From 19d33754f0c4a692402adab5213b1615665b77fc Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 10:40:39 +0000 Subject: [PATCH 1/3] CI: CodeQL and OSSF Scorecard start again Both workflows ended every run on main in startup_failure with no jobs. CodeQL (added in #30) referenced its actions by tag, and this repository requires full-SHA pins. It now uses actions/checkout at v7.0.1, as the proof gate does, and github/codeql-action init and analyze at b96794f0 (v4.38.0), the pin hyperpolymath/standards uses estate-wide (4.38.1 is held back there). Tag-to-SHA checked with git ls-remote. Scorecard's reusable workflow (hyperpolymath/standards, scorecard-reusable.yml) declares actions: read on its job, for the Packaging check, and its header says callers must grant it on the calling job. This caller granted contents, security-events and id-token only; a called job may not request more than its caller grants, so the run was refused at startup. The caller now grants actions: read at the workflow and job level. actions.lock lists the three workflows it was missing (codeql.yml with its two pins; main-estate-audit.yml and scorecard.yml, which call reusable workflows, as []), and the codeql-action dependency entry is copied from the standards lock (owner 9919, repo 259445878). actionlint clean on both files; the documentation guard, 27 tests and the 25 locally runnable estate gates pass. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV --- .github/workflows/actions.lock | 10 ++++++++++ .github/workflows/codeql.yml | 9 ++++++--- .github/workflows/scorecard.yml | 5 +++++ 3 files changed, 21 insertions(+), 3 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 3accb23..011c480 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -3,13 +3,18 @@ # Docs: https://gh.io/actions-lockfile version: 'v0.0.2' workflows: + '.github/workflows/codeql.yml': + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' '.github/workflows/documentation-integrity.yml': [] '.github/workflows/label-triage.yml': [] '.github/workflows/labels.yml': [] + '.github/workflows/main-estate-audit.yml': [] '.github/workflows/proofs.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/push-email-notify.yml': - 'hyperpolymath/smtp-notify-action@v0.2.0' + '.github/workflows/scorecard.yml': [] '.github/workflows/secret-scanner.yml': [] dependencies: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': @@ -17,6 +22,11 @@ dependencies: commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' owner_id: 44036562 repo_id: 197814629 + 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63': + ref: 'b96794f015dfd88f77b49b1c93e0fa7110f94c63' + commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' + owner_id: 9919 + repo_id: 259445878 'hyperpolymath/smtp-notify-action@v0.2.0': ref: 'v0.2.0' commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7' diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7ecfa09..046f3f3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -57,7 +57,7 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Add any setup steps before running the `github/codeql-action/init` action. # This includes steps like installing compilers or runtimes (`actions/setup-node` @@ -66,8 +66,11 @@ jobs: # uses: actions/setup-example@v1 # Initializes the CodeQL tools for scanning. + # Full-SHA pins: this repository requires them, and a tag reference + # ends every run in startup_failure. v4.38.0 is the estate's pin + # (hyperpolymath/standards); 4.38.1 is held back estate-wide. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -96,6 +99,6 @@ jobs: exit 1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 3fc9e74..81aa2e4 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -14,7 +14,11 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +# The reusable workflow's job requests actions: read (Scorecard's Packaging +# check lists workflow runs). A called job may not ask for more than its +# caller grants, so without it every run ends in startup_failure, no jobs. permissions: + actions: read contents: read security-events: write id-token: write @@ -24,6 +28,7 @@ jobs: name: OSSF Scorecard Check uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@main permissions: + actions: read contents: read security-events: write id-token: write From 33c91e4df891599a7106adad9b6a1e9a40755e91 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 10:44:50 +0000 Subject: [PATCH 2/3] Scorecard: pin the reusable workflow by SHA and record reusable refs in the lock With the caller fixed, Scorecard ran on this PR and its pin reconciliation failed by design: "job-level reusable ref absent from actions.lock" for scorecard.yml and main-estate-audit.yml. The reconciler (standards scripts/reconcile-scorecard-actions-lock.rb at 5a0891e9) requires every remote reusable-workflow reference to be listed under the workflow and under dependencies with a sha1 commit; [] does not cover it. scorecard.yml now calls scorecard-reusable.yml at standards 192389bf (main of 2026-10-14; the file is identical to the 2ae085c the PR run used), as the estate's reusable-workflow callers pin by SHA. actions.lock records hyperpolymath/standards@192389bf for it and hyperpolymath/standards@571cc734 for secret-scanner.yml, in the estate lock's own shape (owner 6759885, repo 1116521501). main-estate-audit.yml stays at cicd-suite@main and unlocked: pinning it would freeze this repository's central gate rules, which is the owner's decision, so Scorecard keeps that one finding. The reconciler's lock_covers_reusable_deps? run locally: every workflow COVER except main-estate-audit.yml (on main, three were ABSENT). actionlint clean; guard, 27 tests, estate gates pass. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV --- .github/workflows/actions.lock | 16 ++++++++++++++-- .github/workflows/scorecard.yml | 4 +++- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 011c480..30b8c2c 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -14,8 +14,10 @@ workflows: - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/push-email-notify.yml': - 'hyperpolymath/smtp-notify-action@v0.2.0' - '.github/workflows/scorecard.yml': [] - '.github/workflows/secret-scanner.yml': [] + '.github/workflows/scorecard.yml': + - 'hyperpolymath/standards@192389bf1b40b70c594464937db7fdbf39a9a964' + '.github/workflows/secret-scanner.yml': + - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd' dependencies: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': ref: 'v7.0.1' @@ -32,3 +34,13 @@ dependencies: commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7' owner_id: 6759885 repo_id: 1352485172 + 'hyperpolymath/standards@192389bf1b40b70c594464937db7fdbf39a9a964': + ref: '192389bf1b40b70c594464937db7fdbf39a9a964' + commit: 'sha1-192389bf1b40b70c594464937db7fdbf39a9a964' + owner_id: 6759885 + repo_id: 1116521501 + 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd': + ref: '571cc734cd69fb846032ec77a662aa8ee4fc32cd' + commit: 'sha1-571cc734cd69fb846032ec77a662aa8ee4fc32cd' + owner_id: 6759885 + repo_id: 1116521501 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 81aa2e4..b5d99a6 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -26,7 +26,9 @@ permissions: jobs: scorecard: name: OSSF Scorecard Check - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@main + # Pinned by SHA, as the estate's reusable-workflow callers are; actions.lock + # records it. Bump deliberately: it is the standards main of 2026-10-14. + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@192389bf1b40b70c594464937db7fdbf39a9a964 permissions: actions: read contents: read From 3df020584ef42a2b384e072aa8ca3c6519e1093b Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 10:48:55 +0000 Subject: [PATCH 3/3] Revert "Scorecard: pin the reusable workflow by SHA and record reusable refs in the lock" This reverts commit 33c91e4. With it, Secret Scanner and OSSF Scorecard both ended in startup_failure on this PR, and Secret Scanner carries the required scan / gitleaks check. GitHub enforces actions.lock at workflow startup. A caller's entry for a job-level reusable workflow has to enumerate the actions that workflow uses (the `uses:` list gh actions-lock writes, as in the standards lock); the hand-written entries had none, so the nested actions were unlocked and the runs were refused. Pinning scorecard-reusable.yml to standards' current main was also unsafe: standards' lock-selfcheck.yml records that its commits alternate between lock-consistent and not, and "pin to HEAD is the wrong reflex". Back to the first commit's state, where Secret Scanner, CodeQL and Scorecard all started. Recording reusable refs for Scorecard's pin reconciliation needs `gh actions-lock` itself to generate the entries. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV --- .github/workflows/actions.lock | 16 ++-------------- .github/workflows/scorecard.yml | 4 +--- 2 files changed, 3 insertions(+), 17 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 30b8c2c..011c480 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -14,10 +14,8 @@ workflows: - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/push-email-notify.yml': - 'hyperpolymath/smtp-notify-action@v0.2.0' - '.github/workflows/scorecard.yml': - - 'hyperpolymath/standards@192389bf1b40b70c594464937db7fdbf39a9a964' - '.github/workflows/secret-scanner.yml': - - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd' + '.github/workflows/scorecard.yml': [] + '.github/workflows/secret-scanner.yml': [] dependencies: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': ref: 'v7.0.1' @@ -34,13 +32,3 @@ dependencies: commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7' owner_id: 6759885 repo_id: 1352485172 - 'hyperpolymath/standards@192389bf1b40b70c594464937db7fdbf39a9a964': - ref: '192389bf1b40b70c594464937db7fdbf39a9a964' - commit: 'sha1-192389bf1b40b70c594464937db7fdbf39a9a964' - owner_id: 6759885 - repo_id: 1116521501 - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd': - ref: '571cc734cd69fb846032ec77a662aa8ee4fc32cd' - commit: 'sha1-571cc734cd69fb846032ec77a662aa8ee4fc32cd' - owner_id: 6759885 - repo_id: 1116521501 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index b5d99a6..81aa2e4 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -26,9 +26,7 @@ permissions: jobs: scorecard: name: OSSF Scorecard Check - # Pinned by SHA, as the estate's reusable-workflow callers are; actions.lock - # records it. Bump deliberately: it is the standards main of 2026-10-14. - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@192389bf1b40b70c594464937db7fdbf39a9a964 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@main permissions: actions: read contents: read