fix(ci): nothing merges and nothing scans — two org-move breakages - #801
Closed
catomean wants to merge 3 commits into
Closed
fix(ci): nothing merges and nothing scans — two org-move breakages#801catomean wants to merge 3 commits into
catomean wants to merge 3 commits into
Conversation
The repos moved to the `bitbaum` organisation, so `catomean/dotfiles` — itself the fix for the `maonakamoto` rename two days ago — became a redirect in turn. Every auto-merge run since has failed, so nothing merges and nothing deploys. Same invisible failure as before. GitHub redirects a renamed owner for the REST API and for git remotes, so `gh api repos/catomean/dotfiles` answers happily and `git push` works; the Actions resolver is the one consumer that does not follow the redirect. It dies before any step exists — "This run likely failed because of a workflow file issue", no readable log — while pull requests stay green, clean and mergeable. The red run is on main, under a workflow nobody opens. Twice is where the rule says stop fixing instances. check-workflow-refs asks the REST API what each referenced repo is really called and fails when that disagrees with what the workflow says. That disagreement IS the bug: REST resolves the redirect, Actions does not. A static allowlist cannot do this — after a rename the workflow and the allowlist would hold the same stale name and agree with each other. It runs in CI rather than in `npm run verify`, because verify is the offline SSOT bundle and this needs the API to answer; without a token it skips rather than passing quietly. Proven by mutation: restoring `catomean/dotfiles` fails the check with the canonical name to use. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012dpTLxh5GJWeWTF1UEvcD5
gitleaks-action is free for personal accounts only. The move to the bitbaum org made it refuse to run — "License key is required" — so the security job went red on every PR and blocked the whole merge queue, while scanning nothing. The gitleaks CLI is MIT and has no such restriction, so this runs the scanner directly and keeps the coverage the action gave. The script guards the trap that makes a security gate worthless: gitleaks exits 0 on an EMPTY commit range, so a force-push, a missing base ref or a shallow clone reports success having examined nothing — not "no secrets" but "no look", wearing a green tick. The range is computed first and an empty one fails hard. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012dpTLxh5GJWeWTF1UEvcD5
catomean
changed the title
They rode in on a branch switch and were swept up by `git add -A`. Unrelated to the CI fixes; they belong with the Cat handle work. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Collaborator
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The repos moved into the
bitbaumorganisation, and two separate things broke silently.1. Nothing merges.
catomean/dotfiles— itself the fix for themaonakamotorename two days ago — is now a redirect in turn, and every auto-merge run has failed since. REST and git follow a rename redirect; the Actions resolver does not. So PRs stay green, clean and mergeable while the red run sits on main under a workflow nobody opens. 13 PRs were queued behind it.2. Nothing scans.
gitleaks-actionis free for personal accounts only. In an org it refuses to run — "[bitbaum] is an organization. License key is required." — so the security job went red on every PR while scanning zero commits. A check that is both red and inert: it blocks the queue and protects nothing.Fixes
scripts/ci/check-workflow-refs.mjsasks the REST API what each referenced repo is really called and fails when that disagrees with the workflow. That disagreement is exactly the bug — REST resolves the redirect, Actions does not. A static allowlist could not catch it: after a rename the workflow and the allowlist would hold the same stale name and agree with each other.scripts/ci/secret-scan.shruns the MIT-licensed gitleaks CLI directly, keeping the coverage the action gave. It also guards the trap that makes a security gate worthless: gitleaks exits 0 on an empty commit range, so a force-push or a shallow clone reports success having examined nothing — not "no secrets" but "no look", wearing a green tick. The range is computed first and an empty one fails hard.Proven by mutation
catomean/dotfilesbitbaum/dotfilesas the fixThe planted credential is deliberately not one of the vendor
EXAMPLEstrings gitleaks allowlists — that is how a mutation stays green and proves nothing.🤖 Generated with Claude Code
https://claude.ai/code/session_012dpTLxh5GJWeWTF1UEvcD5