fix(guix): restore blocky-writer identity in guix.scm - #29
Conversation
guix.scm declared (name \"squisher-corpus\") - the squisher clobber, which copied one package definition into many repos carrying the wrong project's identity. Measured across all 418 estate repos: 45 affected. Fixes IDENTITY ONLY: name, synopsis, description, home-page, header comment. The (license ...) form is deliberately untouched - the licence drift (58 repos asserting PMPL) is a separate owner decision. Verified byte-identical. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
🔍 Hypatia Security ScanFindings: 51 issues detected
View findings[
{
"reason": "Issue in scorecard.yml",
"type": "missing_workflow",
"file": "scorecard.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in ci.yml",
"type": "npermissions_typo",
"file": "ci.yml",
"action": "fix_typo",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
"type": "codeql_language_matrix_mismatch",
"file": "codeql.yml",
"action": "switch_codeql_matrix_to_actions",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in boj-build.yml",
"type": "missing_timeout_minutes",
"file": "boj-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in ci.yml",
"type": "missing_timeout_minutes",
"file": "ci.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in codeql.yml",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in hypatia-scan.yml",
"type": "missing_timeout_minutes",
"file": "hypatia-scan.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in instant-sync.yml",
"type": "missing_timeout_minutes",
"file": "instant-sync.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedRestores the blocky-writer name, synopsis, description, home-page, and header comment in guix.scm, reverting the squisher-corpus identity clobber. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
|
|
guix.scmdeclared(name "squisher-corpus")— the squisher clobber. Measured across all 418 estate repos: 45 affected.Fixes identity only — name, synopsis, description, home-page, header comment.
The
(license ...)form is deliberately untouched; the licence drift (58 repos asserting PMPL) is a separate owner decision. Verified byte-identical before and after.🤖 Generated with Claude Code