fix(ci): repoint the deleted validate-actions at the live ecosystem repos

[hyperpolymath]

hyperpolymath/a2ml-validate-action and k9-validate-action are deleted (verified 404). An unresolvable uses: ref produces no check run at all — not a red one — so Validate A2ML manifests and Validate K9 contracts could never report, and any ruleset requiring them was unsatisfiable. The repo looked green while the check had simply never run.

The actions moved: a2ml-ecosystem/validate-action and k9-ecosystem/validate-action. Repointed rather than vendored — vendoring would create one drifting copy per repo.

Measured scope: 69 repos, 135 references. SHAs are those already proven green in the-nash-equilibrium#83.

Verified: no dead refs remain; every touched workflow still parses.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved 1 resolved / 1 findings

Repoints deleted GitHub action references to live ecosystem repositories. Blocked due to mismatched new owner references that may still be unresolvable.

✅ 1 resolved

✅ Bug: New uses: refs contradict PR description; may still be unresolvable

📄 .github/workflows/dogfood-gate.yml:41 📄 .github/workflows/dogfood-gate.yml:89
The PR description states the actions moved to a2ml-ecosystem/validate-action and k9-ecosystem/validate-action (owner=a2ml-ecosystem/k9-ecosystem, repo=validate-action). But the diff points at hyperpolymath/a2ml-ecosystem/validate-action@... and hyperpolymath/k9-ecosystem/validate-action@..., which GitHub parses as owner=hyperpolymath, repo=a2ml-ecosystem/k9-ecosystem, subdirectory=validate-action. These are entirely different locations. If the description is correct, the committed refs are wrong — and per the PR's own premise an unresolvable uses: produces no check run at all, leaving the gate silently green (the very bug being fixed). Confirm which form actually resolves: verify that hyperpolymath/a2ml-ecosystem and hyperpolymath/k9-ecosystem repos exist, contain a validate-action/action.yml, and that the pinned SHAs (aa4b836..., 89f3c27...) are reachable on those repos. If the target is a standalone repo, the ref should be a2ml-ecosystem/validate-action@<sha> instead.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[github-actions]

🔍 Hypatia Security Scan

Findings: 73 issues detected

Severity	Count
🔴 Critical	1
🟠 High	29
🟡 Medium	43

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
    "type": "codeql_language_matrix_mismatch",
    "file": "codeql.yml",
    "action": "switch_codeql_matrix_to_actions",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence