Repository navigation
ci: name the standards repository by its current owner in 6 callers - #79
Merged
Merged
Conversation
6 workflows call a reusable workflow in `hyperpolymath/standards`: governance, hypatia-scan, mirror, rust-ci, scorecard and secret-scanner. None of them starts. For `rust-ci.yml`, GitHub Actions says (run 42889708382): `error parsing called workflow ... hyperpolymath/standards/ .github/workflows/rust-ci-reusable.yml@571cc73...: workflow was not found`. The last runs of governance and secret-scanner end in the same way, at creation. The standards repository now has the owner `metadatastician`. `git` follows the old name, GitHub Actions does not. This change replaces only the owner name in the 6 `uses:` lines. Each caller keeps its own pinned commit (571cc73, d7c2271, db12a6a). Each of those commits is on `main` of the standards repository and has the called file. The permissions that each called file requests are permissions that its caller grants. No called file has a `concurrency:` key. Not known: if the Actions settings of this repository permit a reusable workflow from another owner. In echidnabot they do not. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK
Contributor
|
Caution Review failedThe pull request is closed. Summary
Merge Risk:
 |
|
hyperpolymath
marked this pull request as ready for review
November 10, 2026 20:02
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
5 of 8 tasks
hyperpolymath
added a commit
that referenced
this pull request
Nov 10, 2026
## Summary 3 callers on `main` have `secrets: inherit`. That line gives every secret of this repository to the called workflow. SonarCloud reported it on PR #79 (rule `githubactions:S7635`, "Only pass required secrets to this workflow"). This PR removes the 3 lines and passes only the secrets that each called workflow declares. **Merge this before `metadatastician/standards` goes on the Actions allow list of this repository.** At this time the Actions policy refuses the 6 standards callers, so no secret is passed. When the policy permits them, the callers on `main` start to run with the lines that `main` has at that time. ## Changes - `hypatia-scan.yml`: the pin moves from `571cc73` to `740c9d7`, and the caller passes `HYPATIA_SCAN_PAT` only. At `571cc73` the called workflow declares no secrets, so a named secret is not possible there. - `mirror.yml`: the pin moves from `571cc73` to `740c9d7`, and the caller passes the 7 key secrets that the called workflow declares (`GITLAB_SSH_KEY`, `BITBUCKET_SSH_KEY`, `CODEBERG_SSH_KEY`, `SOURCEHUT_SSH_KEY`, `DISROOT_SSH_KEY`, `GITEA_SSH_KEY`, `RADICLE_KEY`). - `secret-scanner.yml`: the pin stays at `db12a6a`. The `secrets: inherit` line goes, with no replacement. The called workflow uses only the automatic token. `740c9d7` (2026-10-19) is an ancestor of standards `main`. It is the pin that echidnabot uses for the same 2 workflows. ## RSR Quality Checklist ### Required - [ ] Tests pass (`just test` or equivalent): not run, the change is in 3 workflow files only - [ ] Code is formatted (`just fmt` or equivalent): not run, same reason - [ ] Linter is clean (no new warnings or errors): not run locally, the PR checks give the result - [x] No banned language patterns (no TypeScript, no npm/bun, no Go/Python) - [x] No `unsafe` blocks without `// SAFETY:` comments - [x] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`, `Admitted`, `sorry`) - [x] SPDX license headers present on all new/modified source files - [x] No secrets, credentials, or `.env` files included (secret names only, no values) ### As Applicable None of the listed documents changes. ## Testing - `grep` finds 0 `secrets: inherit` lines outside comments in `.github/workflows/`. - `yq` parses the 3 files. - Each secret that a caller passes is declared in the `workflow_call` block of the called file at `740c9d7` (read from a clone of the standards repository). - SonarCloud on this pull request: Quality Gate passed, 0 new issues. The finding from #79 is gone. Not verified: - No run of these 3 callers is possible before the Actions policy permits `metadatastician/standards`. The first runs after that change are the proof. - That the called secret scanner receives the automatic token without `inherit`. GitHub passes `GITHUB_TOKEN` to a called workflow by default, but I did not see a run that shows it for this caller. Note for the owner: `mirror.yml` starts on each push to `main`. At `740c9d7`, a forge job runs only if the repository variable `<FORGE>_MIRROR_ENABLED` is `true` (for example `GITLAB_MIRROR_ENABLED`), and it pushes only if the key secret of that forge exists. Read those variables before the Actions policy permits the callers. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
6 workflows of this repository do not start:
governance.yml,hypatia-scan.yml,mirror.yml,rust-ci.yml,scorecard.ymlandsecret-scanner.yml. Each one calls a reusable workflow inhyperpolymath/standards. Forrust-ci.yml, GitHub Actions says (run 42889708382):The last runs of
governance.yml(run 42889708030) andsecret-scanner.yml(run 42889708195) end in the same way:failureat creation, with the file path as the run name. So this repository has no governance gate, no secret scan, no shared Rust CI, no Hypatia scan, no scorecard and no mirror at this time. The other 3 callers have the same line form; their runs were not read.The cause is the name only. The standards repository now has the owner
metadatastician.gitfollows the old name. GitHub Actions does not. echidnabot had the same fault (hyperpolymath/echidnabot#203).Changes
In each of the 6
uses:lines,hyperpolymath/standardsbecomesmetadatastician/standards. Nothing else changes: 6 lines, 1 name each.Each caller keeps its own pinned commit:
571cc73db12a6ad7c2271What to know before a merge
ea2f4d8(2026-11-07), and it takes the secret scanner fromhyperpolymath/proven-cicd. A move to those versions is a different decision and is not in this pull request.metadatastician/standards). The runs on this pull request show which case applies.mirror.ymlbecomes active after a merge. It runs on each push tomainand sends the repository to the other forges for which a key secret exists. It does not run on this pull request. Decide if that is wanted before the merge.RSR Quality Checklist
Required
.envfiles includedunsafeblocks, banned functions. Only 6 workflow lines change.Testing
Read from the standards repository (fetched from
metadatastician/standards):mainthere, and each has the called file.concurrency:key, so theconcurrency:key of each caller does not clash with it.Not verified:
Generated by Claude Code