fix(ci): close the three gaps left on main by #55 and #56#57
Merged
Conversation
#55 and #56 were merged before their final commits landed, so three fixes that were verified on those branches are not on main. One of them is a regression main did not have before #56. 1. Hypatia is startup_failure on main — REGRESSION from #56 #56 refreshed hypatia-scan-reusable.yml to standards HEAD. The newer reusable declares `security-events: write` (it uploads SARIF); the caller still grants `security-events: read`. A called workflow cannot escalate beyond its caller's grant, so GitHub rejects the run at parse time: zero jobs, no log. Caller now grants write. Confirmed by A/B on the tangle branch, which carries the identical change: 558f631 (old pin, read) -> Hypatia success 2369299 (new pin, read) -> Hypatia startup_failure d090ff2 (new pin, write) -> Hypatia success Note for future sweeps: `gh pr checks` does NOT list startup_failure among its `fail` rows, so a PR can read "0 fail" while a workflow never started. Use `gh run list --json conclusion` to see it. 2. Dogfood Gate still fails — k9-validate-action pin container/deploy.k9.ncl uses the canonical single-line pedigree form `pedigree = component_pedigree & { name = "krl-deploy" },`, which the pinned validator (2d96f43) cannot parse; support was added upstream after that pin. Same stale-pin trap as the a2ml bump in #55. Bumped to 08958c9. 3. Governance still fails — unpinned actions in pages.yml #56 fixed the SPDX half of the Workflow security linter, which then reported its next rule: `ERROR: Found unpinned actions`. pages.yml used floating tags where every other workflow pins by SHA: actions/checkout@v4 -> de0fac2e... # v6.0.2 actions/upload-pages-artifact@v3 -> 56afc609... # v3 actions/deploy-pages@v4 -> d6db9016... # v4 Same majors, so pinning only, not behaviour. Verified on this branch: K9 0 errors, A2ML 0 errors, actionlint 0, all 18 workflows carry SPDX, no unpinned third-party actions. Remaining reds after this lands are not fixable in-repo: * GitHub Pages deploy — Pages is not enabled (/repos/hyperpolymath/krl/pages returns 404). Owner action; the build itself passes and certifies a11y. * Instant Sync — deliberately frozen.
|
hyperpolymath
added a commit
that referenced
this pull request
Jul 21, 2026
…ode) (#58) `main` is green as of #57. This addresses the one original red that had gone unexamined all programme: **SonarCloud Quality Gate — `C Security Rating on New Code` (required ≥ A)**. ## Getting the findings without dashboard access SonarCloud's project is public, so its API lists them directly: ``` https://sonarcloud.io/api/issues/search?componentKeys=hyperpolymath_krl&types=VULNERABILITY ``` **15 vulnerabilities, all inside the new-code period.** Two are fixed here — including one this programme introduced. ## Fixed ### `e2e.yml` — *"Replace `read-all` with specific permissions"* **This one is mine.** `e2e.yml` was rewritten in #53 and carried the RSR template's `permissions: read-all`. Narrowed to `contents: read`, which is all four jobs need. ### `pages.yml` ×3 — *"Move this read/write permission from workflow level to job level"* The workflow granted `contents:read` + `pages:write` + `id-token:write` to **both** jobs, but only `deploy` needs the pages and id-token scopes. Now split per job: | Job | Permissions | |---|---| | `build` | `contents: read` | | `deploy` | `contents: read`, `pages: write`, `id-token: write` | That matters here beyond satisfying the linter: the `build` job runs a **container image** and executes the SSG over repository content. It should not be holding deploy credentials while doing so. ## Not fixed — deliberately, so this stays reviewable | Finding | Location | |---|---| | Only pass required secrets to this workflow | `secret-scanner.yml:18`, `mirror.yml:12` | | Dependencies without locked resolved versions | `release.yml:38` | | Not enforcing HTTPS | `release.yml:91`, `static-analysis-gate.yml:30,31,229,230`, `setup.sh:144,156` | | Workflow-level permission | `static-analysis-gate.yml:11` | **The rating will not reach A until those are triaged too.** Several of the HTTPS findings may be false positives and need reading in context before anything is changed — which is exactly why they aren't bundled into a PR about permissions. ## Verified `actionlint` **0** · K9 **0 errors** · A2ML **0 errors** · e2e 4/4 · aspect 4/4 · smoke 20/20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#55 and #56 were merged before their final commits landed, so three fixes verified on those branches are not on
main. One is a regressionmaindid not have before #56 — please treat this as the follow-up that finishes them.1. Hypatia is
startup_failureon main — regression from #56#56 refreshed
hypatia-scan-reusable.ymlto standards HEAD. The newer reusable declaressecurity-events: **write**(it uploads SARIF); the caller still grantssecurity-events: **read**. A called workflow cannot escalate beyond its caller's grant, so GitHub rejects the run at parse time — zero jobs, no log.Confirmed by a clean A/B on the tangle branch, which carries the identical change:
558f631read2369299readd090ff2write2. Dogfood Gate still fails —
k9-validate-actionpincontainer/deploy.k9.ncluses the canonical single-line pedigree form:The pinned validator (
2d96f43) cannot parse it — single-line support was added upstream after that pin. Exactly the same stale-pin trap as thea2ml-validate-actionbump in #55, where the file was correct and the validator was too old to see it. Bumped to08958c9.3. Governance still fails — unpinned actions in
pages.yml#56 fixed the SPDX half of the Workflow security linter, which then reported its next rule:
pages.ymlused floating tags where every other workflow pins by SHA:actions/checkout@v4de0fac2e…# v6.0.2actions/upload-pages-artifact@v356afc609…# v3actions/deploy-pages@v4d6db9016…# v4Same major versions — pinning only, not behaviour.
Verified on this branch
actionlintTwo reds will remain, and neither is fixable in-repo
/repos/hyperpolymath/krl/pagesreturns404, surfacing asHttpError: Not Found. The build itself passes and certifies a11y. Owner action (also true ofhyperpolymath/tangle).Opened ready-for-review rather than draft, since it repairs a live regression on
main.