ci: re-pin codeql-action to the true v4.38.0 commit #128
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow is managed by gh actions-lock. | |
| # SPDX-License-Identifier: MPL-2.0 | |
| # This workflow is managed by gh actions-lock. | |
| # This workflow is managed by gh actions-lock. | |
| # This workflow is managed by gh actions-lock. | |
| # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk> | |
| # | |
| # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate | |
| # Validates that the repo uses hyperpolymath's own formats and tools. | |
| # Companion to static-analysis-gate.yml (security) — this is for format compliance. | |
| name: Dogfood Gate | |
| on: | |
| pull_request: | |
| branches: ['**'] | |
| push: | |
| branches: [main, master] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| # --------------------------------------------------------------------------- | |
| # Job 1: A2ML manifest validation | |
| # --------------------------------------------------------------------------- | |
| a2ml-validate: | |
| name: Validate DEED manifests | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7.0.1 | |
| - name: Check for A2ML files | |
| id: detect | |
| run: | | |
| COUNT=$(find . -type f \( -name '*.a2ml' -o -name '*.deed' \) -not -path './.git/*' | wc -l) | |
| echo "count=$COUNT" >> "$GITHUB_OUTPUT" | |
| if [ "$COUNT" -eq 0 ]; then | |
| echo "::warning::No .a2ml/.deed manifest files found. Every RSR repo should have a repo deed (<reponame>_chora.deed); legacy 0-AI-MANIFEST.a2ml accepted mid-migration — standards #837" | |
| fi | |
| # Runs the in-repo validator, not hyperpolymath/a2ml-validate-action. | |
| # That action repository does not exist — `gh api repos/...` returns 404 | |
| # and the job failed at Set up job with "Unable to resolve action ..., | |
| # repository not found", so it never ran. Meanwhile the real | |
| # implementation ships here as .github/hooks/validate-a2ml.sh and takes the | |
| # same INPUT_PATH / INPUT_STRICT interface the action was passed. | |
| - name: Validate A2ML manifests | |
| if: steps.detect.outputs.count > 0 | |
| env: | |
| INPUT_PATH: '.' | |
| INPUT_STRICT: 'false' | |
| run: bash .github/hooks/validate-a2ml.sh | |
| - name: Write summary | |
| run: | | |
| A2ML_COUNT="${{ steps.detect.outputs.count }}" | |
| if [ "$A2ML_COUNT" -eq 0 ]; then | |
| cat <<'EOF' >> "$GITHUB_STEP_SUMMARY" | |
| ## A2ML Validation | |
| :warning: **No .a2ml/.deed manifest files found.** Every RSR-compliant repo should have a repo deed (`<reponame>_chora.deed`) at its root. | |
| Copy one from [rsr-template-repo](https://github.com/hyperpolymath/rsr-template-repo). | |
| EOF | |
| else | |
| echo "## A2ML Validation" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "Scanned **${A2ML_COUNT}** manifest file(s) (.deed, or legacy .a2ml). See step output for details." >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| # --------------------------------------------------------------------------- | |
| # Job 2: K9 contract validation | |
| # --------------------------------------------------------------------------- | |
| k9-validate: | |
| name: Validate K9 contracts | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7.0.1 | |
| - name: Check for K9 files | |
| id: detect | |
| run: | | |
| COUNT=$(find . \( -name '*.k9' -o -name '*.k9.ncl' \) -not -path './.git/*' | wc -l) | |
| CONFIG_COUNT=$(find . \( -name '*.toml' -o -name '*.yaml' -o -name '*.yml' -o -name '*.json' \) \ | |
| -not -path './.git/*' -not -path './node_modules/*' -not -path './.deno/*' \ | |
| -not -name 'package-lock.json' -not -name 'Cargo.lock' -not -name 'deno.lock' | wc -l) | |
| echo "k9_count=$COUNT" >> "$GITHUB_OUTPUT" | |
| echo "config_count=$CONFIG_COUNT" >> "$GITHUB_OUTPUT" | |
| if [ "$COUNT" -eq 0 ] && [ "$CONFIG_COUNT" -gt 0 ]; then | |
| echo "::warning::Found $CONFIG_COUNT config files but no K9 contracts. Run k9iser to generate contracts." | |
| fi | |
| # In-repo validator — hyperpolymath/k9-validate-action does not exist | |
| # either (404). See the note on the A2ML step above. | |
| - name: Validate K9 contracts | |
| if: steps.detect.outputs.k9_count > 0 | |
| env: | |
| INPUT_PATH: '.' | |
| INPUT_STRICT: 'false' | |
| run: bash .github/hooks/validate-k9.sh | |
| - name: Write summary | |
| run: | | |
| K9_COUNT="${{ steps.detect.outputs.k9_count }}" | |
| CFG_COUNT="${{ steps.detect.outputs.config_count }}" | |
| if [ "$K9_COUNT" -eq 0 ]; then | |
| cat <<'EOF' >> "$GITHUB_STEP_SUMMARY" | |
| ## K9 Contract Validation | |
| :warning: **No .a2ml/.deed manifest files found.** Every RSR-compliant repo should have a repo deed (`<reponame>_chora.deed`) at its root. | |
| Generate contracts with: `k9iser generate .` | |
| EOF | |
| else | |
| echo "## K9 Contract Validation" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "Validated **${K9_COUNT}** K9 contract(s) against **${CFG_COUNT}** config file(s)." >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| # --------------------------------------------------------------------------- | |
| # Job 3: Empty-linter — invisible character detection | |
| # --------------------------------------------------------------------------- | |
| empty-lint: | |
| name: Empty-linter (invisible characters) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7.0.1 | |
| - name: Scan for invisible characters | |
| id: lint | |
| run: | | |
| # Inline invisible character detection (from empty-linter's core patterns). | |
| # Checks for: zero-width spaces, zero-width joiners, BOM, soft hyphens, | |
| # non-breaking spaces, null bytes, and other invisible Unicode in source files. | |
| set +e | |
| PATTERNS='(*UTF)[\x00-\x08\x0B\x0C\x0E-\x1F\x{a0}\x{ad}\x{200b}-\x{200f}\x{202a}-\x{202f}\x{2060}\x{2066}-\x{2069}\x{feff}]' | |
| find "$GITHUB_WORKSPACE" \ | |
| -not -path '*/.git/*' -not -path '*/node_modules/*' \ | |
| -not -path '*/.deno/*' -not -path '*/target/*' \ | |
| -not -path '*/_build/*' -not -path '*/deps/*' \ | |
| -not -path '*/external_corpora/*' -not -path '*/.lake/*' \ | |
| -type f \( -name '*.rs' -o -name '*.ex' -o -name '*.exs' -o -name '*.res' \ | |
| -o -name '*.js' -o -name '*.ts' -o -name '*.json' -o -name '*.toml' \ | |
| -o -name '*.yml' -o -name '*.yaml' -o -name '*.md' -o -name '*.adoc' \ | |
| -o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \ | |
| -o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \ | |
| -exec grep -aPrl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null | |
| EL_EXIT=$? | |
| set -e | |
| FINDINGS=$(wc -l < /tmp/empty-lint-results.txt 2>/dev/null || echo 0) | |
| echo "findings=$FINDINGS" >> "$GITHUB_OUTPUT" | |
| echo "exit_code=$EL_EXIT" >> "$GITHUB_OUTPUT" | |
| echo "ready=true" >> "$GITHUB_OUTPUT" | |
| # Emit annotations for each file with invisible chars | |
| while IFS= read -r filepath; do | |
| [ -z "$filepath" ] && continue | |
| REL_PATH="${filepath#$GITHUB_WORKSPACE/}" | |
| echo "::warning file=${REL_PATH}::Invisible Unicode characters detected (zero-width space, BOM, NBSP, etc.)" | |
| done < /tmp/empty-lint-results.txt | |
| - name: Write summary | |
| run: | | |
| if [ "${{ steps.lint.outputs.ready }}" = "true" ]; then | |
| FINDINGS="${{ steps.lint.outputs.findings }}" | |
| if [ "$FINDINGS" -gt 0 ] 2>/dev/null; then | |
| echo "## Empty-Linter Results" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "Found **${FINDINGS}** invisible character issue(s). See annotations above." >> "$GITHUB_STEP_SUMMARY" | |
| else | |
| echo "## Empty-Linter Results" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo ":white_check_mark: No invisible character issues found." >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| else | |
| echo "## Empty-Linter" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "Skipped: empty-linter not available." >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| # --------------------------------------------------------------------------- | |
| # Job 4: Groove manifest check (for repos that should expose services) | |
| # --------------------------------------------------------------------------- | |
| groove-check: | |
| name: Groove manifest check | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7.0.1 | |
| - name: Check for Groove manifest | |
| id: groove | |
| run: | | |
| # Check for static or dynamic Groove endpoints | |
| HAS_MANIFEST="false" | |
| HAS_GROOVE_CODE="false" | |
| if [ -f ".well-known/groove/manifest.json" ]; then | |
| HAS_MANIFEST="true" | |
| # Validate the manifest JSON | |
| if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then | |
| echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest" | |
| else | |
| SVC_ID=$(jq -r '.service_id // "unknown"' .well-known/groove/manifest.json) | |
| echo "service_id=$SVC_ID" >> "$GITHUB_OUTPUT" | |
| fi | |
| fi | |
| # Check for Groove endpoint code (Rust, Elixir, Zig, V) | |
| if grep -rl 'well-known/groove' --include='*.rs' --include='*.ex' --include='*.zig' --include='*.v' --include='*.res' . 2>/dev/null | head -1 | grep -q .; then | |
| HAS_GROOVE_CODE="true" | |
| fi | |
| # Check if this repo likely serves HTTP in production. Key on | |
| # production HTTP-server framework markers only. A bare `TcpListener` | |
| # is deliberately NOT a signal: it is dominated by test/utility use | |
| # (e.g. a #[cfg(test)] loopback fake), so matching it produced a | |
| # spurious groove nudge on client-only apps. A real hand-rolled Rust | |
| # server still pairs the listener with `axum::serve`/`hyper::Server`, | |
| # which are matched here. | |
| HAS_SERVER="false" | |
| if grep -rl 'Bandit\|Plug.Cowboy\|httpz\|vweb\|axum::serve\|actix_web\|hyper::Server\|rocket::build\|warp::serve' --include='*.rs' --include='*.ex' --include='*.zig' --include='*.v' . 2>/dev/null | head -1 | grep -q .; then | |
| HAS_SERVER="true" | |
| fi | |
| echo "has_manifest=$HAS_MANIFEST" >> "$GITHUB_OUTPUT" | |
| echo "has_groove_code=$HAS_GROOVE_CODE" >> "$GITHUB_OUTPUT" | |
| echo "has_server=$HAS_SERVER" >> "$GITHUB_OUTPUT" | |
| if [ "$HAS_SERVER" = "true" ] && [ "$HAS_MANIFEST" = "false" ] && [ "$HAS_GROOVE_CODE" = "false" ]; then | |
| echo "::warning::This repo has server code but no Groove endpoint. Add .well-known/groove/manifest.json for service discovery." | |
| fi | |
| - name: Write summary | |
| run: | | |
| echo "## Groove Protocol Check" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| Check | Status |" >> "$GITHUB_STEP_SUMMARY" | |
| echo "|-------|--------|" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| Static manifest (.well-known/groove/manifest.json) | ${{ steps.groove.outputs.has_manifest }} |" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| Groove endpoint in code | ${{ steps.groove.outputs.has_groove_code }} |" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| Has HTTP server code | ${{ steps.groove.outputs.has_server }} |" >> "$GITHUB_STEP_SUMMARY" | |
| # --------------------------------------------------------------------------- | |
| # Job 5: eclexiaiser manifest validation | |
| # --------------------------------------------------------------------------- | |
| eclexiaiser-validate: | |
| name: Validate eclexiaiser manifest | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7.0.1 | |
| - name: Check and validate eclexiaiser manifest | |
| id: eclex | |
| run: | | |
| if [ ! -f "eclexiaiser.toml" ]; then | |
| # Check if repo has a Containerfile — if so, recommend eclexiaiser | |
| if [ -f "Containerfile" ]; then | |
| echo "::warning::Containerfile present but no eclexiaiser.toml. Run \`eclexiaiser init\` to scaffold energy/carbon budgets." | |
| fi | |
| echo "has_manifest=false" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| echo "has_manifest=true" >> "$GITHUB_OUTPUT" | |
| # Validate eclexiaiser.toml structure (bash + grep; NO Python per estate policy). | |
| # Structural presence checks only — deep schema validation is eclexiaiser's own job. | |
| err=0 | |
| grep -qE '^[[:space:]]*\[project\]' eclexiaiser.toml || { echo "::error file=eclexiaiser.toml::[project] section is required"; err=1; } | |
| grep -qE '^[[:space:]]*name[[:space:]]*=[[:space:]]*"[^"]+"' eclexiaiser.toml || { echo "::error file=eclexiaiser.toml::a non-empty name is required"; err=1; } | |
| grep -qE '^[[:space:]]*\[\[functions\]\]' eclexiaiser.toml || { echo "::error file=eclexiaiser.toml::at least one [[functions]] entry is required"; err=1; } | |
| if [ "$err" -ne 0 ]; then | |
| exit 1 | |
| fi | |
| fns=$(grep -cE '^[[:space:]]*\[\[functions\]\]' eclexiaiser.toml) | |
| echo "Valid: eclexiaiser.toml structure present (${fns} function block(s))" | |
| - name: Write summary | |
| run: | | |
| if [ "${{ steps.eclex.outputs.has_manifest }}" = "true" ]; then | |
| echo "## Eclexiaiser Manifest" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo ":white_check_mark: **eclexiaiser.toml** present and valid." >> "$GITHUB_STEP_SUMMARY" | |
| else | |
| echo "## Eclexiaiser Manifest" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo ":ballot_box_with_check: No eclexiaiser.toml. Add one with \`eclexiaiser init\` for energy/carbon tracking." >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| # --------------------------------------------------------------------------- | |
| # Job 6: Dogfooding summary | |
| # --------------------------------------------------------------------------- | |
| dogfood-summary: | |
| name: Dogfooding compliance summary | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| needs: [a2ml-validate, k9-validate, empty-lint, groove-check, eclexiaiser-validate] | |
| if: always() | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7.0.1 | |
| - name: Generate dogfooding scorecard | |
| run: | | |
| SCORE=0 | |
| MAX=6 | |
| # A2ML manifest present? | |
| if find . -type f \( -name '*.a2ml' -o -name '*.deed' \) -not -path './.git/*' | head -1 | grep -q .; then | |
| SCORE=$((SCORE + 1)) | |
| A2ML_STATUS=":white_check_mark:" | |
| else | |
| A2ML_STATUS=":x:" | |
| fi | |
| # K9 contracts present? | |
| if find . \( -name '*.k9' -o -name '*.k9.ncl' \) -not -path './.git/*' | head -1 | grep -q .; then | |
| SCORE=$((SCORE + 1)) | |
| K9_STATUS=":white_check_mark:" | |
| else | |
| K9_STATUS=":x:" | |
| fi | |
| # .editorconfig present? | |
| if [ -f ".editorconfig" ]; then | |
| SCORE=$((SCORE + 1)) | |
| EC_STATUS=":white_check_mark:" | |
| else | |
| EC_STATUS=":x:" | |
| fi | |
| # Groove manifest or code? | |
| if [ -f ".well-known/groove/manifest.json" ] || grep -rl 'well-known/groove' --include='*.rs' --include='*.ex' --include='*.zig' . 2>/dev/null | head -1 | grep -q .; then | |
| SCORE=$((SCORE + 1)) | |
| GROOVE_STATUS=":white_check_mark:" | |
| else | |
| GROOVE_STATUS=":ballot_box_with_check:" | |
| fi | |
| # VeriSimDB integration? | |
| if grep -rl 'verisimdb\|VeriSimDB' --include='*.toml' --include='*.yaml' --include='*.yml' --include='*.json' --include='*.rs' --include='*.ex' . 2>/dev/null | head -1 | grep -q .; then | |
| SCORE=$((SCORE + 1)) | |
| VSDB_STATUS=":white_check_mark:" | |
| else | |
| VSDB_STATUS=":ballot_box_with_check:" | |
| fi | |
| # eclexiaiser energy tracking? | |
| if [ -f "eclexiaiser.toml" ]; then | |
| SCORE=$((SCORE + 1)) | |
| ECLEX_STATUS=":white_check_mark:" | |
| else | |
| ECLEX_STATUS=":ballot_box_with_check:" | |
| fi | |
| cat <<EOF >> "$GITHUB_STEP_SUMMARY" | |
| ## Dogfooding Scorecard | |
| **Score: ${SCORE}/${MAX}** | |
| | Tool/Format | Status | Notes | | |
| |-------------|--------|-------| | |
| | AI manifest (0-AI-MANIFEST.deed, or legacy .a2ml) | ${A2ML_STATUS} | Required for all RSR repos | | |
| | K9 contracts | ${K9_STATUS} | Required for repos with config files | | |
| | .editorconfig | ${EC_STATUS} | Required for all repos | | |
| | Groove endpoint | ${GROOVE_STATUS} | Required for service repos | | |
| | VeriSimDB integration | ${VSDB_STATUS} | Required for stateful repos | | |
| | eclexiaiser | ${ECLEX_STATUS} | Energy/carbon budgets for container services | | |
| --- | |
| *Generated by the [Dogfood Gate](https://github.com/hyperpolymath/rsr-template-repo) workflow.* | |
| *Dogfooding is guinea pig fooding — we test our tools on ourselves.* | |
| EOF |