Repository navigation
ci: repair the checks that fail on main (workflow lint, K9 contracts, descriptile location) - #90
Open
hyperpolymath wants to merge 4 commits into
Open
hyperpolymath wants to merge 4 commits into
hyperpolymath wants to merge 4 commits into
Conversation
The workflow linter (`workflow-linter.yml`, step "Check SPDX Headers") requires `# SPDX-License-Identifier:` on line 1. In all 30 workflow files the comment of `gh actions-lock` was on line 1 and the SPDX line was on line 2, so the job `lint-workflows` failed on `main` each time a workflow changed. This commit exchanges line 1 and line 2 in each file. No other line changes. The lint steps "Check SPDX Headers", "Check Permissions Declaration", the SHA-pin check of reusable calls and "Check for Duplicate Workflows" pass in a local run. The step `gh actions-lock --verify-local` was not run locally. Known risk: `gh actions-lock` wrote its comment on line 1 before. If it does this again, the linter rule and the tool disagree again. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK
`Validate K9 contracts` (dogfood gate) failed on `main` with 11 errors in 8 files. `.githooks/validate-k9.sh` now reports 17 files, 0 errors and 0 warnings. The validator did not change. Contractiles (bust, intend, must, trust): - Add `signature_required = true` to `pedigree.security`. The K9 contract specification requires it at the leash 'Hunt (K9-S008). The files had the field in other sections only, where the validator does not look. - No `pedigree.signature` block is added (K9-S009). Only a signing ceremony can give a real value. Template leftovers, brought to the form of the current estate template (hyperpolymath/rsr-template-repo): - `coordination.k9` -> `coordination.k9.ncl` and `session/custom-checks.k9` -> `session/custom-checks.k9.ncl`: the same data as a Nickel K9 component with a pedigree (leash 'Kennel). The content is the template file, verbatim. - `.machine_readable/self-validating/methodology-guard.k9.ncl`: add the `K9!` line and the pedigree block (leash 'Yard), and fill the copyright placeholders with the string that the other files of this repository use. - `container/stapeln/deploy.k9.ncl` -> `deploy.k9.ncl.in`: the file has unfilled placeholders (service name, registry, port), so it is a template input and not a component. This repository has no service, so the placeholders are not filled. References to the 3 renamed files are updated in `root-allow.txt`, `session/README.adoc`, `container/README.adoc`, `container/0.1-AI-MANIFEST.a2ml`, `docs/STATE-VISUALIZER.adoc` and one comment block of `PLAYBOOK.a2ml`. Dated audit reports keep the old names. Local gates: validate-k9 PASS, check-root-shape PASS, scan-dangerous PASS, check-no-md-in-docs PASS. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK
…le/descriptiles
The Hypatia scan failed on `main` with 6 critical findings ("Descriptile
in retired location -- must be in .machine_readable/descriptiles/") and
3 high findings ("CI policy requires a retired descriptile path").
This commit moves the directory with `git mv` and updates each reference
to the old path. No descriptile changes its facts:
- 9 of the 12 moved files are pure renames. The other 3 change only
comment or title lines that name a file or the directory
(`0-AI-MANIFEST.a2ml`, `PLAYBOOK.a2ml`, `README.adoc`).
- CLADE, ECOSYSTEM, AGENTIC, STATE and ANCHOR have the same content hash
before and after the move.
- The CI policy in `openssf-compliance.yml`, `scripts/validate-template.sh`,
`.pre-commit-config.yaml`, both Justfiles, the Mustfile clauses, the
arrival-pack and coaptation scripts, and the documents (AFFIRMATION.adoc
included) now name the new path.
Not changed, on purpose:
- `STATE.a2ml` keeps its line about issue 18. The directory layout is now
the descriptiles layout, but the validation against the contractiles
that issue 18 tracks is not done.
- The arrival-pack region of `CLAUDE.md` and the coaptation receipt are
not regenerated (`nickel` is not available in this session). Both were
stale on `main` before this work: `CLAUDE.md` records STATE@5fc823be2cfa
and the file has the hash e6db74eaa45e, and the receipt names
`rsr-template-repo`.
- No `.a2ml` file is converted to a deed. The estate canon retires A2ML,
but it forbids a hand conversion in bulk, and the tools of this
repository read the `.a2ml` files.
Checked locally: the arrival-pack reader and the coaptation fact reader
run at the new path; the two Mustfile clauses for the directory pass;
validate-a2ml (103 files, 0 errors), validate-k9, validate-template,
check-root-shape, scan-dangerous, check-no-md-in-docs and
check-proof-status pass. Hypatia was not run locally.
Refs #18
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 1 minute. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
hyperpolymath
marked this pull request as ready for review
November 10, 2026 11:18
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
…s.yml uses
After the SPDX repair, `lint-workflows` reached its next step and
`gh actions-lock --verify-local` failed:
Ref changed haskell-actions/setup@v2.12.1
workflow uses ref "v2.12.1" but lockfile pins "v2.12.0"
Unused lockfile entry haskell-actions/setup@v2.12.0
1 of 30 workflows failed: 1 ref-changed, 1 stale
Pull request 79 (Dependabot) changed `pages.yml` to v2.12.1 and did not
change the lock. This defect was on `main` behind the SPDX failure.
This commit changes the lock record to v2.12.1. The commit value is the
peeled commit of the tag, read with `git ls-remote`:
0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d.
The record is written by hand, because `gh actions-lock` is not available
in this session. It has the form of the records that the tool wrote for
earlier version changes (list entry, key, `ref`, `commit`). The CI step
`gh actions-lock --verify-local` is the check.
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK
|
Owner
Author
CI status at
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
3 checks fail on
mainfor reasons in the repository itself. This pull request repairs them. It has 4 commits.main5461960lint-workflowsgh actions-lockwas on line 1. (2) Behind that failure:pages.ymluseshaskell-actions/setup@v2.12.1, but the lock pinnedv2.12.0.v2.12.1.Validate K9 contractsHypatia neurosymbolic scan.machine_readable/6a2/..machine_readable/descriptiles/.SonarQubestays red. It is not repaired here (see "Not in this pull request").Refs #18 (the directory layout only; the validation against the contractiles is not done). Refs #30 (part A, the content debt in this repository; part B is upstream).
Changes
Workflow lint
gh actions-lockwrote its comment on line 1 before. If it does this again, the linter rule and the tool disagree again. Instandards, the tool comment is on line 1 and that repository has no linter rule for line 1.actions.lock: the record ofhaskell-actions/setupchanges fromv2.12.0tov2.12.1. Pull request 79 (Dependabot) changedpages.ymland did not change the lock. The record is written by hand, becausegh actions-lockis not available in the session. The commit value is the peeled commit of the tag, read withgit ls-remote. The record has the form of the records that the tool wrote for earlier version changes. The CI stepgh actions-lock --verify-localpasses.K9 contracts
bust,intend,must,trust:signature_required = trueis added topedigree.security. The K9 contract specification requires it at the leash 'Hunt (K9-S008). Nopedigree.signatureblock is added (K9-S009): only a signing ceremony can give a real value.coordination.k9andsession/custom-checks.k9becomecoordination.k9.nclandsession/custom-checks.k9.ncl. The content is the file of the current estate template (rsr-template-repo), verbatim: the same data as a Nickel component with a pedigree.methodology-guard.k9.ncl: theK9!line and the pedigree block are added, as in the template. The copyright placeholders are filled with the string that 30 other files of this repository use.container/stapeln/deploy.k9.nclbecomesdeploy.k9.ncl.in, as in the template. It has unfilled placeholders (service name, registry, port). This repository has no service, so they are not filled.Descriptile location
git mv .machine_readable/6a2 .machine_readable/descriptiles. 9 of the 12 files are pure renames. The other 3 change only comment or title lines that name a file or the directory.openssf-compliance.yml,scripts/validate-template.sh,.pre-commit-config.yaml, both Justfiles, the Mustfile clauses, the arrival-pack and coaptation scripts, and the documents (AFFIRMATION.adocincluded, with permission of the owner).Not in this pull request
.a2mlfile is converted to a deed. The estate canon retires A2ML, but it forbids a hand conversion in bulk, and the tools of this repository read the.a2mlfiles. The move is the interim layout of the canon.SonarQubestays red. The job log shows an emptySONAR_TOKEN. The owner must set the secret or remove the job.standardsreusable workflows (secret-scanner.yml,governance.yml,hypatia-scan.yml,rust-ci.yml,mirror.yml,scorecard.yml) do not start. They need a new pin, which the estate applier instandardsmakes.dependabot-automerge.yml: Hypatia reports (high, not blocking) that the workflow writes withoutcontents: write. This is a permission decision of the owner.STATE.a2mlkeeps its line about issue 18. TheCLAUDE.mdarrival-pack region and the coaptation receipt are not regenerated (nonickelin the session). Both were stale onmainbefore this work.RSR Quality Checklist
Required
just testor equivalent).justis not available in the session. Run in the session:validate-k9.sh(17 files, 0 errors),validate-a2ml.sh(103 files, 0 errors),validate-template.sh,check-root-shape.sh,scan-dangerous.sh,check-no-md-in-docs.sh,check-proof-status.sh: each one passes.lint-workflowspasses in CI.unsafeblocks without// SAFETY:comments (none exist).envfiles includedAs Applicable
.machine_readable/descriptiles/STATE.a2mlupdated. Not done on purpose (see above)..machine_readable/descriptiles/ECOSYSTEM.a2mlupdated. Not applicable..machine_readable/descriptiles/META.a2mlupdated. Not applicable.TOPOLOGY.mdupdated. Not applicable.CHANGELOGor release notes updated. Not done: the change is to CI and repository metadata.Testing
validate-template.shgives the same output onmainand on this branch.5461960,Hypatia neurosymbolic scan,Validate K9 contractsandlint-workflowspass.Screenshots
Not applicable.
🤖 Generated with Claude Code
https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK