ci: vendor validation scripts and remove remote action pins

[hyperpolymath]

Automated PR to fix CI after deleted actions.

[gitar-bot]

CI failed: CI failed due to a CodeQL error from missing or invalid JavaScript/TypeScript source files and a governance check rejection of banned ReScript (.res) files.

Overview

Two distinct failures occurred during the CI run: a CodeQL analysis failure due to missing or invalid JavaScript/TypeScript files, and a governance check failure detecting banned ReScript files.

Failures

CodeQL Analysis Failure (confidence: high)

• Type: configuration
• Affected jobs: 90125564883
• Related to change: unclear
• Root cause: CodeQL found only empty or syntactically invalid JavaScript/TypeScript files in the repository during extraction, leading to exit code 32.
• Suggested fix: Ensure the repository contains valid JavaScript/TypeScript files if scanning is required, or remove javascript-typescript from the CodeQL language matrix.

Governance Check: Banned Language Files (confidence: high)

• Type: tooling
• Affected jobs: 90125566185
• Related to change: unclear
• Root cause: The hypatia governance check (cicd_rules/banned_language_file) detected ReScript (.res) files (e.g., under visualization/src/transforms/), which are prohibited by project standards in favor of AffineScript.
• Suggested fix: Migrate the ReScript files to AffineScript, or add a # hypatia:ignore cicd_rules/banned_language_file pragma / .hypatia-ignore entry if intentional.

Summary

• Change-related failures: 0 explicit code bugs, but 2 workflow/governance check failures related to code structure and policy.
• Infrastructure/flaky failures: None.
• Recommended action: Address the governance violation by removing or migrating the banned ReScript files (or adding exemptions), and review the CodeQL language matrix configuration for JavaScript/TypeScript.

Code Review ✅ Approved 3 resolved / 3 findings

Vendors validation scripts and removes remote action pins, but introduces a single-line pedigree bypass in K9 along with fragile whitespace trimming and CRLF line ending vulnerabilities.

✅ 3 resolved

✅ Security: Single-line pedigree bypasses hunt signature enforcement in K9

📄 .githooks/validate-k9.sh:224-233 📄 .githooks/validate-k9.sh:284-287 📄 .githooks/validate-k9.sh:212-221
The name and version checks were given an extra inline regex ([:space:]=) to handle single-line pedigrees such as pedigree = base & { leash = "hunt" }, but the leash/security_level check (line 224) and the in-pedigree signature check (line 231) only have the anchored ^[[:space:]]+... form. On a single-line pedigree the line starts with pedigree, so neither leash nor signature is ever matched: has_security_level stays false and security_level_value stays empty. This silently skips both the security-level validity check and the mandatory Check 5 hunt-level signature requirement (line 284) — a hunt-level file with no signature would pass. Add inline alternatives ([:space:][[:space:]]= and [:space:][[:space:]]=) mirroring the name/version handling.

✅ Quality: normalise_level whitespace trimming is fragile

📄 .githooks/validate-k9.sh:95-108
normalise_level trims whitespace with ${raw## }/${raw%% }, which each remove only a single leading/trailing space and do not handle tabs. A value with tab indentation or more than two surrounding spaces would retain whitespace, causing a valid level like hunt to compare unequal to the VALID_LEVELS entries and be flagged invalid (or fail the hunt check). Use a [[:space:]]-based trim (e.g. the extglob/parameter idiom already used for PATHS_IGNORE fragments at lines 41-42) for robustness.

✅ Edge Case: CRLF line endings break magic-number and field checks

📄 .githooks/validate-k9.sh:122-136 📄 .githooks/validate-a2ml.sh:102-116
Both validators read lines with IFS= read -r line and compare exactly (e.g. first_content_line != "K9!", SPDX/identity substring matches). A file saved with Windows CRLF endings would leave a trailing \r on each line, so K9!\r fails the exact magic-number match and quoted values retain a carriage return. Consider stripping trailing \r (e.g. line="${line%$'\r'}") after reading to avoid spurious validation errors on cross-platform checkouts.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}