Repository navigation
CI: CodeQL and OSSF Scorecard start again - #31
Conversation
Both workflows ended every run on main in startup_failure with no jobs. CodeQL (added in #30) referenced its actions by tag, and this repository requires full-SHA pins. It now uses actions/checkout at v7.0.1, as the proof gate does, and github/codeql-action init and analyze at b96794f0 (v4.38.0), the pin hyperpolymath/standards uses estate-wide (4.38.1 is held back there). Tag-to-SHA checked with git ls-remote. Scorecard's reusable workflow (hyperpolymath/standards, scorecard-reusable.yml) declares actions: read on its job, for the Packaging check, and its header says callers must grant it on the calling job. This caller granted contents, security-events and id-token only; a called job may not request more than its caller grants, so the run was refused at startup. The caller now grants actions: read at the workflow and job level. actions.lock lists the three workflows it was missing (codeql.yml with its two pins; main-estate-audit.yml and scorecard.yml, which call reusable workflows, as []), and the codeql-action dependency entry is copied from the standards lock (owner 9919, repo 259445878). actionlint clean on both files; the documentation guard, 27 tests and the 25 locally runnable estate gates pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 53 minutes. View limit details
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Docstring Coverage |  |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
| Description Check | |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly identifies the main change: restoring CodeQL and OSSF Scorecard workflow startup. |
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
…in the lock With the caller fixed, Scorecard ran on this PR and its pin reconciliation failed by design: "job-level reusable ref absent from actions.lock" for scorecard.yml and main-estate-audit.yml. The reconciler (standards scripts/reconcile-scorecard-actions-lock.rb at 5a0891e9) requires every remote reusable-workflow reference to be listed under the workflow and under dependencies with a sha1 commit; [] does not cover it. scorecard.yml now calls scorecard-reusable.yml at standards 192389bf (main of 2026-10-14; the file is identical to the 2ae085c the PR run used), as the estate's reusable-workflow callers pin by SHA. actions.lock records metadatastician/standards@192389bf for it and metadatastician/standards@571cc734 for secret-scanner.yml, in the estate lock's own shape (owner 6759885, repo 1116521501). main-estate-audit.yml stays at cicd-suite@main and unlocked: pinning it would freeze this repository's central gate rules, which is the owner's decision, so Scorecard keeps that one finding. The reconciler's lock_covers_reusable_deps? run locally: every workflow COVER except main-estate-audit.yml (on main, three were ABSENT). actionlint clean; guard, 27 tests, estate gates pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV
|
OSSF Scorecard on this PR. The first commit fixed the startup failure: Scorecard now runs. Its PR job then failed by design at the pin reconciliation, naming two workflows with "job-level reusable ref absent from actions.lock":
Still expected to fail: Generated by Claude Code |
|
SonarCloud Code Analysis reports "analysis failed" (conclusion Generated by Claude Code |
…le refs in the lock" This reverts commit 33c91e4. With it, Secret Scanner and OSSF Scorecard both ended in startup_failure on this PR, and Secret Scanner carries the required scan / gitleaks check. GitHub enforces actions.lock at workflow startup. A caller's entry for a job-level reusable workflow has to enumerate the actions that workflow uses (the `uses:` list gh actions-lock writes, as in the standards lock); the hand-written entries had none, so the nested actions were unlocked and the runs were refused. Pinning scorecard-reusable.yml to standards' current main was also unsafe: standards' lock-selfcheck.yml records that its commits alternate between lock-consistent and not, and "pin to HEAD is the wrong reflex". Back to the first commit's state, where Secret Scanner, CodeQL and Scorecard all started. Recording reusable refs for Scorecard's pin reconciliation needs `gh actions-lock` itself to generate the entries. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV
|
Correction to my earlier comment. GitHub enforces The tree is now identical to the first commit ( Generated by Claude Code |
|
❌ The last analysis has failed. |
## Summary The estate audit called `hyperpolymath/cicd-suite/.github/workflows/main-estate-audit.yml@main`. So any change to cicd-suite ran here on the next push, with this repository's token and without review. This PR pins it by full SHA, which you decided after #31. cicd-suite #50, merged today, makes a pinned thin caller the estate's way of consuming the audit. Its README says "Pin a full SHA, never `@main` or a tag". `main-estate-audit.yml` is now its `templates/estate-audit-caller.yml`, with the SHA filled in. ## Type of change - [ ] 🐛 Bug fix - [ ] ✨ New feature - [ ] 🕳️ Soundness fix - [ ] 📖 Documentation - [x] 🔧 Build / CI / tooling - [ ] ♻️ Refactor - [x] 🔒 Security - [ ] 🧪 Tests only ## 📌 New pins - `hyperpolymath/cicd-suite/.github/workflows/main-estate-audit.yml@376898bbe872226866ccbc7648d43123b8bb21b9`: cicd-suite `main`, the #50 merge. It is reachable from `main`, which matters because a PR-head-only commit is refused at job creation. ## What changes in practice - **Same gates as before.** It runs the same 24 gates as `4f54042`, which every audit run here used until today. Both pin the gate composites at `1aa6bfb`, and `actions/` is identical between the two commits. The two stub gates (`prat`, `semantic-audit`) are no longer run. - **New shape.** One check becomes five: `estate / governance`, `hygiene`, `manifests`, `languages` and `advisory`. A failing gate no longer hides the gates after it. No ruleset requires the old check, so nothing in Settings needs changing. - **Permissions.** The caller grants `contents: read`, the only permission the called workflow declares. Asking for more than the caller grants is what stopped Scorecard before #31. - **`actions.lock` unchanged.** It keeps this file as `[]`, the same shape as `secret-scanner.yml`. cicd-suite records that a cross-repository reusable call written into the lock fails at startup with zero jobs. - **Moving the pin later.** It moves only by PR. cicd-suite's `templates/track-estate-audit.yml` can open those PRs weekly, but it needs an `AUTOMATION_TOKEN` secret, so it is not added here. ## How has this been verified? - actionlint is clean. - `node scripts/check-repository.mjs` passes, and all 27 tests pass. - The 25 locally runnable estate gates at `1aa6bfb` pass on this tree. `manifest` needs external validators. - The decisive check is this PR's own audit run, which calls the new pin. It should show five `estate / *` checks rather than one, all green except possibly `advisory`, which cannot fail. ## Checklist - [x] Commits are signed (SSH, verified by GitHub) - [x] Local checks pass - [x] SPDX header kept - [x] Docs do not overstate: the header says why the pin and the `[]` lock entry are needed - [x] No soundness hole: workflow configuration only ## Notes for reviewers - Scorecard's pin reconciliation stays red, for the reason given in #31. It wants reusable calls recorded in `actions.lock`, while cicd-suite and the startup behaviour require them left out. The two estate rules disagree; this PR does not change that. - Branch restarted from `main` at `e997664` after #31 merged. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV --- _Generated by [Claude Code](https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV)_ <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the automated estate audit workflow to run on pushes and pull requests targeting the main branch. It now uses a fixed version of the audit process and read-only repository permissions. The workflow no longer supports being triggered as a reusable workflow. No changes to end-user functionality are included. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude <noreply@anthropic.com>
Every job that resolves actions/checkout from this lock now dies at job setup: "Unable to resolve action actions/checkout@3d3c42e5: invalid lockfile pin". That covers the required Agda proof gate and scan / gitleaks, on this PR and on main (a manual run of proofs.yml on main at f5a4177 failed the same way today, run 39251522875; the same commit passed on 2026-10-15). The scheduled Scorecard failures since 2026-10-16 are the same error on the codeql-action record. Both records repeat the SHA as `ref`: checkout since #33, which changed it from 'v7.0.1', and codeql-action since #31. The standards lock, which gh actions-lock writes, records these SHA-keyed actions with their release tags as `ref` ('v7.0.1', 'v4.38.0'), and this lock did so for checkout until #33. Both records get their tags back; git ls-remote confirms v7.0.1 is 3d3c42e5 and v4.38.0 peels to b96794f0. The untagged workflow pins (cicd-suite, standards) keep the SHA as `ref`, as in the standards lock; the estate audit resolved its record fine on this PR. The lock stays sorted with no dangling or unused entries; the documentation guard passes. This PR's own runs are the check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV
…rd) (#34) ## Summary **`main` is currently broken.** Since 16 Oct, any job that resolves a lock record repeating its SHA as `ref` dies at "Set up job" with: > Unable to resolve action `actions/checkout@3d3c42e5…`: invalid lockfile pin That covers two required checks, the Agda proof gate and `scan / gitleaks`. A manual run of `proofs.yml` on `main` at `f5a4177` failed this way today ([39251522875](https://github.com/hyperpolymath/choreographic-types/actions/runs/39251522875)); the same commit passed on 15 Oct. Until this merges, no PR can pass its required checks. The scheduled OSSF Scorecard runs (16 to 19 Oct) fail with the same error, on `upload-sarif`. What job setup now refuses is a **tagged action whose lock record repeats the SHA as `ref`**. `gh actions-lock` records the release tag there. The check applies in two places: - **This repository's lock.** The `actions/checkout` record has had the SHA as `ref` since #33, which changed it from `v7.0.1`. The `github/codeql-action` record has had it since #31. - **The called repository's lock, for the actions a reusable workflow uses.** At `94572e6`, the commit the Secret Scanner was pinned to, the standards lock has the same SHA form. By `75bd599` standards had fixed its lock. ## Type of change - [x] 🐛 Bug fix - [ ] ✨ New feature - [ ] 🕳️ Soundness fix - [ ] 📖 Documentation - [x] 🔧 Build / CI / tooling - [ ] ♻️ Refactor - [x] 🔒 Security - [ ] 🧪 Tests only ## 📌 New pins - `hyperpolymath/standards` at `75bd5994470661a099df562d6d5ad2fe744dbd66` for both `scorecard-reusable.yml` (was `@main`) and `secret-scanner-reusable.yml` (was `94572e6`). Between `94572e6` and `75bd599` the scanner workflow changed only in its header. - Lock records copied from the standards lock: `actions/upload-artifact@cf430e03…` (v7.0.2) and `ossf/scorecard-action@2d114668…` (v2.4.4). ## What changes - **`actions.lock`:** - `actions/checkout` gets `ref: 'v7.0.1'` back, and `github/codeql-action` gets `ref: 'v4.38.0'`. `git ls-remote` confirms both tags. - Untagged workflow pins (cicd-suite, standards) keep the SHA as `ref`, as the standards lock does. - One `standards@75bd599` record, listing the actions both workflows use, replaces `standards@main` and `standards@94572e6`. - The header states the rule as observed. It no longer claims "36 workflows" or cites a script this repository doesn't have. - **`secret-scanner.yml`:** - Pinned at `75bd599`. - Drops `secrets: inherit`. The scanner workflow's header at that commit says callers must not pass it: the workflow declares and reads no secrets, and `inherit` forwards every secret the caller can see (CWE-250, standards#1108 §6b). - The caller's comment calling `inherit` required is corrected. - **`scorecard.yml`:** pinned at `75bd599`. ## How has this been verified? - **Lock and workflows:** keys sorted, no dangling or unused entries. actionlint is clean on both workflows. - **Repository checks:** `node scripts/check-repository.mjs` passes, and all 27 tests pass. - **On this PR, step by step:** - Fixing the two refs let the Agda gate and CodeQL get past setup, and CodeQL passed. - Repinning the scanner let `scan / gitleaks` pass. - Scorecard (PR job) and the five estate-audit jobs pass. - **The scheduled Scorecard run is confirmed only after merge.** It happens only on `main`, and Scorecard refuses manual runs on other branches ("Only the default branch main is supported"). The first 04:10 UTC run after merge settles it. ## Checklist - [x] Commits are signed (SSH, verified by GitHub) - [x] Local checks pass - [x] SPDX headers untouched - [x] Docs do not overstate: the lock header's false claims are removed - [x] No soundness hole: workflow configuration only ## Notes for reviewers - Four commits, in the order the diagnosis went. Commit 3 (a `uses:` list on the 94572e6 record) did not fix the scanner, and commit 4 removes that record. Squash on merge. - Branch restarted from `main` at `f5a4177` after #32 merged. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV --------- Co-authored-by: Claude <noreply@anthropic.com>
Summary
Both workflows ended every run on
maininstartup_failurewith no jobs (onmainat2224ecd: runs 38544583792 and 38544581357). Two different causes:@v7,@v4), and this repository requires full-SHA pins. It now pinsactions/checkoutat v7.0.1 (asproofs.ymldoes) andgithub/codeql-actioninit and analyze atb96794f0(v4.38.0), the pinhyperpolymath/standardsuses estate-wide; 4.38.1 is held back there. Tag-to-SHA confirmed withgit ls-remote.scorecard-reusable.ymlinhyperpolymath/standards, whose job declaresactions: read; its header says callers must grant that on the calling job. This caller did not, and a called job may not request more than its caller grants, so GitHub refused every run at startup. The caller now grantsactions: read.actions.locklistscodeql.ymlwith its two pins (dependency entry copied from the standards lock), andmain-estate-audit.ymlandscorecard.ymlas[], likesecret-scanner.yml.Type of change
📌 New pins
github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63(v4.38.0), forinitandanalyze.actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1(v7.0.1), already pinned inproofs.yml.How has this been verified?
19d3375(the same tree as the current head), CodeQL (both analyses), Scorecard and the Secret Scanner all started and ran jobs; onmainCodeQL and Scorecard fail at startup.actionlintclean;node scripts/check-repository.mjspasses; 27 tests pass; the 25 locally runnable estate gates pass.Checklist
Notes for reviewers
actions.lockdoes not record the job-level reusable references ofscorecard.ymlandmain-estate-audit.yml. Recording them correctly needsgh actions-lockto generate the entries with their nesteduses:lists, and a pin to a standards commit whose own lock is self-consistent. A hand-written attempt (33c91e4, reverted in3df0205) broke Secret Scanner and Scorecard at startup; see the comment on this PR.main-estate-audit.ymlshould be pinned by SHA at all (it freezes the central gate rules until bumped) or left at@mainwith the Scorecard finding.main; not this PR's.yamllintoncodeql.ymlreports 21 issues onmainand 23 here; the two new ones are the long pinneduses:lines this repository already accepts.mainat2224ecd; three commits, the last two cancelling out.🤖 Generated with Claude Code
https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV