-fixable code-scanning alerts (and one live Bun policy contradiction) - #18
fix(ci): resolve the safely-fixable code-scanning alerts (and one live Bun policy contradiction)#18hyperpolymath wants to merge 2 commits into
Conversation
This repo has 151 open code-scanning alerts and a code_scanning rule with
threshold `all`, so every one of them blocks every PR. This fixes the classes
that are safe to fix, and deliberately leaves two that are not.
FIXED
SD009 ×4 SPDX-License-Identifier added at LINE 1 of ffi/zig/src/main.zig and
src/abi/{Layout,Types,Foreign}.idr. Licence DERIVED from the repo
(MPL-2.0, per LICENSE and 57 existing headers), comment style
matched per language (// zig, -- idris).
SD007 ×3 .claude/CLAUDE.md referenced STATE.scm / META.scm / ECOSYSTEM.scm;
repointed at .machine_readable/descriptiles/*.a2ml. `guix.scm` was
deliberately NOT touched - it is a real Guile file, not metadata.
hygiene ×25 top-level `permissions: contents: read` added to 5 workflows that
lacked one, and `timeout-minutes: 15` to 10 jobs that lacked one.
Edits were made with `yq`, not sed, so malformed YAML is impossible, and every
one of the 32 workflows was re-parsed afterwards. ⚠ Verified specifically that
the added top-level permissions do NOT strip job-level grants: the
jekyll-gh-pages `deploy` job keeps pages:write + id-token:write, and both
scorecard jobs keep security-events:write + id-token:write. Job-level
permissions override top-level, and each job here declares its own.
ALSO FIXED - two blanked-token scars from the language purge
ts-blocker.yml "New TS/JS files detected. Use instead."
-> "... Use AffineScript instead."
npm-bun-blocker.yml blocked `bun.lockb` and said "Use instead."
⚠ The second was a live POLICY CONTRADICTION, not just a cosmetic blank. The
owner ruled 2026-08-26 that Bun is tier 1 and that "package.json plus bun.lock
are expected, not anti-patterns" - while this workflow FAILED THE BUILD if a
Bun lockfile was present. It now rejects npm/pnpm/yarn lockfiles only.
Estate-wide: 272 of 273 copies across 34 repos still block Bun this way.
NOT FIXED, DELIBERATELY
1. 79 alerts (PinnedDependenciesID + actions/unpinned-tag) - DO NOT inline-pin.
This repo is lockfile-enforced: .github/workflows/actions.lock exists and
`gh actions-lock --no-fix` reports it fully clean across all 32 workflows.
On lockfile-enforced repos `actions/checkout@v7.0.1` IS pinned, and inline
SHA-pinning REMOVES the action from the lockfile, reducing coverage. This was
measured before: inline-pinning 40 refs on hypatia produced 14 workflow
startup_failures and turned both required CodeQL contexts into phantoms.
Scorecard is simply wrong for this repo class.
2. 6 SD004 alerts - the a2ml files exist in BOTH .machine_readable/6a2/ and
.machine_readable/descriptiles/, and ALL SIX PAIRS HAVE DIVERGED. The
canonical location holds TEMPLATE RESIDUE for STATE and ECOSYSTEM while the
retired location holds real content, and the reverse for others. Choosing a
side would destroy real project metadata, so nothing was moved or deleted -
zero a2ml files are touched by this commit. Needs a human decision.
Estate-wide: 76 repos hold both copies, 74 of them diverged.
Remaining after this: 19 SD022 (docs referencing directories that no longer
exist) and 15 posture metrics (MaintainedID, CodeReviewID) that no single PR can
change.
|
|
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
This PR effectively addresses several security hygiene issues by implementing timeout-minutes and least-privilege permissions across GitHub workflows. Although Codacy indicates the PR is 'up to standards', two significant issues should be addressed before merging:
- Policy Contradiction: The PR promotes Bun to 'Tier 1' status in CI, but the primary project guide (
.claude/CLAUDE.md) still lists Bun as 'BANNED'. This inconsistency will cause friction for developers and AI agents. - Permission Shadowing: The OpenSSF Scorecard workflow contains a configuration error where job-level permissions override the top-level declaration, stripping the necessary
actions: readpermission and potentially causing job failure.
Additionally, some metadata redactions in the diff have limited the ability to verify specific file path updates against the project's audit requirements.
About this PR
- The redaction of path strings in
.claude/CLAUDE.mdprevents verification of the specific file paths repointed to satisfy alert SD007. Ensure the final merged paths accurately point to.machine_readable/descriptiles/*.a2ml.
1 comment outside of the diff
.github/workflows/jekyll.yml
line 50⚪ LOW RISK
Nitpick: The globalpermissionsblock added here is redundant because all jobs in this workflow already specify their own job-level permissions, which take precedence. This should be removed to keep the workflow clean.
Test suggestions
- Verify npm-bun-blocker.yml rejects package-lock.json, pnpm-lock.yaml, and yarn.lock additions
- Verify npm-bun-blocker.yml allows bun.lock and bun.lockb files
- Verify ts-blocker.yml rejects new .ts/.js files and suggests 'AffineScript' in the failure message
- Verify workflow jobs have timeout-minutes configured
- Verify license headers are present at line 1 of the specified Zig and Idris files
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| run: | | ||
| if [ -f "package-lock.json" ] || [ -f "bun.lockb" ] || [ -f ".npmrc" ]; then | ||
| echo "❌ npm/bun artifacts detected. Use instead." | ||
| # Bun is tier 1 as of the 2026-08-26 owner ruling: package.json plus |
There was a problem hiding this comment.
🔴 HIGH RISK
The claim that Bun is 'Tier 1' contradicts the 'BANNED' list in .claude/CLAUDE.md. Since this PR intends to promote Bun to Tier 1 status, CLAUDE.md should be updated to remove Bun from the BANNED section and add it to the ALLOWED languages section to match the new CI policy.
| cancel-in-progress: true | ||
| permissions: | ||
| actions: read # required by the reusable workflow (staleness check reads workflow runs) | ||
| actions: read # required by the reusable workflow (staleness check reads workflow runs) |
There was a problem hiding this comment.
🟡 MEDIUM RISK
The 'actions: read' permission is stripped from the 'scorecard' job because the job-level permissions block (line 20) overrides the top-level declaration (line 12) without re-declaring it. This contradicts the requirement for the reusable workflow to function correctly.
Accepted review finding, raised INDEPENDENTLY by coderabbitai and codacy on several PRs in this wave, and correct. The blocker still listed .npmrc alongside the npm/pnpm/yarn lockfiles. But Bun reads .npmrc for private-registry and scoped-package authentication, so a perfectly valid Bun repository was still failed by the very check that was supposed to stop blocking Bun. Now rejects package-lock.json, pnpm-lock.yaml and yarn.lock only. 1 file(s). YAML re-parsed after every edit, and any file still mentioning .npmrc after the edit was reverted rather than shipped half-changed.
|
1 participant
This repo has 151 open code-scanning alerts and a
code_scanningrule with thresholdall— so every one of them blocks every PR. This fixes the classes that are safe to fix, and deliberately leaves two that are not.Fixed
SPDX-License-Identifieradded at line 1 offfi/zig/src/main.zigandsrc/abi/{Layout,Types,Foreign}.idr. Licence derived from the repo (MPL-2.0 — perLICENSEand 57 existing headers), comment style matched per language..claude/CLAUDE.mdreferencedSTATE.scm/META.scm/ECOSYSTEM.scm→ repointed at.machine_readable/descriptiles/*.a2ml.guix.scmdeliberately not touched — it's a real Guile file, not metadata.permissions: contents: readon 5 workflows lacking one;timeout-minutes: 15on 10 jobs lacking one.Edits used
yq, notsed, so malformed YAML is impossible — and all 32 workflows were re-parsed afterwards.Also fixed — two blanked-token scars, one of them live policy
ts-blocker.yml: "New TS/JS files detected. Use instead." → "Use AffineScript instead."npm-bun-blocker.yml: blockedbun.lockband said "Use instead."The second was a live contradiction, not cosmetics. The owner ruled Bun is tier 1 and that "
package.jsonplusbun.lockare expected, not anti-patterns" — while this workflow failed the build if a Bun lockfile was present. It now rejects npm/pnpm/yarn lockfiles only.Estate-wide: 272 of 273 copies across 34 repos still block Bun this way.
❌ Not fixed, deliberately
1. The 79 unpinned-action alerts — inline pinning would break this repo
.github/workflows/actions.lockexists andgh actions-lock --no-fixreports it fully clean across all 32 workflows. On lockfile-enforced repos,actions/checkout@v7.0.1is pinned, and inline SHA-pinning removes the action from the lockfile, reducing coverage.This was measured before: inline-pinning 40 refs on
hypatiaproduced 14 workflowstartup_failures and turned both required CodeQL contexts into phantoms. Scorecard is wrong for this repo class.2. The 6 SD004 alerts — choosing a side would destroy data
The a2ml files exist in both
.machine_readable/6a2/and.machine_readable/descriptiles/, and all six pairs have diverged. The canonical location holds template residue forSTATEandECOSYSTEMwhile the retired location holds real content — and the reverse for others.Zero a2ml files are touched by this PR. This needs a human decision. Estate-wide: 76 repos hold both copies, 74 of them diverged.
Remaining
19 × SD022 (docs referencing directories that no longer exist) and 15 posture metrics (
MaintainedID,CodeReviewID) that no single PR can change.