Skip to content

Commit 812b769

Browse files
Merge branch 'main' into fix/dependabot-group-updates
2 parents 2b24593 + da60a2a commit 812b769

17 files changed

Lines changed: 258 additions & 84 deletions

.github/workflows/boj-build.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
timeout-minutes: 15
1111
steps:
1212
- name: Checkout
13-
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
13+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
1414
- name: Trigger BoJ Server (Casket/ssg-mcp)
1515
run: |
1616
# Send a secure trigger to boj-server to build this repository

.github/workflows/casket-pages.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,10 @@ jobs:
2121
timeout-minutes: 15
2222
steps:
2323
- name: Checkout
24-
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
24+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
2525

2626
- name: Checkout casket-ssg
27-
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
27+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
2828
with:
2929
repository: hyperpolymath/casket-ssg
3030
path: .casket-ssg

.github/workflows/codeql.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,15 +41,15 @@ jobs:
4141

4242
steps:
4343
- name: Checkout
44-
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
44+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
4545

4646
- name: Initialize CodeQL
47-
uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v3
47+
uses: github/codeql-action/init@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v3
4848
with:
4949
languages: ${{ matrix.language }}
5050
build-mode: ${{ matrix.build-mode }}
5151

5252
- name: Perform CodeQL Analysis
53-
uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v3
53+
uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v3
5454
with:
5555
category: "/language:${{ matrix.language }}"

.github/workflows/dogfood-gate.yml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626

2727
steps:
2828
- name: Checkout repository
29-
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
29+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3030

3131
- name: Check for A2ML files
3232
id: detect
@@ -39,7 +39,7 @@ jobs:
3939
4040
- name: Validate A2ML manifests
4141
if: steps.detect.outputs.count > 0
42-
uses: hyperpolymath/a2ml-validate-action@59145c7d1039fa3059b3ecacdb50ee23d7505898 # main
42+
uses: hyperpolymath/a2ml-validate-action@5468b7ff0f5129a74d25af5f2468df11a706dc70 # main
4343
with:
4444
path: '.'
4545
strict: 'false'
@@ -71,7 +71,7 @@ jobs:
7171

7272
steps:
7373
- name: Checkout repository
74-
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
74+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
7575

7676
- name: Check for K9 files
7777
id: detect
@@ -88,7 +88,7 @@ jobs:
8888
8989
- name: Validate K9 contracts
9090
if: steps.detect.outputs.k9_count > 0
91-
uses: hyperpolymath/k9-validate-action@2d96f43c538964b097d159ed3a56ba5b5ceca227 # main
91+
uses: hyperpolymath/k9-validate-action@08958c9bab64f9941a85938a78122a0d4a3058e8 # main
9292
with:
9393
path: '.'
9494
strict: 'false'
@@ -121,7 +121,7 @@ jobs:
121121

122122
steps:
123123
- name: Checkout repository
124-
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
124+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
125125

126126
- name: Scan for invisible characters
127127
id: lint
@@ -186,7 +186,7 @@ jobs:
186186

187187
steps:
188188
- name: Checkout repository
189-
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
189+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
190190

191191
- name: Check for Groove manifest
192192
id: groove
@@ -247,7 +247,7 @@ jobs:
247247

248248
steps:
249249
- name: Checkout repository
250-
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
250+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
251251

252252
- name: Generate dogfooding scorecard
253253
run: |

.github/workflows/pages.yml

100755100644
Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
3+
#
4+
# pages.yml — GitHub Pages deployment via Ddraig SSG.
15
name: GitHub Pages (Ddraig SSG)
26
on:
37
push:
@@ -18,9 +22,9 @@ jobs:
1822
image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
1923
steps:
2024
- name: Checkout Site
21-
uses: actions/checkout@v4
25+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
2226
- name: Checkout Ddraig SSG
23-
uses: actions/checkout@v4
27+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
2428
with:
2529
repository: hyperpolymath/ddraig-ssg
2630
path: .ddraig-ssg
@@ -37,7 +41,7 @@ jobs:
3741
fi
3842
./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/}
3943
- name: Upload artifact
40-
uses: actions/upload-pages-artifact@v3
44+
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
4145
with:
4246
path: '_site'
4347
deploy:
@@ -50,4 +54,4 @@ jobs:
5054
steps:
5155
- name: Deploy to GitHub Pages
5256
id: deployment
53-
uses: actions/deploy-pages@v4
57+
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/push-email-notify.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
runs-on: ubuntu-latest
1616
steps:
1717
- name: Send push notification email
18-
uses: dawidd6/action-send-mail@c50dc4cc848ade21f848990889906d804fae78c5 # pinned
18+
uses: dawidd6/action-send-mail@12335b969ae3fb71bee5f2c6b829744261aec34c # pinned
1919
with:
2020
server_address: ${{ secrets.SMTP_HOST }}
2121
server_port: ${{ secrets.SMTP_PORT }}

.github/workflows/rust-ci.yml

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
3+
#
4+
# rust-ci.yml — Build and test the Aletheia microkernel (Rust).
5+
#
6+
# WHY THIS LIVES AT THE REPOSITORY ROOT
7+
# ------------------------------------
8+
# `aletheia/` is vendored as plain tracked files, not a submodule. GitHub Actions
9+
# only reads workflows from `.github/workflows/` at the repository root, so the 16
10+
# workflow files under `aletheia/.github/workflows/` have never executed — see
11+
# `aletheia/.github/workflows/README.md`. Until this file landed, ~962 lines of Rust
12+
# had no build, test, or format gate of any kind, and `main` sat uncompilable for
13+
# over a month (broken 2026-06-17 by b5322c2, fixed in this change).
14+
#
15+
# SCOPE OF THIS GATE — read before trusting a green tick
16+
# -----------------------------------------------------
17+
# Gated here (all genuinely passing, all blocking):
18+
# * debug + release build
19+
# * the 26 unit tests
20+
# * `cargo fmt --check`
21+
#
22+
# NOT gated here, because they are genuinely red today and a passing-but-hollow
23+
# job is worse than no job:
24+
# * `tests/integration_tests.rs` — 27 of 29 fail; they exercise a CLI surface
25+
# (--help, --version, --format=, --badge, --html, --init-hook) that `src/main.rs`
26+
# does not implement.
27+
# * `cargo clippy -- -D warnings` — 25 findings, mostly dead code from modules
28+
# that `main.rs` never wires up.
29+
# Both are tracked as issues. Add them here as blocking jobs once they pass; do not
30+
# add them with `continue-on-error`.
31+
name: Rust CI
32+
33+
on:
34+
pull_request:
35+
branches: ['**']
36+
push:
37+
branches: [main, master]
38+
workflow_dispatch:
39+
40+
permissions:
41+
contents: read
42+
43+
concurrency:
44+
group: rust-ci-${{ github.ref }}
45+
cancel-in-progress: true
46+
47+
defaults:
48+
run:
49+
working-directory: aletheia
50+
51+
jobs:
52+
build:
53+
name: Build (debug + release)
54+
runs-on: ubuntu-latest
55+
timeout-minutes: 15
56+
steps:
57+
- name: Checkout repository
58+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
59+
with:
60+
submodules: false
61+
62+
- name: Show toolchain
63+
run: cargo --version && rustc --version
64+
65+
- name: Verify zero dependencies (RSR Bronze constraint)
66+
run: |
67+
if cargo tree --depth 1 | tail -n +2 | grep -q '[a-z]'; then
68+
echo "::error::Aletheia must have zero dependencies (see aletheia/CLAUDE.md)"
69+
cargo tree --depth 1
70+
exit 1
71+
fi
72+
echo "Zero dependencies confirmed"
73+
74+
- name: Build (debug)
75+
run: cargo build --locked --verbose
76+
77+
- name: Build (release)
78+
run: cargo build --locked --release --verbose
79+
80+
test:
81+
name: Unit tests
82+
runs-on: ubuntu-latest
83+
timeout-minutes: 15
84+
steps:
85+
- name: Checkout repository
86+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
87+
with:
88+
submodules: false
89+
90+
- name: Run unit tests
91+
run: cargo test --locked --bins --verbose
92+
93+
format:
94+
name: Formatting
95+
runs-on: ubuntu-latest
96+
timeout-minutes: 10
97+
steps:
98+
- name: Checkout repository
99+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
100+
with:
101+
submodules: false
102+
103+
- name: cargo fmt --check
104+
run: cargo fmt --all --check

.github/workflows/secret-scanner.yml

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,5 @@ jobs:
1717
scan:
1818
permissions:
1919
contents: read
20-
pull-requests: write
21-
actions: read
22-
uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
20+
uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586
2321
secrets: inherit

absolute-zero

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<!--
2+
SPDX-License-Identifier: CC-BY-SA-4.0
3+
SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
4+
-->
5+
6+
# These 16 workflows do not run. They never have.
7+
8+
GitHub Actions only reads workflow files from `.github/workflows/` **at the root of a
9+
repository**. This directory is nested inside `maa-framework`, so every YAML file here
10+
is inert — including `rust-ci.yml`, `codeql.yml`, `cflite_pr.yml`, `cflite_batch.yml`,
11+
`generator-generic-ossf-slsa3-publish.yml`, `scorecard.yml`, and `ghcr-publish.yml`.
12+
13+
## Why they are here
14+
15+
`aletheia` began as the standalone repository `hyperpolymath/aletheia` (created
16+
2025-12-11), where these workflows *did* run. That repository was removed from GitHub —
17+
its mirrors on GitLab, Codeberg and Bitbucket all stop by early January 2026. On
18+
2026-02-21, commit `639f389` left behind a dangling gitlink with no `.gitmodules`
19+
entry; on 2026-03-02, commit `25cf219` ("Fix stale submodule pointers after repo
20+
cleanup") replaced that pointer by vendoring 361 files — these workflows among them —
21+
into `maa-framework` as ordinary tracked files.
22+
23+
Nothing has executed them since.
24+
25+
## What that cost
26+
27+
Between 2026-06-17 and 2026-07-21, `aletheia` **did not compile**. Commit `b5322c2`
28+
("security: remediate Track C and Track E findings") correctly added a 1 MiB read cap
29+
to `Config::load_config`, but collapsed the block onto one line and dropped a closing
30+
brace. A single `cargo build` would have caught it. Nothing ran one, so `main` stayed
31+
broken for over a month.
32+
33+
## Where the real gate lives now
34+
35+
`/.github/workflows/rust-ci.yml`, at the repository root. It builds debug and release,
36+
runs the 26 unit tests, checks formatting, and enforces the zero-dependency constraint
37+
from `aletheia/CLAUDE.md`. Read its header comment for what it deliberately does *not*
38+
gate yet.
39+
40+
## If you are changing CI for aletheia
41+
42+
Edit the root workflow. Editing anything in this directory has no effect. These files
43+
are retained only as the source material for porting the capabilities that were lost —
44+
ClusterFuzzLite fuzzing, SLSA3 provenance, GHCR publishing — back to root workflows.
45+
Once a capability is ported, delete its file here so this directory shrinks toward
46+
empty.

0 commit comments

Comments
 (0)