fix(ci): repair e2e.yml Zig + Deno pins (baseline rot) by hyperpolymath · Pull Request #123 · hyperpolymath/boj-server

hyperpolymath · 2026-05-20T09:07:13Z

Summary

Restores three CI checks to green by repairing two unrelated upstream pin issues in .github/workflows/e2e.yml. All three had been red on main, gating every PR:

E2E — Full REST + MCP Bridge
E2E — Order Ticket (FFI layer)
Bench — FFI Catalogue + Mount/Unmount + Hash

Fixes

Zig 0.15.0 retired upstream. All three setup-zig steps failed on Error: Could not find version 0.15.0 for platform x86_64-linux. Bumped to 0.15.1 to match .tool-versions (the canonical estate declaration). release.yml runs 0.15.2 via mlugg/setup-zig; either point on the 0.15.x line is fine.
denoland/setup-deno SHA 5fae568d… no longer resolves. GitHub Actions: Unable to resolve action denoland/setup-deno@5fae568d37c3b73e0e4ca63d4e2c4e324a2b3497. Repointed to the same v2.0.4 SHA already in use by publish.yml (667a34cdef165d8d2b2e98dde39547c9daac7282), verified via the GitHub API.

Relationship to #118

Companion to #118 (tests/aspect_tests.sh grep-count fix). The two were originally one commit but workflow-file edits need the workflow OAuth scope to push, so they're split.

Out of scope (deliberately)

governance / Language / package anti-pattern policy is also red on main, but a parallel session is already diagnosing it under the Estate-drift-remediation 2026-05 campaign (parent standards#66). Not touched here per the parallel-session-branch-drift guardrail.

Test plan

CI on this PR: the three previously-red checks (E2E Full, E2E Order Ticket, Bench) come back green.
No new reds introduced by the Zig version bump.

🤖 Generated with Claude Code

`E2E — Full REST + MCP Bridge`, `E2E — Order Ticket (FFI layer)`, and `Bench — FFI Catalogue + Mount/Unmount + Hash` have been red on `main`, gating every PR. Two unrelated upstream issues, fixed together: 1. **Zig `0.15.0` retired upstream.** All three setup-zig steps were failing on `Error: Could not find version 0.15.0 for platform x86_64-linux`. Bumped to `0.15.1` to match `.tool-versions` (canonical estate declaration). `release.yml` runs `0.15.2` via `mlugg/setup-zig`; either point on the 0.15.x line is fine. 2. **`denoland/setup-deno` SHA `5fae568d…` no longer resolves.** GitHub Actions: `Unable to resolve action denoland/setup-deno@ 5fae568d37c3b73e0e4ca63d4e2c4e324a2b3497`. Repointed to the same v2.0.4 SHA already in use by `publish.yml` (`667a34cdef165d8d2b2e98dde39547c9daac7282`), verified via the GitHub API. Companion to PR #118 (`tests/aspect_tests.sh` grep-count fix) — the two were originally one commit but workflow files need the `workflow` OAuth scope to push, so they're split. Out of scope: - `governance / Language / package anti-pattern policy` — also red on main, but a parallel session is already diagnosing it under the Estate-drift-remediation 2026-05 campaign (parent standards#66). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions · 2026-05-20T09:08:07Z

🔍 Hypatia Security Scan

Findings: 30 issues detected

Severity	Count
🔴 Critical	18
🟠 High	5
🟡 Medium	7

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stale AI session file -- delete",
    "type": "stale",
    "file": "GEMINI.md",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/fireflag-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/ephapax-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

Both merged after PR #126 was opened. CHANGELOG.md `[Unreleased]` Fixed: - Added bullet for SafeAPIKey `logSafeBounded` rebuild (#116, MERGED 2026-05-20T08:46Z). - Added bullet for `tests/aspect_tests.sh` grep-count bash bug (#118, MERGED 2026-05-20T09:02Z). .machine_readable/6a2/STATE.a2ml session-history: - Updated the 2026-05-20 entry to mark #116 and #118 MERGED inline, rather than the stale OPEN/OPEN-DRAFT status they carried when the entry was written. #123 (e2e.yml Zig + Deno pin refresh) remains OPEN — listed in session-history with its current status. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions · 2026-05-20T09:17:45Z

🔍 Hypatia Security Scan

Findings: 30 issues detected

Severity	Count
🔴 Critical	18
🟠 High	5
🟡 Medium	7

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stale AI session file -- delete",
    "type": "stale",
    "file": "GEMINI.md",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/fireflag-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/ephapax-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

…eep (#126) ## Summary Human + machine documentation close-out for the 2026-05-20 epic #87 Tier C session and follow-on baseline-rot sweep. No code, no behavioural change. ## Files - **`CHANGELOG.md`** `[Unreleased]`: - *Added* — ADR-0014 RFC (#109); README "Formal verification" section (#108). - *Fixed* — SafeAPIKey `logSafeBounded` proof rebuild for Idris2 0.8.0 (#116); `tests/aspect_tests.sh` grep-count bash bug (#118); honest framing of the ABI axiom count + `(s t : T)` → `(s, t : T)` parser-comma fix to `SafetyLemmas.idr` (#108). - **`.machine_readable/6a2/STATE.a2ml`**: - `last-updated` bumped `2026-04-25` → `2026-05-20`. - `believe-me-count` corrected `4` → `5`, with citation back to `PROOF-NEEDS.md` 2026-05-18 audit + #108. - `[session-history]` entry appended summarising items 11 + 12 + the SafeAPIKey baseline-rot follow-up + the CI baseline-rot sweep + operational notes (parallel-session branch drift, workflow OAuth scope dance). ## Companion PRs from this thread | PR | Status | What | |---|---|---| | #108 | MERGED 2026-05-20T08:13Z | item 11 honest framing (docstring + README + parser-comma) | | #109 | MERGED 2026-05-20T08:12Z | item 12 ADR-0014 RFC (cross-cartridge composition safety) | | #116 | MERGED 2026-05-20T08:46Z | SafeAPIKey `logSafeBounded` rebuild for Idris2 0.8.0 | | #118 | MERGED 2026-05-20T09:02Z | `tests/aspect_tests.sh` grep-count bash bug | | #123 | OPEN | `.github/workflows/e2e.yml` Zig + Deno pin refresh | | **#126 (this)** | OPEN | session-close docs | ## Out of scope (intentionally) - `governance / Language / package anti-pattern policy` baseline rot stays untouched per the parallel-session-branch-drift guardrail (parent campaign standards#66 owns it). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

hyperpolymath mentioned this pull request May 20, 2026

docs(state): close-out 2026-05-20 — epic #87 Tier C + baseline-rot sweep #126

Merged

Merge branch 'main' into fix/e2e-workflow-zig-deno-pins

1786ce5

hyperpolymath enabled auto-merge (squash) May 20, 2026 09:19

hyperpolymath disabled auto-merge May 20, 2026 09:20

hyperpolymath merged commit 1b9fb60 into main May 20, 2026
19 checks passed

hyperpolymath deleted the fix/e2e-workflow-zig-deno-pins branch May 20, 2026 09:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(ci): repair e2e.yml Zig + Deno pins (baseline rot)#123

fix(ci): repair e2e.yml Zig + Deno pins (baseline rot)#123
hyperpolymath merged 2 commits into
mainfrom
fix/e2e-workflow-zig-deno-pins

hyperpolymath commented May 20, 2026

Uh oh!

github-actions Bot commented May 20, 2026

Uh oh!

github-actions Bot commented May 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hyperpolymath commented May 20, 2026

Summary

Fixes

Relationship to #118

Out of scope (deliberately)

Test plan

Uh oh!

github-actions Bot commented May 20, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented May 20, 2026

🔍 Hypatia Security Scan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant