ci: deploy docs via Ddraig SSG#503
Merged
Merged
Conversation
|
hyperpolymath
added a commit
that referenced
this pull request
Jul 21, 2026
## The main fix: standards' own secret scanning has not run since 2026-07-06 `secret-scanner.yml` pinned the reusable at `@891b1ed` (2026-07-06), which is **21 commits behind #500** (`08e2d246`). At that pin the reusable's `gitleaks` job requests `pull-requests: write` + `actions: read`, but this caller grants only `contents: read`. A called workflow cannot exceed its caller's grant, so **every run terminated at `startup_failure`**: ``` startup_failure main 2026-07-20T17:36 startup_failure test/signed-push-smoke 2026-07-20T17:33 startup_failure main 2026-07-20T17:24 startup_failure feat/signed-push-app-action 2026-07-20T16:55 startup_failure main 2026-07-20T13:43 startup_failure dependabot/github_actions/actions-5fa456a2a3 2026-07-20T13:28 ``` This is worse than a fake-green gate: the scan never executed at all, on the repo that *defines* the estate's secret-scanning standard. **Fix:** use the local relative path `./.github/workflows/secret-scanner-reusable.yml`, mirroring the `governance.yml` exemplar. This repo owns the reusable, so it should always scan itself with the current version — and a local path **cannot re-stale**, so this class of breakage cannot recur here. The current reusable needs only `contents: read`, so the existing grant is already correct (the in-file comment was accurate; only the pin was stale). ### Estate-wide corollary (not fixed here) The same `@d135b05` / pre-#500 pins are still in place on callers across the estate. Verified for the record: ``` $ gh api repos/hyperpolymath/standards/compare/08e2d246...d135b05 {"status":"behind","ahead":0,"behind":64} ``` At `d135b05` the gitleaks step is literally: ```yaml - name: Gitleaks Secret Scan continue-on-error: true # <-- cannot fail uses: gitleaks/gitleaks-action@e0c47f4f... ``` versus current `main`: ```yaml - name: Install gitleaks (pinned + checksum-verified) # sha256-verified binary - name: Gitleaks secret scan (gating) run: ... gitleaks detect ... --exit-code 1 # gates for real ``` So bumping those caller pins is **not cosmetic staleness** — it converts the estate's primary secret scanner from cannot-fail to actually-gating, *and* drops the permission demand to `contents: read` (removing the startup_failure hazard). That caller sweep is tracked separately. ## Secondary fixes - **`pages.yml`** (added in #503): had no SPDX header — tripping the governance "missing SPDX header" gate — and four unpinned tag refs, which the estate Actions policy rejects at run creation. Added `MPL-2.0` (**this repo's licence — deliberately not AGPL**) and pinned all four to release SHAs, keeping the current majors: `checkout` v7.0.0, `upload-pages-artifact` v5.0.0, `deploy-pages` v5.0.0. (Note: paint-type's pages.yml pins v3/v4 — copying those here would be a downgrade.) - **`spark-theatre-gate.yml`**: corrected a mislabelled pin comment — SHA `9c091bb2` is v7.0.0, not v4. Cosmetic, no behavioural change. ## Verification - All three files parse (`yaml.safe_load`). - The `startup_failure` claim is from `gh run list`, not inference; this PR's own Secret Scanner run is the direct test — it should execute rather than startup_failure. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mass rollout for Ddraig SSG