You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit 6e38719
Browse filesBrowse the repository at this point in the historyBrowse files
authored
feat(fix-scripts): repair the three workflow-pin defect classes; re-pin this repo's standards callers (#615)
## Why
Three defect classes killed Rust CI across the estate this fortnight,
each a setup failure that reads as a code failure.
hyperpolymath/cicd-suite#54 built gates in which they cannot occur;
hypatia (hyperpolymath/hypatia, companion PR) detects them; this is the
actuation half: a fix script per class, a registry row, and a contract
test run by `rust.yml`.
| Class | Rule | Script |
|---|---|---|
| SHA-pinned `dtolnay/rust-toolchain` with no `toolchain:` input
(`'toolchain' is a required input`;
hyperpolymath/plasma-parser-writer#105) | WF026 |
`scripts/fix-rust-toolchain-input.sh` |
| Caller pinned at a reusable revision the estate has **measured** dead
(June 2026 toolchain window, 83 commits; 2026-08-19..10-19 lock window,
545 commits) | WF027, PIN-003, WF016 |
`scripts/fix-stale-reusable-pin.sh` +
`scripts/lib/stale-reusable-pins.tsv` |
| `actions.lock` record whose `ref:` is its own SHA, which GitHub
rejects at `Set up job` since ~2026-10-15 (`invalid lockfile pin`) |
PI006 | `scripts/fix-lock-self-sha-refs.sh` +
`scripts/lib/action-ref-tags.tsv` |
Design points worth a reviewer's eye:
* The stale-pin script moves a pin **only** to the replacement the table
names, never to "newest" (standards' `lock-selfcheck.sh` exists because
newer can be less usable). The table was generated from a walk of
standards' history, file content and lock records checked per commit,
not dates.
* If the caller's `actions.lock` names the stale SHA, it follows the
pin; two dead SHAs moving to one replacement are merged into one record.
The nested `uses:` list is **not** recomputed here and the script says
so (that closure is the `gh actions-lock` / `check-lock-sync.sh` step).
* The self-SHA script takes tags from a map whose every row comes from
the lock GitHub accepts (standards@`75bd599`), falling back to `git
ls-remote --tags`; a commit with no tag is reported and left, exit 1.
Reusable-workflow records keep their SHA ref, as the accepted lock does.
* `AGENTIC.a2ml` names what an agent may and may not do with these:
never choose a replacement SHA, never recompute a closure here, always
idempotent.
## Dogfooded on this repository
The five standards callers (governance, hypatia-scan, mirror, scorecard,
secret-scanner) were pinned inside the lock window (`da2c748`,
`571cc73`) and have been dying at `Set up job` since 2026-10-16
([Governance run
39105727502](https://github.com/hyperpolymath/gitbot-fleet/actions/runs/39105727502)
and every run after). They now pin `75bd599`; `actions.lock` holds one
`standards@75bd599` record whose nested list is the union of what those
five reusables use at that commit, every third-party record copied
verbatim from standards' own lock, the seven self-SHA refs given their
tags, and the three Dependabot bumps the lock had missed
(`download-artifact` v8.0.2, `upload-artifact` v7.0.2) resynced.
`scripts/check-lock-sync.sh`: in sync, transitively closed.
## Evidence
* `scripts/tests/fix-workflow-pins.sh`: 28 checks — planted defects
fixed, planted non-defects untouched, second runs byte-identical,
controls with an empty table. Wired into `rust.yml`'s
`dispatch-contracts` job.
* `scripts/tests/dispatch-paths.sh` still passes. `bash -n` and the
fleet's JSON registry parse.
No bot slot, manifest or quarantine change; `[mass-delete-ok]` not
needed (no deletions).
Commits on this branch are unsigned: no signing key is available in this
session (the configured key file is empty). GitHub signs the squash
merge.
---
_Generated by [Claude
Code](https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8)_
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated shared governance, security scanning, mirroring, and scorecard
workflows, with explicit secret mappings where needed.
* Added tools to repair stale workflow references, missing Rust
toolchain settings, and lockfile references.
* **Bug Fixes**
* Rust formatting checks now block CI when formatting requirements are
not met.
* **Tests**
* Added offline checks for workflow maintenance tools, including
verification that repeated runs leave corrected files unchanged.
* CI now runs these checks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?v=4&size=40){kind=avatar}
0 commit comments