Foundational CI/CD: supersede #1338, wire squabbler/proven/deep-recon, KYAML+I-JSON gates

.github/code-scanning-dismissals.json

@@ -20,15 +20,15 @@
     {
       "alert_number": null,
       "comment": "security-events: write is the ONLY permission that can upload SARIF to code scanning; it cannot be expressed as read. The reusable this job calls declares the same permission, and GitHub rejects a run at startup when the caller grants less than the callee requests (startup_failure, zero jobs) - so downgrading this to read does not reduce privilege, it silently disables code scanning. See standards#451 and the in-file comment.",
-      "line": 25,
+      "line": 26,
       "path": ".github/workflows/hypatia-scan.yml",
       "reason": "won't fix",
       "rule_id": "TokenPermissionsID"
     },
     {
       "alert_number": null,
       "comment": "Same structural requirement as the caller above: the scan job uploads its own SARIF, so security-events: write is the minimum this reusable can declare. Workflow-level actions/contents stay read.",
-      "line": 44,
+      "line": 62,
       "path": ".github/workflows/hypatia-scan-reusable.yml",
       "reason": "won't fix",
       "rule_id": "TokenPermissionsID"
@@ -80,6 +80,22 @@
       "path": ".github/workflows/fork-governance.yml",
       "reason": "won't fix",
       "rule_id": "TokenPermissionsID"
+    },
+    {
+      "alert_number": null,
+      "comment": "Same structural SARIF requirement as hypatia-scan.yml: this caller job grants security-events: write only so the pons job in deep-recon-reusable.yml can upload its SARIF to code scanning. A caller cannot grant less than the callee declares without startup_failure and zero jobs; workflow level remains contents: read and the panic-attack job declares contents: read only.",
+      "line": 36,
+      "path": ".github/workflows/deep-recon.yml",
+      "reason": "won't fix",
+      "rule_id": "TokenPermissionsID"
+    },
+    {
+      "alert_number": null,
+      "comment": "The pons job is the one job in this reusable that uploads SARIF, using github/codeql-action/upload-sarif, and security-events: write is the only permission spelling that can perform that upload. It is job-scoped: the reusable workflow level and the panic-attack job remain contents: read, and the scan itself still fails closed on error-severity findings or an incomplete scan.",
+      "line": 70,
+      "path": ".github/workflows/deep-recon-reusable.yml",
+      "reason": "won't fix",
+      "rule_id": "TokenPermissionsID"
     }
   ]
 }

.github/workflows/actions.lock

@@ -37,6 +37,15 @@ workflows:
         - 'haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d'
         - 'hyperpolymath/standards@d55304a01b5260b0511aae0d14ed8b8770b00293'
         - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
+    '.github/workflows/cicd-squabbler-reusable.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'hyperpolymath/cicd-squabbler@14f853fde902ab2d7631070d87a9dc9122e01013'
+        - 'step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25'
+    '.github/workflows/cicd-squabbler.yml': []
+    '.github/workflows/code-coverage.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'actions/upload-code-coverage@2b21a77928be8d5168c2b9581a67f2adbebacc52'
+        - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8'
     '.github/workflows/codeql-reusable.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63'
@@ -46,6 +55,11 @@ workflows:
     '.github/workflows/deed-conformance.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
+    '.github/workflows/deep-recon-reusable.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63'
+    '.github/workflows/deep-recon.yml': []
     '.github/workflows/dependabot-lock-regen.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510'
@@ -235,6 +249,11 @@ dependencies:
         repo_id: 496012378
         uses:
             - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+    'actions/upload-code-coverage@2b21a77928be8d5168c2b9581a67f2adbebacc52':
+        ref: 'v1.4.4'
+        commit: 'sha1-2b21a77928be8d5168c2b9581a67f2adbebacc52'
+        owner_id: 44036562
+        repo_id: 1220171870
     'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
         ref: 'v2.0.5'
         commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
@@ -270,6 +289,11 @@ dependencies:
         commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d'
         owner_id: 75048950
         repo_id: 623796603
+    'hyperpolymath/cicd-squabbler@14f853fde902ab2d7631070d87a9dc9122e01013':
+        ref: 'main'
+        commit: 'sha1-14f853fde902ab2d7631070d87a9dc9122e01013'
+        owner_id: 6759885
+        repo_id: 1284026967
     'hyperpolymath/standards@70019048f862250c04346f27e6ca196ff7aa187a':
         ref: '70019048f862250c04346f27e6ca196ff7aa187a'
         commit: 'sha1-70019048f862250c04346f27e6ca196ff7aa187a'

.github/workflows/allowlist-preflight-reusable.yml

@@ -39,7 +39,7 @@ jobs:
 
       - name: Stage policy tools outside the scanned tree
         run: |
-          if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
+          if [ "${GITHUB_REPOSITORY_ID:-}" = "1116521501" ] || [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ] || [ "$GITHUB_REPOSITORY" = metadatastician/standards ]; then
             cp scripts/check-actions-policy.sh scripts/check-allowed-actions.sh "$RUNNER_TEMP/"
             cp rhodium-standard-repositories/actions-allowlist/allowed-actions.json \
                "$RUNNER_TEMP/allowed-actions.json"