Repository navigation
ci(lock): drop orphan asana/setup-python records from actions.lock - #1238
Merged
Merged
Conversation
signed-push stopped calling Asana/push-signed-commits in #1233, which replaced it with push-verified.sh (bash, gh, jq). Two records it brought into actions.lock were left behind and nothing references them now: - Asana/push-signed-commits@d615ca8 - actions/setup-python@v2, its only transitive edge. This was the only non-SHA key in the lock. No workflows: list and no nested uses: names either ref. The lock tools cannot remove them: prune-stale.sh works only on the workflows: section, and close-lock.sh only adds records. So the two dependencies: blocks were deleted with a gawk filter that only touches that section. Nothing else in the lock changed. Checks, run before and after the deletion: - check-lock-sync: in sync. - validate-actions-lock: 25 refs, 27 keys (was 28). - check-actions-lock-gate with gh-actions-lock v0.1.6: coverage verified. - prune-stale: no-op. - close-lock: 0 dangling refs. Refs #1122. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014h2gFLLQibfB5N5hFz9ZCD
Contributor
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/38483762373 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
hyperpolymath
marked this pull request as ready for review
October 13, 2026 23:24
hyperpolymath
enabled auto-merge (squash)
October 13, 2026 23:24
hyperpolymath
disabled auto-merge
October 13, 2026 23:24
hyperpolymath
enabled auto-merge (squash)
October 13, 2026 23:24
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/38484021187 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
|
This was referenced Oct 14, 2026
hyperpolymath
added a commit
that referenced
this pull request
Oct 14, 2026
Closes #963. ## Summary Removes the `.hypatia-baseline.json` acknowledgement for `invalid_actions_lock`. The entry had: - `rule_module: ["workflow_audit", "workflow_hardening"]` - `file_pattern: "**actions.lock"` - tracking issue #963 - `expires_at: 2026-12-22` It acknowledged `asana/push-signed-commits@d615…`, which declared the floating transitive `actions/setup-python@v2`. One of its listed exit criteria was "we replace the action", and that is now met: - #1233 replaced the Asana action in `.github/actions/signed-push/` with `push-verified.sh`. - #1238 deleted both the `asana/push-signed-commits` and the `actions/setup-python@v2` records from `actions.lock`. While the entry stood, `**actions.lock` would have muted **any** new `invalid_actions_lock` finding in the repo until 2026-12-22. ## Evidence the rule no longer fires on `main` These are from the Hypatia scan on `main` at `7d2041a` ([run 38484072239](https://github.com/hyperpolymath/standards/actions/runs/38484072239), scanner pinned at `51ab6496`): - The scan reported 59 findings: critical=2, high=2, medium=34, warn=21. - `findings_kept` is `[]`. - None of the 59 suppressed findings has type `invalid_actions_lock`. The two highs are WH013 and `ncl_k9_missing_pedigree`. - No finding names `actions.lock`, asana or setup-python anywhere in the log. The ack was matching nothing. Both lock checks from the task print nothing on this branch: - the non-SHA key grep; - the non-SHA nested `uses:` grep. ## Changes | File | Change | |---|---| | `.hypatia-baseline.json` | One entry deleted, 12 lines. jq confirms the result equals the original with only that entry removed. No other entry changes. | | `scripts/tests/apply-baseline-test.sh` | The "SHIPPED ledger" section asserted that the real baseline holds **exactly one** such ack and suppresses both emission paths, so it would go red on this removal. It is inverted: it now asserts the ledger holds **no** `invalid_actions_lock` ack and that both emission paths **reach the gate** (`workflow_audit`/`actions.lock` and `workflow_hardening`/`.github/workflows/actions.lock`). The fixture-based tests for list-valued `rule_module` are unchanged. | `docs/HYPATIA-BASELINE-FORMAT.adoc`, the schema description and the comment in `apply-baseline.sh` still use `invalid_actions_lock` as their example of one defect emitted by two modules. That describes how the scanner behaves, not a live ack, so they are left as they are. ## Testing | Check | Result | |---|---| | `bash scripts/tests/exemption-ratchet-test.sh` | 14 passed, 0 failed | | `bash scripts/tests/apply-baseline-test.sh` | 32 passed, 0 failed | | `bash scripts/tests/hypatia-blocking-gate-test.sh` | exit 0 | | `scripts/check-exemption-ratchet.sh origin/main` | `SHRANK .hypatia-baseline.json: 189 -> 188`. OK, and no `Ratchet-exception:` was needed. | | `apply-baseline.sh` on `[]` in blocking mode | schema-valid, exit 0 | | `apply-baseline.sh` with both `invalid_actions_lock` emissions in blocking mode | kept=2, suppressed=0, **exit 1**. A recurrence now blocks. | | `.githooks/pre-commit` and `commit-msg` | passed. Included gitleaks 8.28.0, validate-actions-lock and validate-sha-pins, using checksum-verified gitleaks and mikefarah yq v4.47.1. | The Hypatia scanner itself was **not** run locally, because the container has no Elixir. This PR's own `scan / Hypatia Neurosymbolic Analysis` run is the live confirmation. Licence headers are untouched. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01TbbnKqskQA5mj5gfMniPzi Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
#1233 already did the first half of this job. In
.github/actions/signed-push/action.yml, the "Push local commits as Verified" step now runspush-verified.sh, a bash script beside the action. It usesghandjq, the App installation token fromsteps.app-token, andcreateCommitOnBranchwithexpectedHeadOid, so if the remote head moves the push fails closed. The inputs did not change:app-id,private-key,branch. The action has no outputs. It never had any.#1233 left the lock records in place on purpose. This PR removes them. Nothing references either one any more:
dependencies:asana/push-signed-commits@d615ca88…(refv1.3)uses:anywhere names it, and neither does anyworkflows:list.actions/setup-python@v2uses:. It was also the only key in the lock that is not a SHA.The diff deletes 12 lines and changes nothing else.
How the records were removed
The repo's lock tooling cannot do this:
prune-stale.shonly edits theworkflows:section.close-lock.shonly adds records.gh actions-lockregeneration is fenced off for this repo because of the composite action (Lock repair chain drops composite-action edges, and --verify-local accepts the result #1122).So I removed the two
dependencies:blocks with a gawk filter that only touches that section. Afterwardsprune-stale.shwas a no-op, andclose-lock.shfound 0 dangling refs and left the file alone.Testing
All lock gates were run before and after the deletion, with the pinned tool versions:
scripts/check-lock-sync.sh.githooks/validate-actions-lock.shscripts/check-actions-lock-gate.sh(gh-actions-lock v0.1.6, the version CI pins)scripts/prune-stale.shscripts/close-lock.shscripts/lock-selfcheck.sh HEADScript tests that touch this action or the lock all pass:
validate-sha-pins-testsigned-push-testcheck-actions-lock-gate-testvalidate-actions-lock-testcheck-lock-sync-testprune-stale-testclose-lock-testlock-selfcheck-testregen-dependabot-locks-testupdate-actions-lock-testkyaml-format-testThe full
run-shell-test-suite.shpassed 79 of 81 files. The other two fail the same way onmainin this container because tools are missing:check-ijson-jcs-testneeds theijson-jcsbinary.science-ci-security-testneedsssh-keygen.Neither test reads
actions.lock.The pre-commit hook passed in full (gitleaks included), and the commit-msg hook passed.
signed-push-smoke.ymlwas not run. It is dispatch-only and needsAPP_ID/APP_PRIVATE_KEY, whichconfig/README.adocsays this repo does not hold yet.Follow-up, not done here (outside this PR's scope)
.hypatia-baseline.jsonhas aninvalid_actions_lockacknowledgement (**actions.lock, tracking main is red: actions.lock omits a transitive dependency of asana/push-signed-commits (actions/setup-python@v2) #963, expires 2026-12-22) for exactly this defect. Its exit condition was "we replace the action", and that is now met. Removing the entry would shrink the ledger, which the ratchet allows. I left it because I could not run Hypatia here to confirm that nothing else in the lock triggers the rule.regen-dependabot-locks.sh(Lock repair chain drops composite-action edges, and --verify-local accepts the result #1122) is unchanged. The action's only third-party dependency is nowactions/create-github-app-token, and other workflows also use it directly. So a regeneration should no longer have to restore records by hand. Relaxing the guard still needs the live check feat(k9): vnd.k9.coordination subtype, coordination grammar v1.2.0, native signed-push #1233 described.🤖 Generated with Claude Code
https://claude.ai/code/session_014h2gFLLQibfB5N5hFz9ZCD
Generated by Claude Code