Skip to content

Commit cc81c14

Browse files
hyperpolymathhyperpolymath
committed
Merge main into fix/absolute-zero-baseline-rot
Conflict resolution: take main's canonical versions for all 5 conflict files (3 workflows wrapper-converted, .hypatia-ignore SPDX-headed superset, LICENSE migrated PMPL-1.0 → MPL-2.0). The PR's CI/license/baseline fixes are obsolete — superseded by main's independent repair. Substantive PR content (Cargo.toml + tech-debt doc) lands on top.
2 parents 6efcc2b + 3819a1b commit cc81c14

8 files changed

Lines changed: 485 additions & 754 deletions

File tree

‎.github/workflows/hypatia-scan.yml‎

Lines changed: 11 additions & 396 deletions
Large diffs are not rendered by default.

‎.github/workflows/mirror.yml‎

Lines changed: 6 additions & 135 deletions
Original file line numberDiff line numberDiff line change
@@ -1,144 +1,15 @@
1-
# SPDX-License-Identifier: MPL-2.0
2-
# SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell
1+
# SPDX-License-Identifier: MPL-2.0-or-later
32
name: Mirror to Git Forges
43

54
on:
65
push:
76
branches: [main]
87
workflow_dispatch:
98

10-
permissions: read-all
9+
permissions:
10+
contents: read
1111

1212
jobs:
13-
mirror-gitlab:
14-
runs-on: ubuntu-latest
15-
if: vars.GITLAB_MIRROR_ENABLED == 'true'
16-
steps:
17-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
18-
with:
19-
fetch-depth: 0
20-
21-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
22-
with:
23-
ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}
24-
25-
- name: Mirror to GitLab
26-
run: |
27-
ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts
28-
git remote add gitlab git@gitlab.com:hyperpolymath/${{ github.event.repository.name }}.git || true
29-
git push --force gitlab main
30-
31-
mirror-bitbucket:
32-
runs-on: ubuntu-latest
33-
if: vars.BITBUCKET_MIRROR_ENABLED == 'true'
34-
steps:
35-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
36-
with:
37-
fetch-depth: 0
38-
39-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
40-
with:
41-
ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}
42-
43-
- name: Mirror to Bitbucket
44-
run: |
45-
ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts
46-
git remote add bitbucket git@bitbucket.org:hyperpolymath/${{ github.event.repository.name }}.git || true
47-
git push --force bitbucket main
48-
49-
mirror-codeberg:
50-
runs-on: ubuntu-latest
51-
if: vars.CODEBERG_MIRROR_ENABLED == 'true'
52-
steps:
53-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
54-
with:
55-
fetch-depth: 0
56-
57-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
58-
with:
59-
ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }}
60-
61-
- name: Mirror to Codeberg
62-
run: |
63-
ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts
64-
git remote add codeberg git@codeberg.org:hyperpolymath/${{ github.event.repository.name }}.git || true
65-
git push --force codeberg main
66-
67-
mirror-sourcehut:
68-
runs-on: ubuntu-latest
69-
if: vars.SOURCEHUT_MIRROR_ENABLED == 'true'
70-
steps:
71-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
72-
with:
73-
fetch-depth: 0
74-
75-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
76-
with:
77-
ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }}
78-
79-
- name: Mirror to SourceHut
80-
run: |
81-
ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts
82-
git remote add sourcehut git@git.sr.ht:~hyperpolymath/${{ github.event.repository.name }} || true
83-
git push --force sourcehut main
84-
85-
mirror-disroot:
86-
runs-on: ubuntu-latest
87-
if: vars.DISROOT_MIRROR_ENABLED == 'true'
88-
steps:
89-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
90-
with:
91-
fetch-depth: 0
92-
93-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
94-
with:
95-
ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }}
96-
97-
- name: Mirror to Disroot
98-
run: |
99-
ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts
100-
git remote add disroot git@git.disroot.org:hyperpolymath/${{ github.event.repository.name }}.git || true
101-
git push --force disroot main
102-
103-
mirror-gitea:
104-
runs-on: ubuntu-latest
105-
if: vars.GITEA_MIRROR_ENABLED == 'true'
106-
steps:
107-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
108-
with:
109-
fetch-depth: 0
110-
111-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
112-
with:
113-
ssh-private-key: ${{ secrets.GITEA_SSH_KEY }}
114-
115-
- name: Mirror to Gitea
116-
run: |
117-
ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts
118-
git remote add gitea git@${{ vars.GITEA_HOST }}:hyperpolymath/${{ github.event.repository.name }}.git || true
119-
git push --force gitea main
120-
121-
mirror-radicle:
122-
runs-on: ubuntu-latest
123-
if: vars.RADICLE_MIRROR_ENABLED == 'true'
124-
steps:
125-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
126-
with:
127-
fetch-depth: 0
128-
129-
- name: Setup Rust
130-
uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
131-
with:
132-
toolchain: stable
133-
134-
- name: Install Radicle
135-
run: |
136-
# Install via cargo (safer than curl|sh)
137-
cargo install radicle-cli --locked
138-
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
139-
140-
- name: Mirror to Radicle
141-
run: |
142-
echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle
143-
chmod 600 ~/.radicle/keys/radicle
144-
rad sync --announce || echo "Radicle sync attempted"
13+
mirror:
14+
uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f
15+
secrets: inherit

‎.github/workflows/secret-scanner.yml‎

Lines changed: 6 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -1,80 +1,19 @@
1-
# SPDX-License-Identifier: MPL-2.0
2-
# Prevention workflow - scans for hardcoded secrets before they reach main
1+
# SPDX-License-Identifier: MPL-2.0-or-later
32
name: Secret Scanner
43

54
on:
65
pull_request:
76
push:
87
branches: [main]
98

10-
# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
11-
# updates do not pile up queued runs against the shared account-wide
12-
# Actions concurrency pool. Applied only to read-only check workflows
13-
# (no publish/mutation), so cancelling a superseded run is always safe.
149
concurrency:
1510
group: ${{ github.workflow }}-${{ github.ref }}
1611
cancel-in-progress: true
1712

18-
permissions: read-all
13+
permissions:
14+
contents: read
1915

2016
jobs:
21-
trufflehog:
22-
runs-on: ubuntu-latest
23-
steps:
24-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
25-
with:
26-
fetch-depth: 0 # Full history for scanning
27-
28-
- name: TruffleHog Secret Scan
29-
uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab # v3
30-
with:
31-
# The v3 action injects --fail automatically on pull_request events.
32-
# Passing --fail here triggers "flag 'fail' cannot be repeated".
33-
extra_args: --only-verified
34-
35-
gitleaks:
36-
runs-on: ubuntu-latest
37-
steps:
38-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
39-
with:
40-
fetch-depth: 0
41-
42-
- name: Gitleaks Secret Scan
43-
uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
44-
env:
45-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
46-
47-
# Rust-specific: Check for hardcoded crypto values
48-
rust-secrets:
49-
runs-on: ubuntu-latest
50-
steps:
51-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
52-
53-
- name: Check for hardcoded secrets in Rust
54-
run: |
55-
if ! find . -name Cargo.toml -not -path './target/*' -print -quit | grep -q .; then
56-
echo 'No Cargo.toml found — skipping Rust secrets check'
57-
exit 0
58-
fi
59-
# Patterns that suggest hardcoded secrets
60-
PATTERNS=(
61-
'const.*SECRET.*=.*"'
62-
'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"'
63-
'const.*TOKEN.*=.*"'
64-
'let.*api_key.*=.*"'
65-
'HMAC.*"[a-fA-F0-9]{32,}"'
66-
'password.*=.*"[^"]+"'
67-
)
68-
69-
found=0
70-
for pattern in "${PATTERNS[@]}"; do
71-
if grep -rn --include="*.rs" -E "$pattern" src/; then
72-
echo "WARNING: Potential hardcoded secret found matching: $pattern"
73-
found=1
74-
fi
75-
done
76-
77-
if [ $found -eq 1 ]; then
78-
echo "::error::Potential hardcoded secrets detected. Use environment variables instead."
79-
exit 1
80-
fi
17+
scan:
18+
uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0
19+
secrets: inherit

‎.hypatia-ignore‎

Lines changed: 23 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,27 @@
1-
# Hypatia rule exemptions for absolute-zero.
1+
# SPDX-License-Identifier: MPL-2.0
22
#
3-
# Format: `<rule_id>:<file_path_relative_to_repo_root>` (one per line).
4-
# Comments (lines starting with #) and blank lines are ignored.
3+
# Estate-policy exemptions for the absolute-zero language-demonstration
4+
# repo. This repo intentionally ships example files in many banned and
5+
# allowed languages — it is the canonical "what NOT to use, here is what
6+
# you'd get" exemplar. Each entry below is a language-demo file under
7+
# `examples/` or a one-off interpreter implementation, not load-bearing
8+
# code.
59
#
6-
# Adding an entry requires a stated rationale below the line so the
7-
# exemption survives review and audit.
10+
# After standards#180 (file_pattern glob support in in_baseline()) merges,
11+
# this whole file collapses to a single `examples/**` file_pattern entry
12+
# in .hypatia-baseline.json. Tracked in the standards repo as a follow-up.
813

9-
# Per-language CNO reference example. `examples/<lang>/` is a 30-language
10-
# showcase comparing how each language expresses "do absolutely nothing"
11-
# — the Go-specific runtime characteristics (goroutine scheduler init,
12-
# GC startup, runtime.GOMAXPROCS) are the point of the example. Mirrors
13-
# the rationale for keeping `examples/javascript/nop.js` (also a
14-
# per-language reference). The repo language policy still bans new Go
15-
# code; this is reference material, not implementation.
14+
# ReScript demonstration files (banned 2026-04-30 — kept as historical
15+
# examples until the .res→.affine migration ships).
16+
cicd_rules/banned_language_file:src/AuditTrail.res
17+
cicd_rules/banned_language_file:interpreters/rescript/malbolgeInterpreter.res
18+
cicd_rules/banned_language_file:examples/SafeDOMExample.res
19+
20+
# Banned-language example files used to demonstrate the cross-language
21+
# nop-semantics study. None are imported into the toolchain build.
1622
cicd_rules/banned_language_file:examples/go/nop.go
23+
cicd_rules/banned_language_file:examples/java/Nop.java
24+
cicd_rules/banned_language_file:examples/java/BalancedOps.java
25+
cicd_rules/banned_language_file:examples/kotlin/Nop.kt
26+
cicd_rules/banned_language_file:examples/kotlin/BalancedOps.kt
27+
cicd_rules/banned_language_file:examples/swift/Nop.swift

0 commit comments

Comments
 (0)