fix(ci): revive the startup-dead governance gates (0 jobs -> running) - #55
Merged
Merged
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (4)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (1)
|
| Layer / File(s) | Summary |
|---|---|
Update reusable workflow references and permissions .github/workflows/*.yml |
Hypatia, mirror, Scorecards, and secret-scanner use the newer pinned commit. Required actions: read permissions are added. Scorecards gains manual triggering. |
Priority: ➖ Normal
Estimated code review effort: 1 (Trivial) | ~5 minutes
Merge Risk: ⚪ Minimal · up to 71dc9
This restores the affected governance workflows with read-only access and pinned reusable-workflow revisions. The restored gates are ready to merge without an identified production or security risk.
Suggested reviewers: metadatastician
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The title clearly summarises the main change: restoring governance gates that failed before creating jobs. It is concise and directly related to the workflow fixes. |
| Description check | ✅ Passed | The description accurately explains the startup failures, permission and pin changes, workflow dispatch addition, governance pin decision, and verification results. It is directly related to the chang… |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches
🛠️ Fix failing CI checks
- Create stacked PR
- Commit on current branch
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit checks the workflows bright
Pins the scans to commits tight
Read permissions hop in line
Scorecards wait for manual time
Safe little updates, neat and fine
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
…ns:read scorecard, mirror and secret-scanner were dying at startup on this repo: each reported 0 jobs and 0 check runs, so main looked green because the gates were ABSENT, not passing. Two causes, both fixed here: 1. Callers sat on the older standards pin 7fdc2705, whose reusables request `actions: read`, which the callers did not grant. 2. A job-level `permissions:` block REPLACES the workflow-level map rather than merging with it, so a job with its own block ran without `contents: read` or `actions: read` no matter what the top of the file granted. All four affected callers are repointed to standards main HEAD 257869d3 and now grant `actions: read` + `contents: read` at BOTH workflow and job level. governance.yml is deliberately left on fad242d3: standards main HEAD is currently unparseable by callers because its actions.lock is out of sync with governance-reusable.yml after Dependabot #746 (HTTP 422, run dies at startup). hyperpolymath/standards#754 resyncs it; governance moves to HEAD once that lands. Verified on the sibling canary (bofig): mirror went 0 jobs -> 7 jobs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QMTyDv9CoJo5PfeNzyp519
hyperpolymath
force-pushed
the
fix/restore-reachable-standards-pin
branch
from
September 8, 2026 18:20
f19e22e to
4414048
Compare
…emand scorecard.yml triggered only on branch_protection_rule and schedule, so there was no way to prove the startup-failure repair works before merging it. The canonical template caller (proof-burrower, the verified-working control) carries workflow_dispatch; this matches it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QMTyDv9CoJo5PfeNzyp519
|
hyperpolymath
changed the title
Contributor
|
✅ CI fix PR created: Follow
3 PR-caused check(s)
⏭️ 1 check(s) skipped — already failing on `main` (not caused by this PR)
1 file(s) modified
View agent analysis |
hyperpolymath
pushed a commit
that referenced
this pull request
Sep 8, 2026
CI failure fixes was requested by @hyperpolymath. * #55 (comment) The following files were modified: * `Containerfile.alpine-fallback` Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was actually wrong
Three of this repo's five governance-suite gates were dying at startup:
scorecard,mirrorandsecret-scannereach reported 0 jobs and 0 check runs. A gate that never starts is absent, not red — somainlooked green while nothing ran.gh run viewon those runs says only: "This run likely failed because of a workflow file issue."Two causes
actions: read— a permission the callers never granted. The reusable call fails validation and the run dies before any job is created.permissions:block REPLACES the workflow-level map rather than merging with it. So a job carrying its own block ran with neithercontents: readnoractions: read, regardless of what the top of the file granted. This is why "just addactions: readat the top" is a no-op on these callers — the gate stays absent while looking patched.What this PR does
257869d3.actions: read+contents: readat both workflow and job level.workflow_dispatchtoscorecard.ymlso the gate is verifiable on demand (matchingproof-burrower, the verified-working control caller).governance.ymlatfad242d3. standards main HEAD is currently unparseable by callers: itsactions.lockfell out of sync withgovernance-reusable.ymlafter Dependabot #746, so pinning HEAD returnsHTTP 422 … references actions not present in the lockfileand the run dies at startup. fix(ci): resync actions.lock with the workflow refs Dependabot bumped (#746) standards#754 resyncs it; governance moves to HEAD once that lands.Verification — dispatched on this branch, job counts measured
Job counts come from
actions/runs/<id>/jobs .total_count— a failing-checks list cannot distinguish "gate passed" from "gate never ran", so the positive control is the count itself.Newly-visible failures (e.g. mirror's bitbucket/sourcehut targets) are real findings the absent gate was concealing, not regressions introduced here.
🤖 Generated with Claude Code
https://claude.ai/code/session_01QMTyDv9CoJo5PfeNzyp519