Skip to content

ci: vendor validation scripts and remove remote action pins - #64

Merged
hyperpolymath merged 1 commit into
mainfrom
fix-ci-actions
Jul 27, 2026
Merged

ci: vendor validation scripts and remove remote action pins#64
hyperpolymath merged 1 commit into
mainfrom
fix-ci-actions

Conversation

@hyperpolymath

@hyperpolymath hyperpolymath commented Jul 27, 2026

Copy link
Copy Markdown
Owner

Automated PR to fix CI after deleted actions.

gitar-bot[bot]
gitar-bot Bot reviewed Jul 27, 2026
View reviewed changes
Comment thread .githooks/validate-k9.sh
gitar-bot[bot]
gitar-bot Bot reviewed Jul 27, 2026
View reviewed changes
Comment thread .githooks/validate-k9.sh
gitar-bot[bot]
gitar-bot Bot reviewed Jul 27, 2026
View reviewed changes
Comment thread .githooks/validate-k9.sh
@gitar-bot

gitar-bot Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
CI failed: CI failed due to a CodeQL error from missing or invalid JavaScript/TypeScript source files and a governance check rejection of banned ReScript (.res) files.

Overview

Two distinct failures occurred during the CI run: a CodeQL analysis failure due to missing or invalid JavaScript/TypeScript files, and a governance check failure detecting banned ReScript files.

Failures

CodeQL Analysis Failure (confidence: high)

  • Type: configuration
  • Affected jobs: 90125564883
  • Related to change: unclear
  • Root cause: CodeQL found only empty or syntactically invalid JavaScript/TypeScript files in the repository during extraction, leading to exit code 32.
  • Suggested fix: Ensure the repository contains valid JavaScript/TypeScript files if scanning is required, or remove javascript-typescript from the CodeQL language matrix.

Governance Check: Banned Language Files (confidence: high)

  • Type: tooling
  • Affected jobs: 90125566185
  • Related to change: unclear
  • Root cause: The hypatia governance check (cicd_rules/banned_language_file) detected ReScript (.res) files (e.g., under visualization/src/transforms/), which are prohibited by project standards in favor of AffineScript.
  • Suggested fix: Migrate the ReScript files to AffineScript, or add a # hypatia:ignore cicd_rules/banned_language_file pragma / .hypatia-ignore entry if intentional.

Summary

  • Change-related failures: 0 explicit code bugs, but 2 workflow/governance check failures related to code structure and policy.
  • Infrastructure/flaky failures: None.
  • Recommended action: Address the governance violation by removing or migrating the banned ReScript files (or adding exemptions), and review the CodeQL language matrix configuration for JavaScript/TypeScript.
Code Review ✅ Approved 3 resolved / 3 findings

Vendors validation scripts and removes remote action pins, but introduces a single-line pedigree bypass in K9 along with fragile whitespace trimming and CRLF line ending vulnerabilities.

✅ 3 resolved
✅ Security: Single-line pedigree bypasses hunt signature enforcement in K9

📄 .githooks/validate-k9.sh:224-233 📄 .githooks/validate-k9.sh:284-287 📄 .githooks/validate-k9.sh:212-221
The name and version checks were given an extra inline regex ([:space:]=) to handle single-line pedigrees such as pedigree = base & { leash = "hunt" }, but the leash/security_level check (line 224) and the in-pedigree signature check (line 231) only have the anchored ^[[:space:]]+... form. On a single-line pedigree the line starts with pedigree, so neither leash nor signature is ever matched: has_security_level stays false and security_level_value stays empty. This silently skips both the security-level validity check and the mandatory Check 5 hunt-level signature requirement (line 284) — a hunt-level file with no signature would pass. Add inline alternatives ([:space:][[:space:]]= and [:space:][[:space:]]=) mirroring the name/version handling.

✅ Quality: normalise_level whitespace trimming is fragile

📄 .githooks/validate-k9.sh:95-108
normalise_level trims whitespace with ${raw## }/${raw%% }, which each remove only a single leading/trailing space and do not handle tabs. A value with tab indentation or more than two surrounding spaces would retain whitespace, causing a valid level like hunt to compare unequal to the VALID_LEVELS entries and be flagged invalid (or fail the hunt check). Use a [[:space:]]-based trim (e.g. the extglob/parameter idiom already used for PATHS_IGNORE fragments at lines 41-42) for robustness.

✅ Edge Case: CRLF line endings break magic-number and field checks

📄 .githooks/validate-k9.sh:122-136 📄 .githooks/validate-a2ml.sh:102-116
Both validators read lines with IFS= read -r line and compare exactly (e.g. first_content_line != "K9!", SPDX/identity substring matches). A file saved with Windows CRLF endings would leave a trailing \r on each line, so K9!\r fails the exact magic-number match and quoted values retain a carriage return. Consider stripping trailing \r (e.g. line="${line%$'\r'}") after reading to avoid spurious validation errors on cross-platform checkouts.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply Compact 
gitar auto-apply:on         

gitar display:verbose

Was this helpful? React with 👍 / 👎 | Gitar

@hyperpolymath
hyperpolymath merged commit be40101 into main Jul 27, 2026
23 of 25 checks passed
@hyperpolymath
hyperpolymath deleted the fix-ci-actions branch July 27, 2026 22:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gitar-bot gitar-bot[bot] gitar-bot[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath