ci: vendor validation scripts and remove remote action pins

[hyperpolymath]

Automated PR to fix CI after deleted actions.

[gitar-bot]

CI failed: CI failures across 3 jobs caused by a missing Julia test file and undefined Base variable, a Gitleaks shallow-checkout revision resolution error, and a K9 contract validation error due to a missing pedigree name.

Overview

Multiple distinct CI failures occurred across jobs: a Julia package compilation and test failure, a Gitleaks security scan failure due to shallow git history, and a K9 contract validation error due to a missing pedigree field.

Failures

Julia Package Precompilation and Test Failure (confidence: high)

• Type: build
• Affected jobs: 90125414106
• Related to change: unclear
• Root cause: normalize is not defined in Base in the current Julia version, causing a precompilation error in src/julia/RobotVacuum/src/types.jl, and Pkg.test() failed because test/runtests.jl is missing.
• Suggested fix: Properly qualify or import normalize (e.g. LinearAlgebra.normalize) and add a test/runtests.jl file.

Gitleaks Revision Resolution Error (confidence: high)

• Type: tooling
• Affected jobs: 90125414086
• Related to change: yes
• Root cause: Gitleaks failed because the commit range check specified a specific commit hash (^..<SHA>) in a shallow checkout where the revision was unavailable.
• Suggested fix: Configure actions/checkout with fetch-depth: 0 or adjust the gitleaks invocation range.

K9 Contract Validation Failure (confidence: high)

• Type: test
• Affected jobs: 90125414190
• Related to change: yes
• Root cause: The K9 validation script failed because a pedigree block is missing the required name field (pedigree.metadata.name or pedigree.name).
• Suggested fix: Add the missing name field to the pedigree block in the affected contract files.

Summary

• Change-related failures: 2 (Gitleaks checkout configuration and K9 contract validation error)
• Infrastructure/flaky failures: 0
• Recommended action: Update the checkout action fetch depth, fix the K9 contract pedigree metadata, and correct the Julia package's imports and test runner file.

Code Review ✅ Approved 3 resolved / 3 findings

Vendors validation scripts and removes remote action pins to fix CI stability. Consider addressing the minor CRLF line ending, read loop, and space normalization findings to ensure robust script execution.

Auto-approved: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria.

✅ 3 resolved

✅ Edge Case: K9 magic-number check breaks on CRLF line endings

📄 .githooks/validate-k9.sh:122-136
The magic-number check compares the first non-empty line for exact equality with 'K9!'. If a K9 file uses CRLF line endings, read leaves a trailing carriage return so first_content_line is 'K9!\r', which fails the != "K9!" test and reports a false 'Missing K9! magic number' error. Strip the CR (e.g. line="${line%$'\r'}") inside the read loops, or compare with a pattern that tolerates trailing whitespace.

✅ Edge Case: read loops silently ignore a final line with no trailing newline

📄 .githooks/validate-k9.sh:122-131 📄 .githooks/validate-k9.sh:141-150 📄 .githooks/validate-k9.sh:169-183 📄 .githooks/validate-a2ml.sh:102-111 📄 .githooks/validate-a2ml.sh:128-142 📄 .githooks/validate-a2ml.sh:239-253 📄 .githooks/validate-a2ml.sh:270-280
All validation loops use while IFS= read -r line; do ... done < "$file". read returns non-zero on the last line if the file lacks a trailing newline, so that final line's body is never processed. A pedigree field, security level, or SPDX header that sits on an un-terminated last line would be missed, producing false 'missing field' errors. Guard the loop with || [[ -n "$line" ]] so the trailing partial line is still handled.

✅ Edge Case: normalise_level trims only a single leading/trailing space

📄 .githooks/validate-k9.sh:95-108
In normalise_level, ${raw## } and ${raw%% } each strip only one space character, and comment removal (%%#*) runs after the trailing-space trim. A value such as leash = "hunt" # note normalises to hunt (residual spaces) and fails the == "hunt" comparison, wrongly reporting an invalid security level. Use a whitespace-class trim after all substitutions, e.g. raw="${raw%%#*}" then [[ $raw =~ ^[[:space:]]*([^[:space:]]+) ]] && raw="${BASH_REMATCH[1]}".

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Gitar has auto-approved this PR (configure)