Skip to content

chore: remove Glama third-party badge from READMEs - #324

Open
hyperpolymath wants to merge 1 commit into
mainfrom
chore/remove-glama-badge
Open

chore: remove Glama third-party badge from READMEs#324
hyperpolymath wants to merge 1 commit into
mainfrom
chore/remove-glama-badge

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

First step of hyperpolymath/standards#446 (badge policy), executed under the 08-27 pre-authorization: the Glama badge (README.md:8, README.adoc:11) is a third-party automated grade presented as if it were a project credential, and removing it is correct under every #446 option. Scope is the badge line in each README only — the Glama listing links, glama.json, and docs/glama/ posture materials are untouched pending the owner decision batched in standards#709.

Refs hyperpolymath/standards#446.

🤖 Generated with Claude Code

First step of hyperpolymath/standards#446 (badge policy), executed under
the 08-27 pre-authorization — removing the Glama badge is correct under
every option on the table. The Glama listing links, glama.json, and
docs/glama/ materials are NOT touched; their fate is the owner decision
tracked in standards#446 / batch #709.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Aug 31, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 91a9368d-c4a9-469a-9f49-ee45120fd062

📥 Commits

Reviewing files that changed from the base of the PR and between c9ede6e and 7bb47d0.

📒 Files selected for processing (2)
  • README.adoc
  • README.md
💤 Files with no reviewable changes (2)
  • README.md
  • README.adoc

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⚠️ CI failures not shown inline (15)

GitHub Actions: README Derive / 0_readme-derive _ Derive & verify README.md.txt: chore: remove Glama third-party badge from READMEs

Conclusion: failure

View job details

##[group]Run # Prefer descriptiles; fall back to the deprecated 6a2 dir during the
 �[36;1m# Prefer descriptiles; fall back to the deprecated 6a2 dir during the�[0m
 �[36;1m# estate migration. No file / no [publishing.readme] table / derive�[0m
 �[36;1m# not true => this repo has opted out and we do nothing.�[0m
 �[36;1mECO=""�[0m
 �[36;1mfor c in .machine_readable/descriptiles/ECOSYSTEM.a2ml \�[0m
 �[36;1m         .machine_readable/6a2/ECOSYSTEM.a2ml; do�[0m
 �[36;1m  if [ -f "$c" ]; then ECO="$c"; break; fi�[0m
 �[36;1mdone�[0m
 �[36;1m�[0m
 �[36;1mif [ -z "$ECO" ]; then�[0m
 �[36;1m  echo "No ECOSYSTEM.a2ml found — repo not opted in. Nothing to derive."�[0m
 �[36;1m  echo "derive=false" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mecho "Reading declaration from: $ECO"�[0m
 �[36;1m�[0m
 �[36;1m# Extract the flat [publishing.readme] table into KEY=VALUE lines.�[0m
 �[36;1meval "$(�[0m
 �[36;1m  awk '�[0m
 �[36;1m    /^[[:space:]]*\[/ { inblk = ($0 ~ /^[[:space:]]*\[publishing\.readme\][[:space:]]*$/) ? 1 : 0; next }�[0m
 �[36;1m    inblk && /=/ {�[0m
 �[36;1m      key = $0; sub(/=.*/, "", key); gsub(/[[:space:]]/, "", key)�[0m
 �[36;1m      val = $0; sub(/^[^=]*=[[:space:]]*/, "", val)�[0m
 �[36;1m      sub(/[[:space:]]*(#.*)?$/, "", val)          # strip trailing comment/space�[0m
 �[36;1m      gsub(/^"|"$/, "", val)                        # strip surrounding quotes�[0m
 �[36;1m      if (key ~ /^(canonical|derive|format|path|consumer)$/)�[0m
 �[36;1m        printf "DECL_%s=%s\n", toupper(key), val�[0m
 �[36;1m    }�[0m
 �[36;1m  ' "$ECO"�[0m
 �[36;1m)"�[0m
 �[36;1m�[0m
 �[36;1mif [ "${DECL_DERIVE:-false}" != "true" ]; then�[0m
 �[36;1m  echo "[publishing.readme] absent or derive != true — repo not opted in."�[0m
 �[36;1m  echo "derive=false" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mCANONICAL="${DECL_CANONICAL:-README.adoc}"�[0m
 �[36;1mDERIVED_PATH="${DECL_PATH:-README.md}"�[0m
 �[36;1mFORMAT="${DEC...

GitHub Actions: Build / 0_SonarQube.txt: chore: remove Glama third-party badge from READMEs

Conclusion: failure

View job details

##[group]Run SonarSource/sonarqube-scan-action@v8.1.0
 with:
   projectBaseDir: .
   scannerVersion: 8.1.0.6389
   scannerBinariesUrl: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli
   skipSignatureVerification: false
 env:
   SONAR_***REDACTED_SECRET_ASSIGNMENT***
 ##[endgroup]
 Installing Sonar Scanner CLI 8.1.0.6389 for linux-x64...
 Downloading from: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.1.0.6389-linux-x64.zip
 Downloading signature from: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.1.0.6389-linux-x64.zip.asc
 Importing SonarSource public key from hkps://keyserver.ubuntu.com...
 [command]/usr/bin/gpg --homedir /home/runner/work/_temp/gpg-home-1788203376887-2254 --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 679F1EE92B19609DE816FDE81DB198F93525EC1A
 gpg: keybox '/home/runner/work/_temp/gpg-home-1788203376887-2254/pubring.kbx' created
 gpg: /home/runner/work/_temp/gpg-home-1788203376887-2254/trustdb.gpg: trustdb created
 gpg: key 1DB198F93525EC1A: public key "SonarSource S.A. <infra@sonarsource.com>" imported
 gpg: Total number processed: 1
 gpg:               imported: 1
 Successfully imported key from hkps://keyserver.ubuntu.com
 ✓ SonarSource public key imported successfully
 Verifying GPG signature...
 [command]/usr/bin/gpg --homedir /home/runner/work/_temp/gpg-home-1788203376887-2254 --batch --verify /home/runner/work/_temp/e89cdeef-04a9-476d-b879-2ea5b42e7bce /home/runner/work/_temp/ff084c68-b092-43ac-b1c7-cca9ff3db509
 gpg: Signature made Tue Apr 21 07:20:26 2026 UTC
 gpg:                using RSA key D1436C0DBACEA48702AF97C363F1DD7753B8B315
 gpg: Good signature from "SonarSource S.A. <infra@sonarsource.com>" [unknown]
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg:          There is no indication that the signature belongs to the owner.
 Primary key fingerprint: 679F 1EE9 2B19 609D E816  FDE8 1DB1 98F9 3525 EC1A
   ...

GitHub Actions: README Derive / readme-derive _ Derive & verify README.md: chore: remove Glama third-party badge from READMEs

Conclusion: failure

View job details

##[group]Run # Prefer descriptiles; fall back to the deprecated 6a2 dir during the
 �[36;1m# Prefer descriptiles; fall back to the deprecated 6a2 dir during the�[0m
 �[36;1m# estate migration. No file / no [publishing.readme] table / derive�[0m
 �[36;1m# not true => this repo has opted out and we do nothing.�[0m
 �[36;1mECO=""�[0m
 �[36;1mfor c in .machine_readable/descriptiles/ECOSYSTEM.a2ml \�[0m
 �[36;1m         .machine_readable/6a2/ECOSYSTEM.a2ml; do�[0m
 �[36;1m  if [ -f "$c" ]; then ECO="$c"; break; fi�[0m
 �[36;1mdone�[0m
 �[36;1m�[0m
 �[36;1mif [ -z "$ECO" ]; then�[0m
 �[36;1m  echo "No ECOSYSTEM.a2ml found — repo not opted in. Nothing to derive."�[0m
 �[36;1m  echo "derive=false" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mecho "Reading declaration from: $ECO"�[0m
 �[36;1m�[0m
 �[36;1m# Extract the flat [publishing.readme] table into KEY=VALUE lines.�[0m
 �[36;1meval "$(�[0m
 �[36;1m  awk '�[0m
 �[36;1m    /^[[:space:]]*\[/ { inblk = ($0 ~ /^[[:space:]]*\[publishing\.readme\][[:space:]]*$/) ? 1 : 0; next }�[0m
 �[36;1m    inblk && /=/ {�[0m
 �[36;1m      key = $0; sub(/=.*/, "", key); gsub(/[[:space:]]/, "", key)�[0m
 �[36;1m      val = $0; sub(/^[^=]*=[[:space:]]*/, "", val)�[0m
 �[36;1m      sub(/[[:space:]]*(#.*)?$/, "", val)          # strip trailing comment/space�[0m
 �[36;1m      gsub(/^"|"$/, "", val)                        # strip surrounding quotes�[0m
 �[36;1m      if (key ~ /^(canonical|derive|format|path|consumer)$/)�[0m
 �[36;1m        printf "DECL_%s=%s\n", toupper(key), val�[0m
 �[36;1m    }�[0m
 �[36;1m  ' "$ECO"�[0m
 �[36;1m)"�[0m
 �[36;1m�[0m
 �[36;1mif [ "${DECL_DERIVE:-false}" != "true" ]; then�[0m
 �[36;1m  echo "[publishing.readme] absent or derive != true — repo not opted in."�[0m
 �[36;1m  echo "derive=false" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mCANONICAL="${DECL_CANONICAL:-README.adoc}"�[0m
 �[36;1mDERIVED_PATH="${DECL_PATH:-README.md}"�[0m
 �[36;1mFORMAT="${DEC...

GitHub Actions: Build / SonarQube: chore: remove Glama third-party badge from READMEs

Conclusion: failure

View job details

##[group]Run SonarSource/sonarqube-scan-action@v8.1.0
 with:
   projectBaseDir: .
   scannerVersion: 8.1.0.6389
   scannerBinariesUrl: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli
   skipSignatureVerification: false
 env:
   SONAR_***REDACTED_SECRET_ASSIGNMENT***
 ##[endgroup]
 Installing Sonar Scanner CLI 8.1.0.6389 for linux-x64...
 Downloading from: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.1.0.6389-linux-x64.zip
 Downloading signature from: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.1.0.6389-linux-x64.zip.asc
 Importing SonarSource public key from hkps://keyserver.ubuntu.com...
 [command]/usr/bin/gpg --homedir /home/runner/work/_temp/gpg-home-1788203376887-2254 --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 679F1EE92B19609DE816FDE81DB198F93525EC1A
 gpg: keybox '/home/runner/work/_temp/gpg-home-1788203376887-2254/pubring.kbx' created
 gpg: /home/runner/work/_temp/gpg-home-1788203376887-2254/trustdb.gpg: trustdb created
 gpg: key 1DB198F93525EC1A: public key "SonarSource S.A. <infra@sonarsource.com>" imported
 gpg: Total number processed: 1
 gpg:               imported: 1
 Successfully imported key from hkps://keyserver.ubuntu.com
 ✓ SonarSource public key imported successfully
 Verifying GPG signature...
 [command]/usr/bin/gpg --homedir /home/runner/work/_temp/gpg-home-1788203376887-2254 --batch --verify /home/runner/work/_temp/e89cdeef-04a9-476d-b879-2ea5b42e7bce /home/runner/work/_temp/ff084c68-b092-43ac-b1c7-cca9ff3db509
 gpg: Signature made Tue Apr 21 07:20:26 2026 UTC
 gpg:                using RSA key D1436C0DBACEA48702AF97C363F1DD7753B8B315
 gpg: Good signature from "SonarSource S.A. <infra@sonarsource.com>" [unknown]
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg:          There is no indication that the signature belongs to the owner.
 Primary key fingerprint: 679F 1EE9 2B19 609D E816  FDE8 1DB1 98F9 3525 EC1A
   ...

GitHub Actions: README Derive / readme-derive _ Derive & verify README.md: chore: remove Glama third-party badge from READMEs

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1mcurl -fsSL -o /tmp/pandoc.deb \�[0m
 �[36;1m  "https://github.com/jgm/pandoc/releases/download/${PANDOC_VERSION}/pandoc-${PANDOC_VERSION}-1-amd64.deb"�[0m
 �[36;1msudo dpkg -i /tmp/pandoc.deb�[0m
 �[36;1msudo gem install --no-document \�[0m
 �[36;1m  asciidoctor -v "$ASCIIDOCTOR_VERSION" \�[0m
 �[36;1m  asciidoctor-reducer -v "$ASCIIDOCTOR_REDUCER_VERSION"�[0m
 �[36;1mpandoc --version | head -1�[0m
 �[36;1masciidoctor --version | head -1�[0m
 shell: /usr/bin/bash -e {0}
 env:
   PANDOC_VERSION: 3.10
   ASCIIDOCTOR_VERSION: 2.0.26
   ASCIIDOCTOR_REDUCER_VERSION: 1.1.1
 ##[endgroup]
 Selecting previously unselected package pandoc.
 (Reading database ... 203385 files and directories currently installed.)
 Preparing to unpack /tmp/pandoc.deb ...
 Unpacking pandoc (3.10-1) ...
 Setting up pandoc (3.10-1) ...
 Processing triggers for man-db (2.12.0-4build2) ...
 Not building database; man-db/auto-update is not 'true'.
 ERROR:  Can't use --version with multiple gems. You can specify multiple gems with version requirements using `gem install 'my_gem:1.0.0' 'my_other_gem:~>2.0.0'`
 ##[error]Process completed with exit code 1.

GitHub Actions: Governance / 2_governance _ Well-Known (RFC 9116 + RSR).txt: chore: remove Glama third-party badge from READMEs

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): chore: remove Glama third-party badge from READMEs

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): chore: remove Glama third-party badge from READMEs

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m

GitHub Actions: Governance / 3_governance _ Workflow security linter.txt: chore: remove Glama third-party badge from READMEs

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1mSCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m# Self-hosting fallback: when THIS repository is standards, its own�[0m
 �[36;1m# working tree already holds the script, and during a rename that copy�[0m
 �[36;1m# is the only correct one — the pinned main checkout still has the old�[0m
 �[36;1m# name. Preferring the fetched copy keeps every other caller on the�[0m
 �[36;1m# canonical version.�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f scripts/check-workflow-duplicate-keys.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / governance _ Workflow security linter: chore: remove Glama third-party badge from READMEs

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1mSCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m# Self-hosting fallback: when THIS repository is standards, its own�[0m
 �[36;1m# working tree already holds the script, and during a rename that copy�[0m
 �[36;1m# is the only correct one — the pinned main checkout still has the old�[0m
 �[36;1m# name. Preferring the fetched copy keeps every other caller on the�[0m
 �[36;1m# canonical version.�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f scripts/check-workflow-duplicate-keys.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / governance _ Workflow security linter: chore: remove Glama third-party badge from READMEs

Conclusion: failure

View job details

##[group]Run if [ -f .github/workflows/actions.lock ]; then
 �[36;1mif [ -f .github/workflows/actions.lock ]; then�[0m
 �[36;1m  # The lockfile records transitive dependency evidence, while direct�[0m
 �[36;1m  # workflow references remain visibly SHA-pinned. Keep both layers:�[0m
 �[36;1m  # external analysers and GitHub's sha_pinning_required setting do�[0m
 �[36;1m  # not infer direct pins from actions.lock.�[0m
 �[36;1m  gh extension install github/gh-actions-lock�[0m
 �[36;1m  bash scripts/update-actions-lock.sh --verify-local�[0m
 �[36;1m  unpinned=$(grep -rnE --include='*.yml' --include='*.yaml' \�[0m
 �[36;1m    "^[[:space:]]+uses:" .github/workflows/ | \�[0m
 �[36;1m    grep -v "@[a-f0-9]\{40\}" | \�[0m
 �[36;1m    grep -v "uses: \./\|uses: docker://\|uses: hyperpolymath/standards/" || true)�[0m
 �[36;1m  if [ -n "$unpinned" ]; then�[0m
 �[36;1m    echo "ERROR: direct workflow references not SHA-pinned:"�[0m
 �[36;1m    echo "$unpinned"�[0m
 �[36;1m    exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "Lockfile coverage verified; direct references SHA-pinned"�[0m
 �[36;1melse�[0m
 �[36;1m  unpinned=$(grep -rnE --include='*.yml' --include='*.yaml' \�[0m
 �[36;1m    "^[[:space:]]+uses:" .github/workflows/ | \�[0m
 �[36;1m    grep -v "@[a-f0-9]\{40\}" | \�[0m
 �[36;1m    grep -v "uses: \./\|uses: docker://\|uses: actions/github-script\|uses: hyperpolymath/standards/" || true)�[0m
 �[36;1m  if [ -n "$unpinned" ]; then�[0m
 �[36;1m    echo "ERROR: no .github/workflows/actions.lock in THIS TREE, and these refs are not SHA-pinned."�[0m
 �[36;1m  echo "  Prefer \`gh actions-lock\` — it also locks the transitive dependencies"�[0m
 �[36;1m  echo "  of composite actions, which an inline SHA cannot express."�[0m
 �[36;1m  echo "  Do NOT do both: gh actions-lock refuses a ref no tag or branch contains,"�[0m
 �[36;1m  echo "  so inline pinning REMOVES actions from the lockfile."�[0m
 �[36;1m    echo "$unpinned"�[0m
 �[36;1m    exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "All ...

GitHub Actions: Governance / 6_governance _ Security policy checks.txt: chore: remove Glama third-party badge from READMEs

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

GitHub Actions: Governance / governance _ Security policy checks: chore: remove Glama third-party badge from READMEs

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

GitHub Actions: Governance / 7_governance _ Allowlist Preflight.txt: chore: remove Glama third-party badge from READMEs

Conclusion: failure

View job details

##[group]Run rm -rf .standards-checkout
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-actions-policy.sh" \�[0m
 �[36;1m  "$GITHUB_REPOSITORY" "$RUNNER_TEMP/allowed-actions.json"�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GH_***REDACTED_SECRET_ASSIGNMENT***
 gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable. Example:
   env:
     GH_***REDACTED_SECRET_ASSIGNMENT*** github.token }}
 ERROR: could not read live Actions permissions for hyperpolymath/boj-server
 ##[error]Process completed with exit code 3.

GitHub Actions: Governance / governance _ Allowlist Preflight: chore: remove Glama third-party badge from READMEs

Conclusion: failure

View job details

##[group]Run rm -rf .standards-checkout
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-actions-policy.sh" \�[0m
 �[36;1m  "$GITHUB_REPOSITORY" "$RUNNER_TEMP/allowed-actions.json"�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GH_***REDACTED_SECRET_ASSIGNMENT***
 gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable. Example:
   env:
     GH_***REDACTED_SECRET_ASSIGNMENT*** github.token }}
 ERROR: could not read live Actions permissions for hyperpolymath/boj-server
 ##[error]Process completed with exit code 3.

📝 Walkthrough

Summary by CodeRabbit

  • Documentation
    • Removed the Glama MCP Server badge from the README badge listings.
    • Retained the Glama listing as a plain-text link in the “Contributing & links” section.
    • Preserved all other project badges.

Walkthrough

The Glama MCP Server badge was removed from README.adoc and README.md. Other badges and the plain-text Glama listing link remain.

Changes

Cohort / File(s) Summary
Documentation badge cleanup
README.adoc, README.md
Removes the Glama MCP Server badge from both badge lists. Retains the remaining badges and the plain-text Glama listing link in README.md.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 7bb47

The PR only removes the Glama badge from the two README files, with no other documented behavior or runtime changes. No actionable merge-blocking risk remains after normal checks and review.

Poem

A rabbit checked the badges in a row
One Glama mark was set to go
The other badges stayed in place
The links still point to their proper space
Documentation now has a tidy glow

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description explains the scope and rationale, but it does not use the required template sections. It omits the Changes list, RSR Quality Checklist, Testing section, and Screenshots section. Update the description to include the required template headings. List the README changes, complete the applicable RSR Quality Checklist items, describe the testing performed, and state that screenshots are not applicable if none are availa…
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the main change: removal of the Glama third-party badge from both README files.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Description check

Resolution

Update the description to include the required template headings. List the README changes, complete the applicable RSR Quality Checklist items, describe the testing performed, and state that screenshots are not applicable if none are available.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files.

  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 69 issues detected

Severity Count
🔴 Critical 11
🟠 High 4
🟡 Medium 54

⚠️ Action Required: Critical security issues found!

View findings
[
  {
    "reason": "Issue in build.yml",
    "type": "missing_timeout_minutes",
    "file": "build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in label-triage.yml",
    "type": "missing_timeout_minutes",
    "file": "label-triage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in labels.yml",
    "type": "missing_timeout_minutes",
    "file": "labels.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in pages-deploy.yml",
    "type": "missing_timeout_minutes",
    "file": "pages-deploy.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in push-email-notify.yml",
    "type": "missing_timeout_minutes",
    "file": "push-email-notify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "believe_me undermines formal verification (4 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/boj-server/boj-server/src/abi/Boj/SafetyLemmas.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "eval() -- arbitrary code execution (2 occurrences, CWE-94)",
    "type": "js_eval",
    "file": "/home/runner/work/boj-server/boj-server/mcp-bridge/lib/security.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/boj-server/boj-server/mcp-bridge/lib/nickel-validator.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant