fix(governance): add SPDX header to pages.yml, refresh three stale standards pins#56
Merged
Conversation
…andards pins Both failing Governance jobs are root-caused and fixed. Workflow security linter The failure was `.github/workflows/pages.yml missing SPDX header`. pages.yml arrived in #51 and begins directly at `name:`. Every other workflow in the repo already carries the header; this was the only one. Added. Recording a correction: an earlier audit in this programme reported that every workflow already had both an SPDX header and a top-level `permissions:` block, and the hypothesis that SPDX was the cause was marked disproved. That audit was wrong. The real cause is exactly the one first suspected. Check Workflow Staleness Three callers pinned standards reusables at d7c22711e830, which the gate measured as 63 commits / 24 days behind standards HEAD — outside its recency window of >50 commits AND >14 days: * governance-reusable.yml * hypatia-scan-reusable.yml * scorecard-reusable.yml All three refreshed to f9dca6ded2cad8ab54044c1cb0489b558ae2682b (full 40-char SHA; the gate's message quotes the abbreviated form). Deliberately NOT touched: * mirror-reusable.yml (d135b05) and secret-scanner-reusable.yml (c65436e) — neither was flagged by the staleness gate, and the secret-scanner pin in particular should not be moved independently of the gitleaks allowlist work. * scorecard-enforcer.yml — the gate's message asks for its removal, but this repository does not have that file. That clause is generic advice, not a finding against this repo. Verified: actionlint 0 errors; all 18 workflows carry an SPDX header.
hyperpolymath
marked this pull request as ready for review
July 21, 2026 15:09
|
hyperpolymath
added a commit
that referenced
this pull request
Jul 21, 2026
#55 and #56 were merged **before their final commits landed**, so three fixes verified on those branches are not on `main`. One is a **regression `main` did not have before #56** — please treat this as the follow-up that finishes them. ## 1. Hypatia is `startup_failure` on main — regression from #56 #56 refreshed `hypatia-scan-reusable.yml` to standards HEAD. The newer reusable declares `security-events: **write**` (it uploads SARIF); the caller still grants `security-events: **read**`. A called workflow **cannot escalate beyond its caller's grant**, so GitHub rejects the run at parse time — zero jobs, no log. Confirmed by a clean A/B on the tangle branch, which carries the identical change: | tangle commit | pin | caller perm | Hypatia | |---|---|---|---| | `558f631` | old | `read` | **success** | | `2369299` | new | `read` | **startup_failure** | | `d090ff2` | new | `write` | **success** | > **Worth knowing for future sweeps:** `gh pr checks` does **not** list `startup_failure` among its `fail` rows. A PR can read *"0 fail"* while a workflow never started. Use `gh run list --json conclusion` to see it. This is how the regression slipped past my own green check. ## 2. Dogfood Gate still fails — `k9-validate-action` pin `container/deploy.k9.ncl` uses the canonical single-line pedigree form: ```nickel pedigree = component_pedigree & { name = "krl-deploy" }, ``` The pinned validator (`2d96f43`) cannot parse it — single-line support was added upstream *after* that pin. Exactly the same stale-pin trap as the `a2ml-validate-action` bump in #55, where the file was correct and the validator was too old to see it. Bumped to `08958c9`. ## 3. Governance still fails — unpinned actions in `pages.yml` #56 fixed the SPDX half of the Workflow security linter, which then reported its **next** rule: ``` ERROR: Found unpinned actions: ``` `pages.yml` used floating tags where every other workflow pins by SHA: | Action | From | To | |---|---|---| | `actions/checkout` | `@v4` | `de0fac2e…` `# v6.0.2` | | `actions/upload-pages-artifact` | `@v3` | `56afc609…` `# v3` | | `actions/deploy-pages` | `@v4` | `d6db9016…` `# v4` | Same major versions — pinning only, not behaviour. ## Verified on this branch | Check | Result | |---|---| | K9 validator | **0 errors** | | A2ML validator | **0 errors** (121 files) | | `actionlint` | **0 errors** | | SPDX headers | all 18 workflows | | Unpinned third-party actions | **0** | ## Two reds will remain, and neither is fixable in-repo - **GitHub Pages deploy** — Pages is **not enabled**: `/repos/hyperpolymath/krl/pages` returns `404`, surfacing as `HttpError: Not Found`. The build itself passes and certifies a11y. **Owner action** (also true of `hyperpolymath/tangle`). - **Instant Sync** — deliberately frozen. Opened ready-for-review rather than draft, since it repairs a live regression on `main`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Both failing Governance jobs are root-caused and fixed. Follows #53, #54, #55.
Workflow security linterpages.ymlarrived in #51 and begins directly atname:. Every other workflow already carries the header; this was the only one.Check Workflow StalenessThree callers were pinned at
d7c22711e830:governance-reusable.ymld7c22711e830…f9dca6ded2cad8ab54044c1cb0489b558ae2682bhypatia-scan-reusable.ymld7c22711e830…f9dca6ded2cad8ab54044c1cb0489b558ae2682bscorecard-reusable.ymld7c22711e830…f9dca6ded2cad8ab54044c1cb0489b558ae2682bFull 40-char SHAs — the gate's message quotes the abbreviated form, which would weaken the pin.
Deliberately not touched
mirror-reusable.yml(d135b05) andsecret-scanner-reusable.yml(c65436e) — neither was flagged by the staleness gate, and the secret-scanner pin in particular should not be moved independently of the gitleaks allowlist work, since re-pinning consumers ahead of the config work reintroduces false positives.scorecard-enforcer.yml— the gate asks for its removal, but this repo doesn't have that file. That clause is generic advice in the reusable's message, not a finding against krl.Note on bumping toward standards HEAD
The newer
governance-reusablehas more real checks than the pinned one (its previously-dead docs and Guix/Nix jobs were made real, warn-first until 2026-08-21). So this bump may surface new warnings. That is the gate working, and warn-first means it should not turn the build red.Verified
actionlint0 errors · all 18 workflows carry an SPDX header