fix(governance): provide lock verifier to consumers

[hyperpolymath]

Summary

• include the actions-lock verification helper in the reusable workflow's existing sparse standards checkout
• preserve it in the runner temp directory before the checkout is removed
• invoke that canonical copy from consumer repositories

Root cause

The reusable workflow ran scripts/update-actions-lock.sh --verify-local from the caller checkout. Consumer repositories with an actions.lock do not carry that standards implementation script, so their otherwise-correct governance job failed with exit 127.

Verification

• bash scripts/check-workflow-duplicate-keys.sh .github/workflows
• bash scripts/tests/actions-lock-update-test.sh
• git diff --check

This is an infrastructure correction; it does not change governance policy or weaken lockfile verification.

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[coderabbitai]

Warning

Review limit reached

Next included review available in 55 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c5bc018b-4571-43b4-bc1d-53bbdca16489

📥 Commits

Reviewing files that changed from the base of the PR and between 9c11ffa and b6835b8.

📒 Files selected for processing (1)

• .github/workflows/governance-reusable.yml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: bad3b15a-40ab-49fd-9bcf-650b852bd7fb

📥 Commits

Reviewing files that changed from the base of the PR and between 0ecfa63 and 9c11ffa.

📒 Files selected for processing (1)

• .github/workflows/governance-reusable.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: Codacy Static Code Analysis

⚠️ CI failures not shown inline (11)

GitHub Actions: Governance / 5_governance _ Security policy checks.txt: fix(governance): provide lock verifier to consumers

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

---

GitHub Actions: Governance / governance _ Security policy checks: fix(governance): provide lock verifier to consumers

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

---

GitHub Actions: Governance / 6_governance _ Workflow security linter.txt: fix(governance): provide lock verifier to consumers

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1mSCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m# Self-hosting fallback: when THIS repository is standards, its own�[0m
 �[36;1m# working tree already holds the script, and during a rename that copy�[0m
 �[36;1m# is the only correct one — the pinned main checkout still has the old�[0m
 �[36;1m# name. Preferring the fetched copy keeps every other caller on the�[0m
 �[36;1m# canonical version.�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f scripts/check-workflow-duplicate-keys.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

---

GitHub Actions: Governance / governance _ Workflow security linter: fix(governance): provide lock verifier to consumers

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1mSCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m# Self-hosting fallback: when THIS repository is standards, its own�[0m
 �[36;1m# working tree already holds the script, and during a rename that copy�[0m
 �[36;1m# is the only correct one — the pinned main checkout still has the old�[0m
 �[36;1m# name. Preferring the fetched copy keeps every other caller on the�[0m
 �[36;1m# canonical version.�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f scripts/check-workflow-duplicate-keys.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

---

GitHub Actions: Governance / 8_governance _ Allowlist Preflight.txt: fix(governance): provide lock verifier to consumers

Conclusion: failure

View job details

##[group]Run rm -rf .standards-checkout
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-actions-policy.sh" \�[0m
 �[36;1m  "$GITHUB_REPOSITORY" "$RUNNER_TEMP/allowed-actions.json"�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GH_***REDACTED_SECRET_ASSIGNMENT***
 ##[endgroup]
 gh: Bad credentials (HTTP 401)
 ERROR: could not read live Actions permissions for hyperpolymath/standards
 ##[error]Process completed with exit code 1.

---

GitHub Actions: Governance / governance _ Allowlist Preflight: fix(governance): provide lock verifier to consumers

Conclusion: failure

View job details

##[group]Run rm -rf .standards-checkout
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-actions-policy.sh" \�[0m
 �[36;1m  "$GITHUB_REPOSITORY" "$RUNNER_TEMP/allowed-actions.json"�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GH_***REDACTED_SECRET_ASSIGNMENT***
 ##[endgroup]
 gh: Bad credentials (HTTP 401)
 ERROR: could not read live Actions permissions for hyperpolymath/standards
 ##[error]Process completed with exit code 1.

---

GitHub Actions: Governance / 9_governance _ Check Workflow Staleness.txt: fix(governance): provide lock verifier to consumers

Conclusion: failure

View job details

##[group]Run bash "$HOME/standards/scripts/check-workflow-staleness.sh" .
 �[36;1mbash "$HOME/standards/scripts/check-workflow-staleness.sh" .�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GITHUB_***REDACTED_SECRET_ASSIGNMENT***
 ##[endgroup]
 Staleness Check against Standards SHA: 0ecfa6323d4bcc400f1a32c6693ef11691c26448
 Recency window: <= 50 commits behind HEAD OR <= 14 days old.
 ##[error]OSSF Scorecard must not upload SARIF to GitHub Code Scanning unless it runs for every PR head commit.

---

GitHub Actions: Governance / governance _ Check Workflow Staleness: fix(governance): provide lock verifier to consumers

Conclusion: failure

View job details

##[group]Run bash "$HOME/standards/scripts/check-workflow-staleness.sh" .
 �[36;1mbash "$HOME/standards/scripts/check-workflow-staleness.sh" .�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GITHUB_***REDACTED_SECRET_ASSIGNMENT***
 ##[endgroup]
 Staleness Check against Standards SHA: 0ecfa6323d4bcc400f1a32c6693ef11691c26448
 Recency window: <= 50 commits behind HEAD OR <= 14 days old.
 ##[error]OSSF Scorecard must not upload SARIF to GitHub Code Scanning unless it runs for every PR head commit.

---

GitHub Actions: Governance / 10_governance _ Well-Known (RFC 9116 + RSR).txt: fix(governance): provide lock verifier to consumers

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

---

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): fix(governance): provide lock verifier to consumers

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

---

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): fix(governance): provide lock verifier to consumers

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m

🧰 Additional context used

🪛 zizmor (1.29.0)

.github/workflows/governance-reusable.yml

[warning] 1045-1061: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🔇 Additional comments (1)

.github/workflows/governance-reusable.yml (1)

1051-1053: LGTM!

Also applies to: 1089-1093, 1135-1135

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Improved automated workflow validation to ensure all required checks run reliably.
  • Enhanced action pin verification so it continues to work correctly during workflow execution.
  • Updated the supporting automation process for more consistent governance checks.

Walkthrough

The workflow lint job now fetches the action-lock helper, preserves it in $RUNNER_TEMP, and uses that copy for SHA-pin verification after removing the standards checkout.

Changes

Workflow lock verification

Layer / File(s)	Summary
Preserve and invoke the verification helper .github/workflows/governance-reusable.yml	The sparse checkout fetches update-actions-lock.sh. The workflow copies it to $RUNNER_TEMP before checkout removal and runs the preserved copy for verification.

Estimated code review effort: 2 (Simple) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 9c11f

This change makes the lock-verification helper available to reusable-workflow consumers without changing governance policy, and no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: joshuajewell

Poem

A rabbit checks the workflow gate

The helper hops before it’s late
Into temp storage, safe and sound
Then verifies pins without checkout ground
Green ears mark the passing state

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarises the main change: providing the lock verifier to consumer repositories through the reusable governance workflow.
Description check	✅ Passed	The description directly explains the workflow correction, root cause, scope, and verification steps.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The PR introduces the lock verifier to consumer repositories as intended. However, the current implementation of the script preservation step is brittle. While the sparse-checkout is configured to continue on error, the subsequent file copy operation at line 1092 lacks a fallback mechanism and will cause the job to fail immediately if the script is missing (e.g., during self-linting in the standards repository or due to checkout failures). This prevents both the lock verification and the downstream duplicate-key checks from executing, contradicting the resilience patterns established elsewhere in the workflow.

About this PR

• The workflow lacks a fallback mechanism for the lock verifier script. If the standards checkout fails, the workflow will fail at the copy step even if a local copy of the script exists in the repository, breaking self-linting capability and overall robustness.

Test suggestions

• Verify that the sparse-checkout fetches the update-actions-lock.sh script.
• Verify that the script is successfully copied to the temporary directory before directory cleanup.
• Verify that the Check SHA-pinned actions step executes the script from the correct temporary path.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that the sparse-checkout fetches the update-actions-lock.sh script.
2. Verify that the script is successfully copied to the temporary directory before directory cleanup.
3. Verify that the Check SHA-pinned actions step executes the script from the correct temporary path.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🟡 MEDIUM RISK}

The current implementation for preserving update-actions-lock.sh lacks a fallback and error handling. Unlike the dupkeys.sh logic at line 1079, this cp command will fail the entire step if the file is missing from the .standards-dupkey checkout (e.g., if the checkout failed or if the repo is linting itself). This prevents the subsequent duplicate-key check at line 1095 from running. Update the logic to check if .standards-dupkey/scripts/update-actions-lock.sh exists, and if not, fallback to scripts/update-actions-lock.sh. Only attempt the copy if the script is found, ensuring a missing script doesn't prevent the duplicate-key check from running.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud