Repository navigation
fix(ci): give every workflow a recorded state and reconcile the issues it raises - #148
Merged
Merged
Conversation
Contributor
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
⛔ Files ignored due to path filters: 1
📒 Files selected for processing: 14
✨ Finishing Touches: 💡 1
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
hyperpolymath
force-pushed
the
arena/108bf010-rpa-elysium
branch
from
October 14, 2026 18:31
e80c331 to
d03864a
Compare
…s it raises Issue #138 tracked two "pre-existing reds" both named lint-workflows — one check rendered twice. That check is green on main (workflow-linter run 38608640962), but measuring the repository instead of the check name found five workflows that are red, stale, superseded or dormant, none of them triaged anywhere: mirror.yml red mirror-gitea exit 1, mirror-disroot exit 128 cflite_batch.yml stale run predates the in-file harness repairs cflite_pr.yml stale run predates the in-file harness repairs casket-pages.yml superseded cancelled since 2026-09-22, no successful deploy instant-sync.yml dormant disabled_manually, last run 2026-07-14 push-email-notify.yml dormant disabled_manually, last run 2026-07-14 No gate is weakened and no capability is hidden: * docs/audits/ci-check-ledger.json records the state of all 19 workflows with the run that proves it, and for every non-green one a reason, the owner action that clears it, the issue (#147) and a review date. * scripts/ci-check-ledger.sh validates that record offline — it must cover exactly the workflow files on disk, evidence must be an actions run from this repository, review dates must be live and inside 90 days — and verifies it online on pushes to the default branch: a workflow recorded as green that has gone red fails, while benign transitions are reported for recording. An unreadable API means "not verified", never "verified". * cargo-audit.yml keeps both audits blocking and passes their output to scripts/reconcile-audit-issue.sh, which maintains exactly one issue carrying the findings and acceptance criteria and closes it with a green run on the default branch. The old publisher's "Run `cargo audit` locally for details" issue, never closed, is how #143 and #113 both exist. * mirror.yml gains a preflight job that names an enabled-but-undeclared or enabled-but-unconfigured forge before the fan-out — including the empty vars.GITEA_HOST that made ssh-keyscan exit 1 — and actions.lock gains the checkout ref that job uses. Each script has a fail-closed control suite (21, 10 and 7 controls), wired into just ci-check; the determinations and the evidence for every entry are in docs/CI-RED-DETERMINATIONS.adoc. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
hyperpolymath
force-pushed
the
arena/108bf010-rpa-elysium
branch
from
October 14, 2026 18:31
d03864a to
1f9a55f
Compare
Contributor
|
❌ Failed to create Coding Agent finishing-touch task. Please try again. |
hyperpolymath
added a commit
that referenced
this pull request
Oct 14, 2026
## Why #148 gave the dependency audit a lifecycle: one issue carrying the findings, the run and acceptance criteria, closed by a green run on the default branch (`scripts/reconcile-audit-issue.sh`). That reconciler has only ever been exercised against a stubbed `gh` in `scripts/tests/reconcile-audit-issue-test.sh` — it has not yet touched the API from a runner. The audit workflow runs on push to `Cargo.toml`/`Cargo.lock` and on the Monday schedule, so the path that *closes* an issue could not be exercised until a remediation landed or a week passed. This adds `workflow_dispatch`, which makes the gate re-runnable: * after a finding is remediated, the issue goes green and closes immediately instead of waiting for the cron tick; * the reconcile path can be proven on a real runner now, rather than being trusted and discovered broken on Monday; * when a run fails for a transient reason (an install failure), the audit can be re-run without an empty commit. ## What it does not change * the audits stay blocking and identical (`--deny warnings`, `--deny unmaintained`, both outputs teed); * the reconcile step's condition is unchanged — it already treats any non-pull-request event the same way, so a manual run opens, comments or closes exactly as a scheduled one does, and a manual run never touches issues from a pull request; * no new permissions, no new action references, no change to `actions.lock`. ## Verification * 10/10 reconciliation controls still pass (`bash scripts/tests/reconcile-audit-issue-test.sh`). * All 19 workflows still parse; the locked-ref emulation is unchanged. --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes nothing on its own — it makes the two open issues' classes impossible to leave undetermined, and records a determination for every workflow in the repository. It is the foundational reply to #138 and #143: I did not want to close either one without a mechanism that stops the next one.
What the issues asked for, and what measurement found
#138 lists two reds, both named
lint-workflows— one check rendered twice, the shape hyperpolymath/standards#994 records for this class. That check is green onmain: workflow-linter run https://github.com/hyperpolymath/rpa-elysium/actions/runs/38608640962[38608640962] (2026-10-14T17:40:24Z). The repair was already in the repository (SPDX-before-marker ordering, structured lock verifier, governance pin) — #145 — so nothing needed fixing; it needed recording.Measuring every workflow instead of the one check name found five more red/odd states, none of them triaged anywhere:
mirror.ymlmirror-giteaexit 1,mirror-disrootexit 128cflite_batch.ymlcflite_pr.yml**/*.rsPRcasket-pages.ymlcancelledsince 2026-09-22, no successful Pages deployinstant-sync.ymldisabled_manually, last run 2026-07-14push-email-notify.ymldisabled_manually, last run 2026-07-1413 of 19 workflows are green.
#143's advisory, RUSTSEC-2026-0316, is fixed onmain(wasmtime 36.0.16 / async-trait 0.1.92 from #145); cargo-audit run https://github.com/hyperpolymath/rpa-elysium/actions/runs/38606899195[38606899195] is green.What the change does
A recorded state per workflow.
docs/audits/ci-check-ledger.jsonholds the state, the run that proves it, and — for everything not green — a reason, the owner action that clears it, an issue and a review date.docs/CI-RED-DETERMINATIONS.adoccarries the narrative and the determinations.A checker that cannot be satisfied by hand-waving.
scripts/ci-check-ledger.sh:--check(offline, injust ci-checkand on every CI event): the ledger must cover exactly the workflow files on disk;greenneeds an actions-run URL from this repository;redneeds reason + owner action + issue + review date; the light states need a reason, a review date and one concrete pointer; review dates more than 90 days out are rejected.--verify(on pushes to the default branch): recorded states versus the latest completed runs. A workflow recorded as green that has gone red fails — an unrecorded red is the exact thing that hid here. Benign transitions are printed for recording, not failed. If the API cannot be read, the ledger reports not verified; it never reports verified on an unreadable observation set.--writerefreshes state/evidence from the API and never touches the human fields — a new red still has to be determined by hand.A dependency-issue lifecycle instead of a duplicate generator.
cargo-audit.ymlkeeps both audits blocking (--deny warnings,--deny unmaintained) and tees their output toscripts/reconcile-audit-issue.sh, which keeps exactly one issue carrying the findings, the run and acceptance criteria; adopts the old markerless issue (#143's shape) instead of duplicating it; comments a new failing run rather than opening a second issue; and closes it with a green run on the default branch. #143 will therefore close itself, with the run linked, on the next Cargo Audit run after this merges (Monday schedule at the latest).A preflight for the mirror drift.
mirror.ymlgains a job (no new action refs;actions.lockgains only the checkout ref it uses) that runsscripts/check-mirror-config.shbefore the fan-out: an enabled-but-undeclared forge and an enabled-but-unconfigured one are named, including the emptyvars.GITEA_HOSTthat madessh-keyscanexit 1. Five of the seven legs work and stay untouched; the owner decides declare-or-disable for the rest.Local verification
scripts/tests/ci-check-ledger-test.sh— 21 controls, all passing (missing entry, unknown state, red without owner/issue/review date, expired and over-long review dates, green without evidence, evidence from another repository, exemption on a green workflow, unrecorded red fails verification, benign transition warns, unreadable observations report "not verified",--writepreserves determinations).scripts/tests/reconcile-audit-issue-test.sh— 10 controls against a stubbedgh(create, adopt, update, no duplicate comment, PRs untouched,--dry-run, missing report, and that the workflow still calls it and stays blocking).scripts/tests/mirror-config-test.sh— 7 controls, including the configuration measured on this repository (gitea + disroot + sourcehut + radicle enabled and undeclared, noGITEA_HOST).shellcheck -S warningclean on every script; theactions.lockrules (direct refs, orphan workflows, immutable commits, transitive closure, unreferenced dependencies) were re-implemented locally in Python and pass — the real gate needs mikefarahyqv4, which is not available here, so the Lock Sync Gate in CI is the authoritative run for that.scripts/check-repository-health.shneedsyqtoo.Notes
--checkfails when those go stale.GITEA_HOSTreddens a default branch instead of printing a notice) and cargo-audit.yml template: vulnerability issues carry no findings, no acceptance criteria and never close (rpa-elysium #113/#143 are the same issue twice) standards#1265 (the templatedcargo-audit.ymlpublishes issues with no findings that never close — rpa-elysium Security: Dependency vulnerabilities detected #113/Security: Dependency vulnerabilities detected #143 are that issue twice).src/interface/ABI migration for standards#1262) is deliberately not in this commit.