fix(ci): reconcile scorecard.yml with governance staleness (stop SARIF→Code Scanning)#162
Merged
Merged
Conversation
The Scorecard workflow adopted in #159 ran Scorecard in SARIF mode and pushed the SARIF into GitHub Code Scanning, but only fired on push(main)/schedule — not per-PR-head. The standards governance staleness gate forbids exactly that: ::error:: OSSF Scorecard must not upload SARIF to GitHub Code Scanning unless it runs for every PR head commit. so governance stayed red on every PR (incl. #154/#161). Reconcile by delegating to the canonical standards `scorecard-reusable.yml@7c9db0e` — it runs Scorecard in JSON mode with `publish_results` and uploads an artifact, and does NOT push a SARIF into Code Scanning. This is the canonical behaviour #159's title intended, and it satisfies the gate ("All workflow staleness checks passed" locally). Also harden must-check.sh: portable `[[:space:]]` instead of the GNU-only `\s`, and quote `exit "$fail"`. Verified: check-workflow-staleness.sh passes; scorecard.yml YAML valid; must-check exit 0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh
|
hyperpolymath
marked this pull request as ready for review
July 1, 2026 12:53
hyperpolymath
added a commit
that referenced
this pull request
Jul 1, 2026
…gfault (#163) ## Summary Fixes the **recurring `rust-ci / Coverage (tarpaulin + codecov)` red** (failed on #161, #162, …) with a **locally-verified** repo-side change. **Root cause:** the standards rust-ci reusable runs `cargo tarpaulin --out Xml` with the default **ptrace** engine, which **segfaults** on the CI runners while instrumenting the property-test binary (`"Failed to run tests: A segfault occurred while executing tests"`). It's a tarpaulin instrumentation flake — the suite passes under `cargo test`, and the ptrace engine doesn't even reproduce the segfault locally. **Fix:** `tarpaulin.toml` selecting the **LLVM (source-based) engine**, which avoids ptrace entirely. The reusable's `cargo tarpaulin --out Xml` reads this `[default]` profile, so **no standards-reusable change is needed**. **Verified locally** (I installed tarpaulin and reproduced the setup): - default engine locally → passes (segfault is CI-runner-specific); - `[default] engine = "Llvm"` + `cargo tarpaulin --out Xml` → activates `LLVM_PROFILE_FILE` coverage across 26 test binaries, exits 0, writes a valid `cobertura.xml`. - Note: the value must be capitalized `"Llvm"` — serde is case-sensitive; lowercase silently falls back to ptrace. This clears the last **repo-side-fixable** CI red. Remaining reds are genuinely external: `governance / Validate Hypatia Baseline` is pre-existing **#41 debt** (needs the hypatia CLI, out of session scope, or a baseline-regen decision), which the owner has merged past. ## FLAGS (unchanged) - `gossamer` + `conative-gating` still 403-blocked → **#83 / #103 staged** until added to the environment's repo scope. - OPEN proof obligations 1.1 / 1.2 (formal) / 3.2 remain honestly staged. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh --- _Generated by [Claude Code](https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the recurring
governance / Check Workflow Stalenessred that has failed onevery recent PR (#154, #161, …).
Root cause (pre-existing, from #159): the Scorecard workflow adopted in #159 runs
Scorecard in SARIF mode and pushes the SARIF into GitHub Code Scanning, but only
fires on
push(main)/schedule— not per-PR-head. The standards governance stalenessgate forbids exactly that:
Fix: delegate
scorecard.ymlto the canonical standardsscorecard-reusable.yml@7c9db0e— it runs Scorecard in JSON mode withpublish_resultsand uploads an artifact, and does not push SARIF into CodeScanning. That's the canonical behaviour #159's title ("adopt canonical scorecard.yml")
intended, and it satisfies the gate. Job name (
analysis) preserved for the required-checkcontract.
Also hardened
must-check.sh(portable[[:space:]]instead of GNU-only\s; quotedexit "$fail").Verified locally:
check-workflow-staleness.sh→ "All workflow staleness checkspassed";
scorecard.ymlYAML valid;must-checkexit 0.FLAGS (unchanged)
gossamer+conative-gatingstill 403-blocked → build: migrate Kotlin/Gradle Android app to gossamer (clears banned-language CI) #83 / Adopt conative-gating as policy/egress GO/NO-GO veto (refs proof-obligation #84-3.1) #103 staged (needs the reposadded to the environment's scope).
🤖 Generated with Claude Code
https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh
Generated by Claude Code