fix(ci): close 7 real code-scanning alerts (canary for estate sweep) - #17
Merged
Merged
Conversation
Adds the three missing standards reusables, pins the unpinned one, adds a CodeQL workflow scoped to GitHub Actions (the repo's only analyzable surface), and removes the stale root-level STATE.a2ml. Alerts closed: #2 workflow_audit/missing_workflow scorecard.yml #4 workflow_audit/missing_workflow mirror.yml #6 workflow_audit/missing_workflow secret-scanner.yml #7 workflow_audit/unpinned_action governance.yml @main -> @4285741 #8 cicd_rules/missing_requirement scorecard.yml (same root as #2) #10 scorecard/StaticAnalysis add codeql.yml language: actions #12 structural_drift/SD004 remove root .machine_readable/STATE.a2ml (canonical at .machine_readable/6a2/STATE.a2ml) Not addressed here: #11 git_state/GS007 non-main branch `feat/register-echotypes-krladapter` is the head of in-flight PR #16; will auto-resolve when that PR merges or closes. The 17 CSA001/CSA002/CSA003 self-referential alerts on this repo were dismissed as `won't fix` against hyperpolymath/hypatia#368, which suppresses the meta-rule lens at the SARIF render layer to stop the self-echo at source. All four wrapper workflows are pinned to standards/main HEAD SHA 4285741 (2026-05-27). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
hyperpolymath
enabled auto-merge (squash)
May 27, 2026 18:03
hyperpolymath
disabled auto-merge
May 27, 2026 18:37
3 tasks
hyperpolymath
added a commit
that referenced
this pull request
May 27, 2026
…block PR #17 added scorecard.yml using `permissions: read-all` at workflow level only. The reusable's docstring explicitly states that called-workflow permissions are CAPPED by the caller's block, and that the analysis job needs `security-events: write` + `id-token: write`. Run 26531477593 on main confirms: startup_failure on every push. The same template is in absolute-zero's scorecard.yml and is also startup_failure (3 runs in a row at 12:16, 11:31, 10:47 UTC today), so the bug is estate-wide and should also be fixed at source in standards/scorecard.yml + the canonical caller example. This commit fixes jpr only. Estate-wide fan-out is a follow-up. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
May 27, 2026
…ubstantial wiki (#19) * docs: bring repo to estate documentation + contributor convention Phase 1 — top-level docs: + CHANGELOG.md (Keep-a-Changelog format, points at standards changelog-reusable.yml) + ROADMAP.adoc (vision, near/medium/long term, non-goals, tracking) + MAINTAINERS.adoc (lead, responsibilities, becoming-a-maintainer hook) + GOVERNANCE.adoc (BDFL model, decisions, roles, transition clause) - CONTRIBUTING.adoc (was duplicate of .md in two formats) ~ CONTRIBUTING.md (corrected nix -> guix per standards#101; added Registering a Package section) Phase 2 — .github template fleet: + .github/CODEOWNERS (default + per-area ownership) + .github/FUNDING.yml (github: hyperpolymath) + .github/pull_request_template.md (RSR checklist, registry-specific section) + .github/copilot-instructions.md (estate banned-languages + registry shape) + .github/ISSUE_TEMPLATE/bug_report.md (registry-tailored, Pkg-aware repro) + .github/ISSUE_TEMPLATE/feature_request.md (with estate-alignment field) + .github/ISSUE_TEMPLATE/package_registration.md (new — registration is the most common kind of issue here; quality-bar checklist mirrors GOVERNANCE.adoc) All new files carry SPDX PMPL-1.0-or-later headers consistent with existing repo content. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(ci): scorecard.yml caller permissions match reusable's canonical block PR #17 added scorecard.yml using `permissions: read-all` at workflow level only. The reusable's docstring explicitly states that called-workflow permissions are CAPPED by the caller's block, and that the analysis job needs `security-events: write` + `id-token: write`. Run 26531477593 on main confirms: startup_failure on every push. The same template is in absolute-zero's scorecard.yml and is also startup_failure (3 runs in a row at 12:16, 11:31, 10:47 UTC today), so the bug is estate-wide and should also be fixed at source in standards/scorecard.yml + the canonical caller example. This commit fixes jpr only. Estate-wide fan-out is a follow-up. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the seven actionable code-scanning alerts on this repo. The other 17 alerts were CSA001/CSA002/CSA003 self-referential output from Hypatia's meta-rules — those have been dismissed as won't-fix against hyperpolymath/hypatia#368, which suppresses them at the SARIF render layer to stop the self-echo at source.
workflow_audit/missing_workflowscorecard.yml.github/workflows/scorecard.ymlwrapperworkflow_audit/missing_workflowmirror.yml.github/workflows/mirror.ymlwrapperworkflow_audit/missing_workflowsecret-scanner.yml.github/workflows/secret-scanner.ymlwrapperworkflow_audit/unpinned_actiongovernance.ymlgovernance-reusable.yml@main→@4285741cicd_rules/missing_requirement.github/workflows/scorecard.ymlscorecard/StaticAnalysis.github/workflows/codeql.ymlwithlanguage: actions(the repo's only analyzable surface — registry data is TOML, build surface is the workflows themselves)structural_drift/SD004.machine_readable/STATE.a2ml.machine_readable/6a2/STATE.a2ml)Not addressed here
Alert #11 (git_state/GS007, non-main branch) — the offending branch is
feat/register-echotypes-krladapter, head of open PR #16 (updated 2026-05-27). It will resolve when PR #16 merges or closes. Suppressing the alert manually would be wrong while the PR is live.Pinning
All four wrapper workflows are pinned to standards/main HEAD SHA
42857410898a9f0e3ecae8778cb2c65f7975a260(2026-05-27). Thegovernance.ymlpin moves from@mainto the same SHA.Why this matters
This is the canary repo for an estate-wide sweep. The 2026-05-27 audit (hyperpolymath/hypatia#368 PR body) found 11,785 real open alerts across 325 repos behind 7,724 self-referential noise alerts; closing this one to zero proves the template for the rest.
Test plan
🤖 Generated with Claude Code