Repository navigation
CI hygiene: allow-fail expiry, dead playground workflows, ruleset snapshot (ultraplan Phase 0/2) - #417
Merged
Conversation
Read-only recon of the repository, CI, public deployment, issues, and estate decisions, written up as a proposal for owner ratification: - truth ledger: claims in README/CLAUDE.md that the code does not back (integrity fail-open, unwired certificates, unread --sandbox, SPARK gate with enforcement off, unauthenticated public execution endpoint) - CI/CD measurements from 400 runs, lane-based target design, and a disposition for each of the 35 workflow files - community health and the issue backlog, with dispositions - phased plan (containment, one verdict, one pipeline, CI, data, status, proof assurance, wire, research) with exit criteria - ruling packet D-A to D-N, each with the (E) arm recommended No code, workflow, ruleset, or secret was changed. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
…t snapshot Ultraplan Phase 0.6 and Phase 2.3, tracking issue #416. - Every continue-on-error unit (14) carries '# allow-fail: issue=#416 expires=2026-11-30'. scripts/ci/check-allow-fail-expiry.py runs in the workflow linter and fails on a missing marker, a bad date, or an expired one. - Nine workflow files under echidna-playground/.github/workflows/ never ran (GitHub reads only the root). Moved, unchanged, to echidna-playground/ci-templates/. - .github/rulesets/live/ snapshots the five enforced rulesets (volatile fields stripped). scripts/ci/check-ruleset-drift.py compares live state with it. It needs admin read and is not yet in CI (owner action: read-only secret). No behaviour change to any job: the annotations are comments, and the playground files were not reachable from any trigger. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 6 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configuration
📒 Files selected for processing (25)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -0,0 +1,73 @@ | |||
| #!/usr/bin/env python3 | |||
| @@ -0,0 +1,88 @@ | |||
| #!/usr/bin/env python3 | |||
hyperpolymath
marked this pull request as ready for review
October 9, 2026 19:10
hyperpolymath
added a commit
that referenced
this pull request
Oct 9, 2026
…n since #412) (#419) Fixes the lockfile step that has been red on `main` since #412. PR #412 (dependabot, actions group) moved `mvp-smoke.yml` and `s4-loop.yml` from `taiki-e/install-action@v2.87.22` to `v2.87.26`, but did not update `actions.lock`. The `Verify immutable action lockfile` step then fails, which makes `lint-workflows` / Workflow Security Linter red on `main`. The change is one lock entry: `v2.87.26` at the upstream tag commit `f7e5d7c`, with the same `owner_id` and `repo_id`. No workflow references `v2.87.22` any more, so that entry is replaced. Verified: - No workflow file references an unlocked action ref (checked by parsing every `uses:`). - The authoritative `gh-actions-lock --rescan --no-fix` could not be run from the agent sandbox (its release download is outside the allow-list). CI is the verifier here. Note: this PR was prepared after #417 had already merged, so it is based on current `main`. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
hyperpolymath
added a commit
that referenced
this pull request
Oct 9, 2026
… check) (#423) Removes Python from the CI checkers. The estate language policy bans Python, and #417 added two Python checkers. They are the only `.py` files in the repository, so the governance "banned-language files" check fails on them. `main` also went red on the Static Analysis Gate after #417 (it passed at `645d7a2`). These files are the first suspect for that. The Hypatia job log is not readable from the sandbox, so this is not confirmed. Please check the gate on `main` after this lands. ## What changed - `scripts/ci/check-allow-fail-expiry.sh` replaces the Python version. It is bash with GNU `date`, and it keeps the same output and exit codes. - `scripts/ci/check-ruleset-drift.sh` replaces the Python version. It is bash with `gh` and `jq`, and it keeps the same canonicalisation and exit codes. - The linter step calls the script through `bash`. The rulesets README and the ultraplan are updated to match. ## How it was checked - Allow-fail: output and exit codes match the Python version at 2026-10-09 (14 units, exit 0) and 2026-12-01 (exit 1). Missing-marker, invalid-date and warning-window fixtures also match. - Drift: zero drift against the five live rulesets. A tampered snapshot gives the same two findings as the Python version. `--write` reproduces the committed snapshots after canonicalisation. - The Python-free tree has no `.py` files (`git ls-files '*.py'` is empty). --------- Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of the ultraplan (
docs/planning/ULTRAPLAN-2026-10-09.adoc), ratified by the owner. Scope chosen: CI hygiene first.What changes
continue-on-errorunits carry# allow-fail: issue=#416 expires=2026-11-30.scripts/ci/check-allow-fail-expiry.pyruns in the workflow linter and fails on a missing marker, a bad date, or an expired one. It does not change what any job does.echidna-playground/.github/workflows/never ran, because GitHub reads only the root. Moved unchanged toechidna-playground/ci-templates/, with a README..github/rulesets/live/holds the five enforced rulesets.scripts/ci/check-ruleset-drift.pycompares live state with them. It needs admin read, so it is not in CI yet.Verified locally
test-issue-regressions.shpasses.Not in this PR (owner actions)
VERISIMDB_PAT(Security Scan red: VERISIMDB_PAT is a dead token (401 Bad credentials) — rotate or delete #310).