ci: remove Semgrep App token dependency by hyperpolymath · Pull Request #111 · hyperpolymath/januskey

hyperpolymath · 2026-08-31T10:10:23Z

Summary

remove the obsolete SEMGREP_APP_TOKEN dependency
retain tokenless standalone Semgrep scanning
retain SARIF upload to GitHub code scanning

Validation

actionlint .github/workflows/semgrep.yml
git diff --check
no TypeScript or TSX files added

coderabbitai · 2026-08-31T10:11:33Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: aa65b6a9-c628-4ca4-8170-d57693a097fa

📥 Commits

Reviewing files that changed from the base of the PR and between 71295e7 and 0c8371b.

📒 Files selected for processing (1)

.github/workflows/semgrep.yml

💤 Files with no reviewable changes (1)

.github/workflows/semgrep.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⚠️ CI failures not shown inline (30)

GitHub Actions: Dashboard Check / 0_STATE vs dashboard reconciliation.txt: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run if [[ -z $toolchain ]]; then
 �[36;1mif [[ -z $toolchain ]]; then�[0m
 �[36;1m  # GitHub does not enforce `required: true` inputs itself. https://github.com/actions/runner/issues/1070�[0m
 �[36;1m  echo "'toolchain' is a required input" >&2�[0m
 �[36;1m  exit 1�[0m
 �[36;1melif [[ $toolchain =~ ^stable' '[0-9]+' '(year|month|week|day)s?' 'ago$ ]]; then�[0m
 �[36;1m  if [[ Linux == macOS ]]; then�[0m
 �[36;1m    echo "toolchain=1.$((($(date -v-$(sed 's/stable \([0-9]*\) \(.\).*/\1\2/' <<< $toolchain) +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  else�[0m
 �[36;1m    echo "toolchain=1.$((($(date --date "${toolchain#stable }" +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  fi�[0m
 �[36;1melif [[ $toolchain =~ ^stable' 'minus' '[0-9]+' 'releases?$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((($(date +%s)/60/60/24-16569)/7/6-${toolchain//[^0-9]/}))" >> $GITHUB_OUTPUT�[0m
 �[36;1melif [[ $toolchain =~ ^1\.[0-9]+$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((i=${toolchain#1.}, c=($(date +%s)/60/60/24-16569)/7/6, i+9*i*(10*i<=c)+90*i*(100*i<=c)))" >> $GITHUB_OUTPUT�[0m
 �[36;1melse�[0m
 �[36;1m  echo "toolchain=$toolchain" >> $GITHUB_OUTPUT�[0m
 �[36;1mfi�[0m
 shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
 env:
   toolchain:
 ##[endgroup]
 'toolchain' is a required input
 ##[error]Process completed with exit code 1.

GitHub Actions: Dashboard Check / STATE vs dashboard reconciliation: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run if [[ -z $toolchain ]]; then
 �[36;1mif [[ -z $toolchain ]]; then�[0m
 �[36;1m  # GitHub does not enforce `required: true` inputs itself. https://github.com/actions/runner/issues/1070�[0m
 �[36;1m  echo "'toolchain' is a required input" >&2�[0m
 �[36;1m  exit 1�[0m
 �[36;1melif [[ $toolchain =~ ^stable' '[0-9]+' '(year|month|week|day)s?' 'ago$ ]]; then�[0m
 �[36;1m  if [[ Linux == macOS ]]; then�[0m
 �[36;1m    echo "toolchain=1.$((($(date -v-$(sed 's/stable \([0-9]*\) \(.\).*/\1\2/' <<< $toolchain) +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  else�[0m
 �[36;1m    echo "toolchain=1.$((($(date --date "${toolchain#stable }" +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  fi�[0m
 �[36;1melif [[ $toolchain =~ ^stable' 'minus' '[0-9]+' 'releases?$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((($(date +%s)/60/60/24-16569)/7/6-${toolchain//[^0-9]/}))" >> $GITHUB_OUTPUT�[0m
 �[36;1melif [[ $toolchain =~ ^1\.[0-9]+$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((i=${toolchain#1.}, c=($(date +%s)/60/60/24-16569)/7/6, i+9*i*(10*i<=c)+90*i*(100*i<=c)))" >> $GITHUB_OUTPUT�[0m
 �[36;1melse�[0m
 �[36;1m  echo "toolchain=$toolchain" >> $GITHUB_OUTPUT�[0m
 �[36;1mfi�[0m
 shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
 env:
   toolchain:
 ##[endgroup]
 'toolchain' is a required input
 ##[error]Process completed with exit code 1.

GitHub Actions: Secret Scanner / 0_scan _ shell-secrets.txt: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

GitHub Actions: Secret Scanner / scan _ shell-secrets: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

GitHub Actions: Dogfood Gate / 3_Validate A2ML manifests.txt: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]A2ML Manifest Validation
 Scanning . for .a2ml files...
 Found 29 .a2ml file(s)
   Validating: ./.machine_readable/6a2/0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/6a2/AGENTIC.a2ml
   Validating: ./.machine_readable/6a2/ECOSYSTEM.a2ml
   Validating: ./.machine_readable/6a2/META.a2ml
   Validating: ./.machine_readable/6a2/NEUROSYM.a2ml
   Validating: ./.machine_readable/6a2/PLAYBOOK.a2ml
   Validating: ./.machine_readable/6a2/STATE.a2ml
   Validating: ./.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/6a2/anchor/ANCHOR.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/CLADE.a2ml
   Validating: ./.machine_readable/bot_directives/coverage.a2ml
   Validating: ./.machine_readable/bot_directives/debt.a2ml
   Validating: ./.machine_readable/bot_directives/git-private-farm.a2ml
   Validating: ./.machine_readable/bot_directives/gitbot-fleet.a2ml
   Validating: ./.machine_readable/bot_directives/hypatia.a2ml
   Validating: ./.machine_readable/bot_directives/methodology.a2ml
   Validating: ./.machine_readable/contractiles/Adjustfile.a2ml
   Validating: ./.machine_readable/contractiles/Bustfile.a2ml
   Validating: ./.machine_readable/contractiles/Dustfile.a2ml
   Validating: ./.machine_readable/contractiles/Intentfile.a2ml
   Validating: ./.machine_readable/contractiles/Mustfile.a2ml
   Validating: ./.machine_readable/contractiles/Trustfile.a2ml
   Validating: ./.machine_readable/integrations/feedback-o-tron.a2ml
   Validating: ./.machine_readable/integrations/proven.a2ml
   Validating: ./.machine_readable/integrations/verisimdb.a2ml
   Validating: ./.machine_readable/integrations/vexometer.a2ml
   Validating: ./.machine_readable/threat-model.a2ml
   Validating: ./0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
 ##[war...

GitHub Actions: E2E + Aspect + Bench + Security / 0_Aspect Tests (Cross-Cutting).txt: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run bash tests/aspect/cross_cutting_test.sh
 �[36;1mbash tests/aspect/cross_cutting_test.sh�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 === JanusKey Aspect Tests ===
 --- SPDX License Headers ---
 [PASS] Rust SPDX headers (22/22)
 [PASS] Idris2 SPDX headers (4/4)
 [PASS] Zig SPDX headers (3/3)
 --- Forbidden Patterns ---
 [PASS] No believe_me in proofs
 [PASS] No assert_total in proofs
 [PASS] No postulate in proofs
 [PASS] No sorry in proofs
 [PASS] No unsafe in reversible-core
 --- Documentation ---
 [PASS] README exists
 [FAIL] SECURITY.md exists
 [FAIL] ARCHITECTURE.md exists
 [FAIL] PROOF-NEEDS.md exists
 [FAIL] TOPOLOGY.md exists
 [PASS] LICENSE directory exists
 --- Formal Proofs ---
 [PASS] Types.idr exists (L1-L12)
 [PASS] Layout.idr exists (CNO)
 [PASS] Foreign.idr exists (FFI)
 [PASS] Proofs.idr exists (30+ proofs)
 [PASS] C header generated
 --- Build ---
 [PASS] Cargo.toml exists
 [PASS] Zig build.zig exists
 [PASS] Justfile exists
 --- Test Infrastructure ---
 [PASS] E2E tests exist
 [PASS] P2P tests exist
 [PASS] Aspect tests exist
 [PASS] Benchmarks exist
 --- CI Workflows ---
 [PASS] CI workflows present (21)
 [PASS] hypatia-scan.yml exists
 [PASS] E2E workflow exists
 ===============================
   PASS: 25  FAIL: 4
 ===============================
 ##[error]Process completed with exit code 1.

GitHub Actions: Secret Scanner / 1_scan _ gitleaks.txt: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1mMIRROR="$RUNNER_TEMP/adoc-mirror"�[0m
 �[36;1mREPORT="$RUNNER_TEMP/adoc-report.json"�[0m
 �[36;1mrm -rf "$MIRROR"; mkdir -p "$MIRROR"�[0m
 �[36;1m�[0m
 �[36;1m# -print0/read -d '' so paths with spaces or newlines survive; the�[0m
 �[36;1m# estate has directories with spaces in them.�[0m
 �[36;1mfound=0�[0m
 �[36;1mwhile IFS= read -r -d '' f; do�[0m
 �[36;1m  dest="$MIRROR/$(dirname "$f")"�[0m
 �[36;1m  mkdir -p "$dest"�[0m
 �[36;1m  cp "$f" "$dest/$(basename "$f").txt"�[0m
 �[36;1m  found=$((found + 1))�[0m
 �[36;1mdone < <(find . -path ./.git -prune -o \�[0m
 �[36;1m              \( -name '*.adoc' -o -name '*.asciidoc' \) -type f -print0)�[0m
 �[36;1m�[0m
 �[36;1mif [ "$found" -eq 0 ]; then�[0m
 �[36;1m  echo "No AsciiDoc files present — nothing to scan."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mecho "Scanning $found AsciiDoc file(s) via mirror."�[0m
 �[36;1m�[0m
 �[36;1m# Honour the caller's own baseline when it has one, so repo-specific�[0m
 �[36;1m# allowlists still apply to docs exactly as they do to code — and�[0m
 �[36;1m# otherwise fall back to the estate baseline, so docs and code are�[0m
 �[36;1m# judged by the SAME rules. Previously this step honoured a repo�[0m
 �[36;1m# config while the code scan above honoured none, which meant an�[0m
 �[36;1m# allowlist entry could suppress a finding in a `.adoc` file and not�[0m
 �[36;1m# in the `.md` file beside it.�[0m
 �[36;1m#�[0m
 �[36;1m# Absolute paths: this scan's --source is the MIRROR directory, so a�[0m
 �[36;1m# relative config path would resolve against the mirror rather than�[0m
 �[36;1m# the repository. `[extend] path = ".gitleaks-estate.toml"` inside a�[0m
 �[36;1m# repo config resolves against the process CWD (still the repo root),�[0m
 �[36;1m# which is why the estate baseline is staged there.�[0m
 �[36;1mconfig_args=(--config "$PWD/.gitleaks-estate.toml")�[0m
 �[36;1mif [ -f .gitleaks.toml ]; then�[0m
 �[36;...

GitHub Actions: Dogfood Gate / Validate A2ML manifests: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]A2ML Manifest Validation
 Scanning . for .a2ml files...
 Found 29 .a2ml file(s)
   Validating: ./.machine_readable/6a2/0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/6a2/AGENTIC.a2ml
   Validating: ./.machine_readable/6a2/ECOSYSTEM.a2ml
   Validating: ./.machine_readable/6a2/META.a2ml
   Validating: ./.machine_readable/6a2/NEUROSYM.a2ml
   Validating: ./.machine_readable/6a2/PLAYBOOK.a2ml
   Validating: ./.machine_readable/6a2/STATE.a2ml
   Validating: ./.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/6a2/anchor/ANCHOR.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/CLADE.a2ml
   Validating: ./.machine_readable/bot_directives/coverage.a2ml
   Validating: ./.machine_readable/bot_directives/debt.a2ml
   Validating: ./.machine_readable/bot_directives/git-private-farm.a2ml
   Validating: ./.machine_readable/bot_directives/gitbot-fleet.a2ml
   Validating: ./.machine_readable/bot_directives/hypatia.a2ml
   Validating: ./.machine_readable/bot_directives/methodology.a2ml
   Validating: ./.machine_readable/contractiles/Adjustfile.a2ml
   Validating: ./.machine_readable/contractiles/Bustfile.a2ml
   Validating: ./.machine_readable/contractiles/Dustfile.a2ml
   Validating: ./.machine_readable/contractiles/Intentfile.a2ml
   Validating: ./.machine_readable/contractiles/Mustfile.a2ml
   Validating: ./.machine_readable/contractiles/Trustfile.a2ml
   Validating: ./.machine_readable/integrations/feedback-o-tron.a2ml
   Validating: ./.machine_readable/integrations/proven.a2ml
   Validating: ./.machine_readable/integrations/verisimdb.a2ml
   Validating: ./.machine_readable/integrations/vexometer.a2ml
   Validating: ./.machine_readable/threat-model.a2ml
   Validating: ./0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
 ##[war...

GitHub Actions: E2E + Aspect + Bench + Security / Aspect Tests (Cross-Cutting): ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run bash tests/aspect/cross_cutting_test.sh
 �[36;1mbash tests/aspect/cross_cutting_test.sh�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 === JanusKey Aspect Tests ===
 --- SPDX License Headers ---
 [PASS] Rust SPDX headers (22/22)
 [PASS] Idris2 SPDX headers (4/4)
 [PASS] Zig SPDX headers (3/3)
 --- Forbidden Patterns ---
 [PASS] No believe_me in proofs
 [PASS] No assert_total in proofs
 [PASS] No postulate in proofs
 [PASS] No sorry in proofs
 [PASS] No unsafe in reversible-core
 --- Documentation ---
 [PASS] README exists
 [FAIL] SECURITY.md exists
 [FAIL] ARCHITECTURE.md exists
 [FAIL] PROOF-NEEDS.md exists
 [FAIL] TOPOLOGY.md exists
 [PASS] LICENSE directory exists
 --- Formal Proofs ---
 [PASS] Types.idr exists (L1-L12)
 [PASS] Layout.idr exists (CNO)
 [PASS] Foreign.idr exists (FFI)
 [PASS] Proofs.idr exists (30+ proofs)
 [PASS] C header generated
 --- Build ---
 [PASS] Cargo.toml exists
 [PASS] Zig build.zig exists
 [PASS] Justfile exists
 --- Test Infrastructure ---
 [PASS] E2E tests exist
 [PASS] P2P tests exist
 [PASS] Aspect tests exist
 [PASS] Benchmarks exist
 --- CI Workflows ---
 [PASS] CI workflows present (21)
 [PASS] hypatia-scan.yml exists
 [PASS] E2E workflow exists
 ===============================
   PASS: 25  FAIL: 4
 ===============================
 ##[error]Process completed with exit code 1.

GitHub Actions: Secret Scanner / scan _ gitleaks: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1mMIRROR="$RUNNER_TEMP/adoc-mirror"�[0m
 �[36;1mREPORT="$RUNNER_TEMP/adoc-report.json"�[0m
 �[36;1mrm -rf "$MIRROR"; mkdir -p "$MIRROR"�[0m
 �[36;1m�[0m
 �[36;1m# -print0/read -d '' so paths with spaces or newlines survive; the�[0m
 �[36;1m# estate has directories with spaces in them.�[0m
 �[36;1mfound=0�[0m
 �[36;1mwhile IFS= read -r -d '' f; do�[0m
 �[36;1m  dest="$MIRROR/$(dirname "$f")"�[0m
 �[36;1m  mkdir -p "$dest"�[0m
 �[36;1m  cp "$f" "$dest/$(basename "$f").txt"�[0m
 �[36;1m  found=$((found + 1))�[0m
 �[36;1mdone < <(find . -path ./.git -prune -o \�[0m
 �[36;1m              \( -name '*.adoc' -o -name '*.asciidoc' \) -type f -print0)�[0m
 �[36;1m�[0m
 �[36;1mif [ "$found" -eq 0 ]; then�[0m
 �[36;1m  echo "No AsciiDoc files present — nothing to scan."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mecho "Scanning $found AsciiDoc file(s) via mirror."�[0m
 �[36;1m�[0m
 �[36;1m# Honour the caller's own baseline when it has one, so repo-specific�[0m
 �[36;1m# allowlists still apply to docs exactly as they do to code — and�[0m
 �[36;1m# otherwise fall back to the estate baseline, so docs and code are�[0m
 �[36;1m# judged by the SAME rules. Previously this step honoured a repo�[0m
 �[36;1m# config while the code scan above honoured none, which meant an�[0m
 �[36;1m# allowlist entry could suppress a finding in a `.adoc` file and not�[0m
 �[36;1m# in the `.md` file beside it.�[0m
 �[36;1m#�[0m
 �[36;1m# Absolute paths: this scan's --source is the MIRROR directory, so a�[0m
 �[36;1m# relative config path would resolve against the mirror rather than�[0m
 �[36;1m# the repository. `[extend] path = ".gitleaks-estate.toml"` inside a�[0m
 �[36;1m# repo config resolves against the process CWD (still the repo root),�[0m
 �[36;1m# which is why the estate baseline is staged there.�[0m
 �[36;1mconfig_args=(--config "$PWD/.gitleaks-estate.toml")�[0m
 �[36;1mif [ -f .gitleaks.toml ]; then�[0m
 �[36;...

GitHub Actions: Dogfood Gate / 4_Groove manifest check.txt: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: E2E + Aspect + Bench + Security / 2_Rust Build + Unit Tests.txt: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run if [[ -z $toolchain ]]; then
 �[36;1mif [[ -z $toolchain ]]; then�[0m
 �[36;1m  # GitHub does not enforce `required: true` inputs itself. https://github.com/actions/runner/issues/1070�[0m
 �[36;1m  echo "'toolchain' is a required input" >&2�[0m
 �[36;1m  exit 1�[0m
 �[36;1melif [[ $toolchain =~ ^stable' '[0-9]+' '(year|month|week|day)s?' 'ago$ ]]; then�[0m
 �[36;1m  if [[ Linux == macOS ]]; then�[0m
 �[36;1m    echo "toolchain=1.$((($(date -v-$(sed 's/stable \([0-9]*\) \(.\).*/\1\2/' <<< $toolchain) +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  else�[0m
 �[36;1m    echo "toolchain=1.$((($(date --date "${toolchain#stable }" +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  fi�[0m
 �[36;1melif [[ $toolchain =~ ^stable' 'minus' '[0-9]+' 'releases?$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((($(date +%s)/60/60/24-16569)/7/6-${toolchain//[^0-9]/}))" >> $GITHUB_OUTPUT�[0m
 �[36;1melif [[ $toolchain =~ ^1\.[0-9]+$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((i=${toolchain#1.}, c=($(date +%s)/60/60/24-16569)/7/6, i+9*i*(10*i<=c)+90*i*(100*i<=c)))" >> $GITHUB_OUTPUT�[0m
 �[36;1melse�[0m
 �[36;1m  echo "toolchain=$toolchain" >> $GITHUB_OUTPUT�[0m
 �[36;1mfi�[0m
 shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
 env:
   toolchain:
 ##[endgroup]
 'toolchain' is a required input
 ##[error]Process completed with exit code 1.

GitHub Actions: Secret Scanner / 2_scan _ rust-secrets.txt: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

GitHub Actions: E2E + Aspect + Bench + Security / Rust Build + Unit Tests: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run if [[ -z $toolchain ]]; then
 �[36;1mif [[ -z $toolchain ]]; then�[0m
 �[36;1m  # GitHub does not enforce `required: true` inputs itself. https://github.com/actions/runner/issues/1070�[0m
 �[36;1m  echo "'toolchain' is a required input" >&2�[0m
 �[36;1m  exit 1�[0m
 �[36;1melif [[ $toolchain =~ ^stable' '[0-9]+' '(year|month|week|day)s?' 'ago$ ]]; then�[0m
 �[36;1m  if [[ Linux == macOS ]]; then�[0m
 �[36;1m    echo "toolchain=1.$((($(date -v-$(sed 's/stable \([0-9]*\) \(.\).*/\1\2/' <<< $toolchain) +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  else�[0m
 �[36;1m    echo "toolchain=1.$((($(date --date "${toolchain#stable }" +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  fi�[0m
 �[36;1melif [[ $toolchain =~ ^stable' 'minus' '[0-9]+' 'releases?$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((($(date +%s)/60/60/24-16569)/7/6-${toolchain//[^0-9]/}))" >> $GITHUB_OUTPUT�[0m
 �[36;1melif [[ $toolchain =~ ^1\.[0-9]+$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((i=${toolchain#1.}, c=($(date +%s)/60/60/24-16569)/7/6, i+9*i*(10*i<=c)+90*i*(100*i<=c)))" >> $GITHUB_OUTPUT�[0m
 �[36;1melse�[0m
 �[36;1m  echo "toolchain=$toolchain" >> $GITHUB_OUTPUT�[0m
 �[36;1mfi�[0m
 shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
 env:
   toolchain:
 ##[endgroup]
 'toolchain' is a required input
 ##[error]Process completed with exit code 1.

GitHub Actions: Dogfood Gate / Groove manifest check: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Secret Scanner / scan _ rust-secrets: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

GitHub Actions: E2E + Aspect + Bench + Security / 3_Criterion Benchmarks.txt: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run if [[ -z $toolchain ]]; then
 �[36;1mif [[ -z $toolchain ]]; then�[0m
 �[36;1m  # GitHub does not enforce `required: true` inputs itself. https://github.com/actions/runner/issues/1070�[0m
 �[36;1m  echo "'toolchain' is a required input" >&2�[0m
 �[36;1m  exit 1�[0m
 �[36;1melif [[ $toolchain =~ ^stable' '[0-9]+' '(year|month|week|day)s?' 'ago$ ]]; then�[0m
 �[36;1m  if [[ Linux == macOS ]]; then�[0m
 �[36;1m    echo "toolchain=1.$((($(date -v-$(sed 's/stable \([0-9]*\) \(.\).*/\1\2/' <<< $toolchain) +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  else�[0m
 �[36;1m    echo "toolchain=1.$((($(date --date "${toolchain#stable }" +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  fi�[0m
 �[36;1melif [[ $toolchain =~ ^stable' 'minus' '[0-9]+' 'releases?$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((($(date +%s)/60/60/24-16569)/7/6-${toolchain//[^0-9]/}))" >> $GITHUB_OUTPUT�[0m
 �[36;1melif [[ $toolchain =~ ^1\.[0-9]+$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((i=${toolchain#1.}, c=($(date +%s)/60/60/24-16569)/7/6, i+9*i*(10*i<=c)+90*i*(100*i<=c)))" >> $GITHUB_OUTPUT�[0m
 �[36;1melse�[0m
 �[36;1m  echo "toolchain=$toolchain" >> $GITHUB_OUTPUT�[0m
 �[36;1mfi�[0m
 shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
 env:
   toolchain:
 ##[endgroup]
 'toolchain' is a required input
 ##[error]Process completed with exit code 1.

GitHub Actions: E2E + Aspect + Bench + Security / Criterion Benchmarks: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run if [[ -z $toolchain ]]; then
 �[36;1mif [[ -z $toolchain ]]; then�[0m
 �[36;1m  # GitHub does not enforce `required: true` inputs itself. https://github.com/actions/runner/issues/1070�[0m
 �[36;1m  echo "'toolchain' is a required input" >&2�[0m
 �[36;1m  exit 1�[0m
 �[36;1melif [[ $toolchain =~ ^stable' '[0-9]+' '(year|month|week|day)s?' 'ago$ ]]; then�[0m
 �[36;1m  if [[ Linux == macOS ]]; then�[0m
 �[36;1m    echo "toolchain=1.$((($(date -v-$(sed 's/stable \([0-9]*\) \(.\).*/\1\2/' <<< $toolchain) +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  else�[0m
 �[36;1m    echo "toolchain=1.$((($(date --date "${toolchain#stable }" +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  fi�[0m
 �[36;1melif [[ $toolchain =~ ^stable' 'minus' '[0-9]+' 'releases?$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((($(date +%s)/60/60/24-16569)/7/6-${toolchain//[^0-9]/}))" >> $GITHUB_OUTPUT�[0m
 �[36;1melif [[ $toolchain =~ ^1\.[0-9]+$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((i=${toolchain#1.}, c=($(date +%s)/60/60/24-16569)/7/6, i+9*i*(10*i<=c)+90*i*(100*i<=c)))" >> $GITHUB_OUTPUT�[0m
 �[36;1melse�[0m
 �[36;1m  echo "toolchain=$toolchain" >> $GITHUB_OUTPUT�[0m
 �[36;1mfi�[0m
 shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
 env:
   toolchain:
 ##[endgroup]
 'toolchain' is a required input
 ##[error]Process completed with exit code 1.

GitHub Actions: E2E + Aspect + Bench + Security / 5_E2E Lifecycle Test.txt: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run if [[ -z $toolchain ]]; then
 �[36;1mif [[ -z $toolchain ]]; then�[0m
 �[36;1m  # GitHub does not enforce `required: true` inputs itself. https://github.com/actions/runner/issues/1070�[0m
 �[36;1m  echo "'toolchain' is a required input" >&2�[0m
 �[36;1m  exit 1�[0m
 �[36;1melif [[ $toolchain =~ ^stable' '[0-9]+' '(year|month|week|day)s?' 'ago$ ]]; then�[0m
 �[36;1m  if [[ Linux == macOS ]]; then�[0m
 �[36;1m    echo "toolchain=1.$((($(date -v-$(sed 's/stable \([0-9]*\) \(.\).*/\1\2/' <<< $toolchain) +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  else�[0m
 �[36;1m    echo "toolchain=1.$((($(date --date "${toolchain#stable }" +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  fi�[0m
 �[36;1melif [[ $toolchain =~ ^stable' 'minus' '[0-9]+' 'releases?$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((($(date +%s)/60/60/24-16569)/7/6-${toolchain//[^0-9]/}))" >> $GITHUB_OUTPUT�[0m
 �[36;1melif [[ $toolchain =~ ^1\.[0-9]+$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((i=${toolchain#1.}, c=($(date +%s)/60/60/24-16569)/7/6, i+9*i*(10*i<=c)+90*i*(100*i<=c)))" >> $GITHUB_OUTPUT�[0m
 �[36;1melse�[0m
 �[36;1m  echo "toolchain=$toolchain" >> $GITHUB_OUTPUT�[0m
 �[36;1mfi�[0m
 shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
 env:
   toolchain:
 ##[endgroup]
 'toolchain' is a required input
 ##[error]Process completed with exit code 1.

GitHub Actions: E2E + Aspect + Bench + Security / E2E Lifecycle Test: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run if [[ -z $toolchain ]]; then
 �[36;1mif [[ -z $toolchain ]]; then�[0m
 �[36;1m  # GitHub does not enforce `required: true` inputs itself. https://github.com/actions/runner/issues/1070�[0m
 �[36;1m  echo "'toolchain' is a required input" >&2�[0m
 �[36;1m  exit 1�[0m
 �[36;1melif [[ $toolchain =~ ^stable' '[0-9]+' '(year|month|week|day)s?' 'ago$ ]]; then�[0m
 �[36;1m  if [[ Linux == macOS ]]; then�[0m
 �[36;1m    echo "toolchain=1.$((($(date -v-$(sed 's/stable \([0-9]*\) \(.\).*/\1\2/' <<< $toolchain) +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  else�[0m
 �[36;1m    echo "toolchain=1.$((($(date --date "${toolchain#stable }" +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  fi�[0m
 �[36;1melif [[ $toolchain =~ ^stable' 'minus' '[0-9]+' 'releases?$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((($(date +%s)/60/60/24-16569)/7/6-${toolchain//[^0-9]/}))" >> $GITHUB_OUTPUT�[0m
 �[36;1melif [[ $toolchain =~ ^1\.[0-9]+$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((i=${toolchain#1.}, c=($(date +%s)/60/60/24-16569)/7/6, i+9*i*(10*i<=c)+90*i*(100*i<=c)))" >> $GITHUB_OUTPUT�[0m
 �[36;1melse�[0m
 �[36;1m  echo "toolchain=$toolchain" >> $GITHUB_OUTPUT�[0m
 �[36;1mfi�[0m
 shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
 env:
   toolchain:
 ##[endgroup]
 'toolchain' is a required input
 ##[error]Process completed with exit code 1.

GitHub Actions: Governance / 1_governance _ Security policy checks.txt: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

GitHub Actions: Governance / governance _ Security policy checks: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

GitHub Actions: Governance / 4_governance _ Allowlist Preflight.txt: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run rm -rf .standards-checkout
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-actions-policy.sh" \�[0m
 �[36;1m  "$GITHUB_REPOSITORY" "$RUNNER_TEMP/allowed-actions.json"�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GH_***REDACTED_SECRET_ASSIGNMENT***
 gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable. Example:
   env:
     GH_***REDACTED_SECRET_ASSIGNMENT*** github.token }}
 ERROR: could not read live Actions permissions for hyperpolymath/januskey
 ##[error]Process completed with exit code 3.

GitHub Actions: Governance / governance _ Allowlist Preflight: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run rm -rf .standards-checkout
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-actions-policy.sh" \�[0m
 �[36;1m  "$GITHUB_REPOSITORY" "$RUNNER_TEMP/allowed-actions.json"�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GH_***REDACTED_SECRET_ASSIGNMENT***
 gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable. Example:
   env:
     GH_***REDACTED_SECRET_ASSIGNMENT*** github.token }}
 ERROR: could not read live Actions permissions for hyperpolymath/januskey
 ##[error]Process completed with exit code 3.

GitHub Actions: Governance / 5_governance _ Well-Known (RFC 9116 + RSR).txt: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m

GitHub Actions: Governance / 8_governance _ Workflow security linter.txt: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1mSCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m# Self-hosting fallback: when THIS repository is standards, its own�[0m
 �[36;1m# working tree already holds the script, and during a rename that copy�[0m
 �[36;1m# is the only correct one — the pinned main checkout still has the old�[0m
 �[36;1m# name. Preferring the fetched copy keeps every other caller on the�[0m
 �[36;1m# canonical version.�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f scripts/check-workflow-duplicate-keys.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / governance _ Workflow security linter: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1mSCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m# Self-hosting fallback: when THIS repository is standards, its own�[0m
 �[36;1m# working tree already holds the script, and during a rename that copy�[0m
 �[36;1m# is the only correct one — the pinned main checkout still has the old�[0m
 �[36;1m# name. Preferring the fetched copy keeps every other caller on the�[0m
 �[36;1m# canonical version.�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f scripts/check-workflow-duplicate-keys.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / governance _ Workflow security linter: ci: remove Semgrep App token dependency

Conclusion: failure

View job details

##[group]Run if [ -f .github/workflows/actions.lock ]; then
 �[36;1mif [ -f .github/workflows/actions.lock ]; then�[0m
 �[36;1m  # The lockfile records transitive dependency evidence, while direct�[0m
 �[36;1m  # workflow references remain visibly SHA-pinned. Keep both layers:�[0m
 �[36;1m  # external analysers and GitHub's sha_pinning_required setting do�[0m
 �[36;1m  # not infer direct pins from actions.lock.�[0m
 �[36;1m  gh extension install github/gh-actions-lock�[0m
 �[36;1m  bash scripts/update-actions-lock.sh --verify-local�[0m
 �[36;1m  unpinned=$(grep -rnE --include='*.yml' --include='*.yaml' \�[0m
 �[36;1m    "^[[:space:]]+uses:" .github/workflows/ | \�[0m
 �[36;1m    grep -v "@[a-f0-9]\{40\}" | \�[0m
 �[36;1m    grep -v "uses: \./\|uses: docker://\|uses: hyperpolymath/standards/" || true)�[0m
 �[36;1m  if [ -n "$unpinned" ]; then�[0m
 �[36;1m    echo "ERROR: direct workflow references not SHA-pinned:"�[0m
 �[36;1m    echo "$unpinned"�[0m
 �[36;1m    exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "Lockfile coverage verified; direct references SHA-pinned"�[0m
 �[36;1melse�[0m
 �[36;1m  unpinned=$(grep -rnE --include='*.yml' --include='*.yaml' \�[0m
 �[36;1m    "^[[:space:]]+uses:" .github/workflows/ | \�[0m
 �[36;1m    grep -v "@[a-f0-9]\{40\}" | \�[0m
 �[36;1m    grep -v "uses: \./\|uses: docker://\|uses: actions/github-script\|uses: hyperpolymath/standards/" || true)�[0m
 �[36;1m  if [ -n "$unpinned" ]; then�[0m
 �[36;1m    echo "ERROR: no .github/workflows/actions.lock in THIS TREE, and these refs are not SHA-pinned."�[0m
 �[36;1m  echo "  Prefer \`gh actions-lock\` — it also locks the transitive dependencies"�[0m
 �[36;1m  echo "  of composite actions, which an inline SHA cannot express."�[0m
 �[36;1m  echo "  Do NOT do both: gh actions-lock refuses a ref no tag or branch contains,"�[0m
 �[36;1m  echo "  so inline pinning REMOVES actions from the lockfile."�[0m
 �[36;1m    echo "$unpinned"�[0m
 �[36;1m    exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "All ...

📝 Walkthrough

Summary by CodeRabbit

Chores
- Updated the Semgrep security scanning workflow configuration.
- Scans no longer require the previously configured application token.

Walkthrough

The Semgrep workflow removes the SEMGREP_APP_TOKEN secret environment variable from the scan step.

Changes

Cohort / File(s)	Summary
Semgrep workflow `.github/workflows/semgrep.yml`	Removes the `SEMGREP_APP_TOKEN` environment variable from the Semgrep scan step.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 0c837

This change removes the obsolete Semgrep App token dependency while retaining standalone scanning and SARIF upload behavior. No actionable merge-blocking risk remains beyond normal checks and review.

Poem

A rabbit checks the scan
The token hops away
The workflow stays concise
Semgrep runs its way
Fresh steps mark the day

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: removal of the Semgrep App token dependency from CI.
Description check	✅ Passed	The description directly explains the workflow change, retained behaviour, and validation steps.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

ci: remove Semgrep App token dependency

0c8371b

coderabbitai Bot approved these changes Aug 31, 2026

View reviewed changes

hyperpolymath merged commit f37934a into main Aug 31, 2026
30 of 39 checks passed

hyperpolymath deleted the cleanup/app-integrations-20260831 branch August 31, 2026 10:13

Navigation Menu

Uh oh!

ci: remove Semgrep App token dependency - #111

ci: remove Semgrep App token dependency#111
hyperpolymath merged 1 commit into
mainfrom
cleanup/app-integrations-20260831

hyperpolymath commented Aug 31, 2026

Uh oh!

coderabbitai Bot commented Aug 31, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hyperpolymath commented Aug 31, 2026

Summary

Validation

Uh oh!

coderabbitai Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Aug 31, 2026 •

edited

Loading