Skip to content

ci: pass only named secrets to the called workflows - #80

Merged
hyperpolymath merged 2 commits into
mainfrom
claude/named-secrets-for-callers
Nov 10, 2026
Merged

ci: pass only named secrets to the called workflows#80
hyperpolymath merged 2 commits into
mainfrom
claude/named-secrets-for-callers

Conversation

@hyperpolymath

@hyperpolymath hyperpolymath commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Summary

3 callers on main have secrets: inherit. That line gives every secret of this repository to the called workflow. SonarCloud reported it on PR #79 (rule githubactions:S7635, "Only pass required secrets to this workflow"). This PR removes the 3 lines and passes only the secrets that each called workflow declares.

Merge this before metadatastician/standards goes on the Actions allow list of this repository. At this time the Actions policy refuses the 6 standards callers, so no secret is passed. When the policy permits them, the callers on main start to run with the lines that main has at that time.

Changes

  • hypatia-scan.yml: the pin moves from 571cc73 to 740c9d7, and the caller passes HYPATIA_SCAN_PAT only. At 571cc73 the called workflow declares no secrets, so a named secret is not possible there.
  • mirror.yml: the pin moves from 571cc73 to 740c9d7, and the caller passes the 7 key secrets that the called workflow declares (GITLAB_SSH_KEY, BITBUCKET_SSH_KEY, CODEBERG_SSH_KEY, SOURCEHUT_SSH_KEY, DISROOT_SSH_KEY, GITEA_SSH_KEY, RADICLE_KEY).
  • secret-scanner.yml: the pin stays at db12a6a. The secrets: inherit line goes, with no replacement. The called workflow uses only the automatic token.

740c9d7 (2026-10-19) is an ancestor of standards main. It is the pin that echidnabot uses for the same 2 workflows.

RSR Quality Checklist

Required

  • Tests pass (just test or equivalent): not run, the change is in 3 workflow files only
  • Code is formatted (just fmt or equivalent): not run, same reason
  • Linter is clean (no new warnings or errors): not run locally, the PR checks give the result
  • No banned language patterns (no TypeScript, no npm/bun, no Go/Python)
  • No unsafe blocks without // SAFETY: comments
  • No banned functions (believe_me, unsafeCoerce, Obj.magic, Admitted, sorry)
  • SPDX license headers present on all new/modified source files
  • No secrets, credentials, or .env files included (secret names only, no values)

As Applicable

None of the listed documents changes.

Testing

  • grep finds 0 secrets: inherit lines outside comments in .github/workflows/.
  • yq parses the 3 files.
  • Each secret that a caller passes is declared in the workflow_call block of the called file at 740c9d7 (read from a clone of the standards repository).
  • SonarCloud on this pull request: Quality Gate passed, 0 new issues. The finding from ci: name the standards repository by its current owner in 6 callers #79 is gone.

Not verified:

  • No run of these 3 callers is possible before the Actions policy permits metadatastician/standards. The first runs after that change are the proof.
  • That the called secret scanner receives the automatic token without inherit. GitHub passes GITHUB_TOKEN to a called workflow by default, but I did not see a run that shows it for this caller.

Note for the owner: mirror.yml starts on each push to main. At 740c9d7, a forge job runs only if the repository variable <FORGE>_MIRROR_ENABLED is true (for example GITLAB_MIRROR_ENABLED), and it pushes only if the key secret of that forge exists. Read those variables before the Actions policy permits the callers.

🤖 Generated with Claude Code

https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK

@claude
ci: pass only named secrets to the called workflows
938eec9 
3 callers had `secrets: inherit`: hypatia-scan, mirror and
secret-scanner. With the owner name `metadatastician`, that line gives
every secret of this repository to a workflow of another owner. SonarCloud
reports it on this pull request (rule S7635, 3 findings, "Only pass
required secrets to this workflow").

The called files at the old pins declare no secrets, so `inherit` was the
only way to give them a secret. The owner decided to pass only named
secrets:

- `hypatia-scan.yml` and `mirror.yml` move from 571cc73 to 740c9d7
  (2026-10-19), the commit that echidnabot pins. At that commit the
  called files declare their secrets. `mirror.yml` passes its 7 key
  secrets, and `hypatia-scan.yml` passes `HYPATIA_SCAN_PAT`.
- `secret-scanner.yml` keeps its pin (db12a6a) and has no `secrets:`
  line. The called file uses only the automatic token.

No caller inherits secrets now. `governance.yml`, `rust-ci.yml` and
`scorecard.yml` do not change in this commit.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK
@coderabbitai

coderabbitai Bot commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Explain Change →

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 55 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 571d8070-cdb6-4ad3-816d-4c595741993f
Commits

Reviewing files that changed from the base of the PR and between 938eec9 and 05eb623.

Files selected for processing: 3

  • .github/workflows/hypatia-scan.yml
  • .github/workflows/mirror.yml
  • .github/workflows/secret-scanner.yml

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

  • Chores
    • Updated the repository’s automated scanning and mirroring workflows to use revised shared workflows.
    • Replaced inherited secrets with explicitly selected credentials for mirroring and scanning tasks. The secret-scanning workflow no longer receives inherited secrets.

Three GitHub Actions workflows update their reusable workflow references or secret handling. Hypatia and mirror calls use explicit secret mappings. The secret-scanner call no longer inherits caller secrets.

Changes: Reusable workflow secret scope

Layer / File(s) Summary
Update workflow references and secret mappings
.github/workflows/hypatia-scan.yml, .github/workflows/mirror.yml, .github/workflows/secret-scanner.yml		 The Hypatia and mirror jobs use a new reusable workflow revision. They pass named secrets explicitly. The secret-scanner job removes inherited secrets and notes that the called workflow uses the automatic token.

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Possibly related PRs

  • hyperpolymath/anytype#79: Both PRs change reusable-workflow calls in the same three workflow files. This PR updates workflow revisions and secret mappings; PR #79 changes the repository owner in those calls.
Merge Risk: Minimal · previous review 938ee

No actionable failure is established for these workflow changes. Confirm the enabled mirror forges’ variables before the first permitted mirror run.

Pre-merge checks: Passed 4

Check name Status Explanation
Title check Passed The title clearly summarises the main change: passing only named secrets to called workflows.
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Description check Passed The description covers the purpose, key changes, quality checklist, and testing. It also states which checks were not run and which workflow behaviour remains unverified. Screenshots are not applicabl…
Full details: Description check

Explanation

The description covers the purpose, key changes, quality checklist, and testing. It also states which checks were not run and which workflow behaviour remains unverified. Screenshots are not applicable to these workflow changes.

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

Recent review info

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 774256ac-1913-425b-aa23-9c062d60ed43
Commits

Reviewing files that changed from the base of the PR and between b20e139 and 938eec9.

Files selected for processing: 3

  • .github/workflows/hypatia-scan.yml
  • .github/workflows/mirror.yml
  • .github/workflows/secret-scanner.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Context from checks skipped due to timeout: 2

  • GitHub Check: CodeRabbit
  • GitHub Check: semgrep-cloud-platform/scan
CI failures not shown inline: 10

GitHub Actions: SonarQube / 0_SonarQube.txt: ci: pass only named secrets to the called workflows

Conclusion: failure

View job details

##[group]Run SonarSource/sonarqube-scan-action@e805d875275f728fac1885b413934be6d7c63f65
 with:
   projectBaseDir: .
   scannerVersion: 8.3.1.16491
   scannerBinariesUrl: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli
   skipSignatureVerification: false
 env:
   SONAR_***REDACTED_SECRET_ASSIGNMENT***
 ##[warning]Running this GitHub Action without SONAR_TOKEN is not recommended
 Installing Sonar Scanner CLI 8.3.1.16491 for linux-x64...
 Downloading from: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.3.1.16491-linux-x64.zip
 Downloading signature from: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.3.1.16491-linux-x64.zip.asc
 Importing SonarSource public key from hkps://keyserver.ubuntu.com...
 [command]/usr/bin/gpg --homedir /home/runner/work/_temp/gpg-239bb6a8 --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 679F1EE92B19609DE816FDE81DB198F93525EC1A
 gpg: keybox '/home/runner/work/_temp/gpg-239bb6a8/pubring.kbx' created
 gpg: /home/runner/work/_temp/gpg-239bb6a8/trustdb.gpg: trustdb created
 gpg: key 1DB198F93525EC1A: public key "SonarSource S.A. <infra@sonarsource.com>" imported
 gpg: Total number processed: 1
 gpg:               imported: 1
 Successfully imported key from hkps://keyserver.ubuntu.com
 ✓ SonarSource public key imported successfully
 Verifying GPG signature...
 [command]/usr/bin/gpg --homedir /home/runner/work/_temp/gpg-239bb6a8 --batch --verify /home/runner/work/_temp/052f3a2e-8b3f-421e-b3d8-0e56220d1913 /home/runner/work/_temp/3b228065-5ce0-4e64-b147-1d63b1ac0a11
 gpg: Signature made Mon Nov  2 14:30:12 2026 UTC
 gpg:                using RSA key 06D0369BE1D0B06997DA66E8C33B56C147B01975
 gpg: Good signature from "SonarSource S.A. <infra@sonarsource.com>" [unknown]
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg:          There is no indication that the signature belongs to the owner.
 Primary key fingerprint: 679F 1EE9 2B...

GitHub Actions: SonarQube / SonarQube: ci: pass only named secrets to the called workflows

Conclusion: failure

View job details

##[group]Run SonarSource/sonarqube-scan-action@e805d875275f728fac1885b413934be6d7c63f65
 with:
   projectBaseDir: .
   scannerVersion: 8.3.1.16491
   scannerBinariesUrl: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli
   skipSignatureVerification: false
 env:
   SONAR_***REDACTED_SECRET_ASSIGNMENT***
 ##[warning]Running this GitHub Action without SONAR_TOKEN is not recommended
 Installing Sonar Scanner CLI 8.3.1.16491 for linux-x64...
 Downloading from: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.3.1.16491-linux-x64.zip
 Downloading signature from: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.3.1.16491-linux-x64.zip.asc
 Importing SonarSource public key from hkps://keyserver.ubuntu.com...
 [command]/usr/bin/gpg --homedir /home/runner/work/_temp/gpg-239bb6a8 --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 679F1EE92B19609DE816FDE81DB198F93525EC1A
 gpg: keybox '/home/runner/work/_temp/gpg-239bb6a8/pubring.kbx' created
 gpg: /home/runner/work/_temp/gpg-239bb6a8/trustdb.gpg: trustdb created
 gpg: key 1DB198F93525EC1A: public key "SonarSource S.A. <infra@sonarsource.com>" imported
 gpg: Total number processed: 1
 gpg:               imported: 1
 Successfully imported key from hkps://keyserver.ubuntu.com
 ✓ SonarSource public key imported successfully
 Verifying GPG signature...
 [command]/usr/bin/gpg --homedir /home/runner/work/_temp/gpg-239bb6a8 --batch --verify /home/runner/work/_temp/052f3a2e-8b3f-421e-b3d8-0e56220d1913 /home/runner/work/_temp/3b228065-5ce0-4e64-b147-1d63b1ac0a11
 gpg: Signature made Mon Nov  2 14:30:12 2026 UTC
 gpg:                using RSA key 06D0369BE1D0B06997DA66E8C33B56C147B01975
 gpg: Good signature from "SonarSource S.A. <infra@sonarsource.com>" [unknown]
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg:          There is no indication that the signature belongs to the owner.
 Primary key fingerprint: 679F 1EE9 2B...

GitHub Actions: Dogfood Gate / 2_Empty-linter (invisible characters).txt: ci: pass only named secrets to the called workflows

Conclusion: failure

View job details

##[group]Run # Inline invisible character detection (from empty-linter's core patterns).
 �[36;1m# Inline invisible character detection (from empty-linter's core patterns).�[0m
 �[36;1m# Checks for: zero-width spaces, zero-width joiners, BOM, soft hyphens,�[0m
 �[36;1m# non-breaking spaces, null bytes, and other invisible Unicode in source files.�[0m
 �[36;1mset +e�[0m
 �[36;1mPATTERNS='\x00|[\x01-\x08\x0B\x0C\x0E-\x1F]|\x{a0}|\x{ad}|\x{200b}|\x{200c}|\x{200d}|\x{200e}|\x{200f}|\x{202a}|\x{202b}|\x{202c}|\x{202d}|\x{202e}|\x{2060}|\x{feff}'�[0m
 �[36;1mfind "$GITHUB_WORKSPACE" \�[0m
 �[36;1m  -not -path '*/.git/*' -not -path '*/node_modules/*' \�[0m
 �[36;1m  -not -path '*/.deno/*' -not -path '*/target/*' \�[0m
 �[36;1m  -not -path '*/_build/*' -not -path '*/deps/*' \�[0m
 �[36;1m  -not -path '*/external_corpora/*' -not -path '*/.lake/*' \�[0m
 �[36;1m  -type f \( -name '*.rs' -o -name '*.ex' -o -name '*.exs' -o -name '*.res' \�[0m
 �[36;1m    -o -name '*.js' -o -name '*.ts' -o -name '*.json' -o -name '*.toml' \�[0m
 �[36;1m    -o -name '*.yml' -o -name '*.yaml' -o -name '*.md' -o -name '*.adoc' \�[0m
 �[36;1m    -o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \�[0m
 �[36;1m    -o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \�[0m
 �[36;1m  -exec grep -aPrl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null�[0m
 �[36;1mEL_EXIT=$?�[0m
 �[36;1mset -e�[0m
 �[36;1m�[0m
 �[36;1mFINDINGS=$(wc -l < /tmp/empty-lint-results.txt 2>/dev/null || echo 0)�[0m
 �[36;1mecho "findings=$FINDINGS" >> "$GITHUB_OUTPUT"�[0m
 �[36;1mecho "exit_code=$EL_EXIT" >> "$GITHUB_OUTPUT"�[0m
 �[36;1mecho "ready=true" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m�[0m
 �[36;1m# Blocking subset: C0 controls and NUL only (owner ruling 2026-08-28).�[0m
 �[36;1m# Invisible Unicode (NBSP/BOM/zero-width) stays ADVISORY - about 2,100�[0m
 �[36;1m# estate files carry it as legitimate typography in prose.�[0m
 �[36;1mblocking=0�[0m
 �[36;1mwhile IFS= read -r bf; do�[0m
 �...

GitHub Actions: Dogfood Gate / Empty-linter (invisible characters): ci: pass only named secrets to the called workflows

Conclusion: failure

View job details

##[group]Run # Inline invisible character detection (from empty-linter's core patterns).
 �[36;1m# Inline invisible character detection (from empty-linter's core patterns).�[0m
 �[36;1m# Checks for: zero-width spaces, zero-width joiners, BOM, soft hyphens,�[0m
 �[36;1m# non-breaking spaces, null bytes, and other invisible Unicode in source files.�[0m
 �[36;1mset +e�[0m
 �[36;1mPATTERNS='\x00|[\x01-\x08\x0B\x0C\x0E-\x1F]|\x{a0}|\x{ad}|\x{200b}|\x{200c}|\x{200d}|\x{200e}|\x{200f}|\x{202a}|\x{202b}|\x{202c}|\x{202d}|\x{202e}|\x{2060}|\x{feff}'�[0m
 �[36;1mfind "$GITHUB_WORKSPACE" \�[0m
 �[36;1m  -not -path '*/.git/*' -not -path '*/node_modules/*' \�[0m
 �[36;1m  -not -path '*/.deno/*' -not -path '*/target/*' \�[0m
 �[36;1m  -not -path '*/_build/*' -not -path '*/deps/*' \�[0m
 �[36;1m  -not -path '*/external_corpora/*' -not -path '*/.lake/*' \�[0m
 �[36;1m  -type f \( -name '*.rs' -o -name '*.ex' -o -name '*.exs' -o -name '*.res' \�[0m
 �[36;1m    -o -name '*.js' -o -name '*.ts' -o -name '*.json' -o -name '*.toml' \�[0m
 �[36;1m    -o -name '*.yml' -o -name '*.yaml' -o -name '*.md' -o -name '*.adoc' \�[0m
 �[36;1m    -o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \�[0m
 �[36;1m    -o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \�[0m
 �[36;1m  -exec grep -aPrl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null�[0m
 �[36;1mEL_EXIT=$?�[0m
 �[36;1mset -e�[0m
 �[36;1m�[0m
 �[36;1mFINDINGS=$(wc -l < /tmp/empty-lint-results.txt 2>/dev/null || echo 0)�[0m
 �[36;1mecho "findings=$FINDINGS" >> "$GITHUB_OUTPUT"�[0m
 �[36;1mecho "exit_code=$EL_EXIT" >> "$GITHUB_OUTPUT"�[0m
 �[36;1mecho "ready=true" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m�[0m
 �[36;1m# Blocking subset: C0 controls and NUL only (owner ruling 2026-08-28).�[0m
 �[36;1m# Invisible Unicode (NBSP/BOM/zero-width) stays ADVISORY - about 2,100�[0m
 �[36;1m# estate files carry it as legitimate typography in prose.�[0m
 �[36;1mblocking=0�[0m
 �[36;1mwhile IFS= read -r bf; do�[0m
 �...

GitHub Actions: Dogfood Gate / 3_Groove manifest check.txt: ci: pass only named secrets to the called workflows

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Dogfood Gate / Groove manifest check: ci: pass only named secrets to the called workflows

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Dogfood Gate / 4_Validate K9 contracts.txt: ci: pass only named secrets to the called workflows

Conclusion: failure

View job details

##[group]K9 Configuration Validation
 Scanning . for K9 files (.k9, .k9.ncl)...
 Found 18 K9 file(s)
   Validating: ./.machine_readable/arrival-pack/claude-md.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
   Validating: ./.machine_readable/coaptation/coapt.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
   Validating: ./.machine_readable/contractiles/adjust/adjust.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
   Validating: ./.machine_readable/contractiles/bust/bust.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
 ##[error]Hunt-level K9 file must include a 'signature' or 'signature_required' field
   Validating: ./.machine_readable/contractiles/dust/dust.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
   Validating: ./.machine_readable/contractiles/intend/intend.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
 ##[error]Hunt-level K9 file must include a 'signature' or 'signature_required' field
   Validating: ./.machine_readable/contractiles/must/must.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
 ##[error]Hunt-level K9 file must include a 'signature' or 'signature_required' field
   Validating: ./.machine_readable/contractiles/trust/trust.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
 ##[error]Hunt-level K9 file must include a 'signature' or 'signature_required' field
   Validating: ./.machine_readable/self-validating/examples/ci-config.k9.ncl
   Validating: ./.machine_readable/self-validating/examples/project-metadata.k9.ncl
   Validating: ./.machine_readable/self-validating/examples/setup-repo.k9.ncl
   Validating: ./.machine_readable/self-validating/methodology-guard.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
 #...

GitHub Actions: Dogfood Gate / Validate K9 contracts: ci: pass only named secrets to the called workflows

Conclusion: failure

View job details

##[group]K9 Configuration Validation
 Scanning . for K9 files (.k9, .k9.ncl)...
 Found 18 K9 file(s)
   Validating: ./.machine_readable/arrival-pack/claude-md.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
   Validating: ./.machine_readable/coaptation/coapt.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
   Validating: ./.machine_readable/contractiles/adjust/adjust.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
   Validating: ./.machine_readable/contractiles/bust/bust.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
 ##[error]Hunt-level K9 file must include a 'signature' or 'signature_required' field
   Validating: ./.machine_readable/contractiles/dust/dust.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
   Validating: ./.machine_readable/contractiles/intend/intend.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
 ##[error]Hunt-level K9 file must include a 'signature' or 'signature_required' field
   Validating: ./.machine_readable/contractiles/must/must.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
 ##[error]Hunt-level K9 file must include a 'signature' or 'signature_required' field
   Validating: ./.machine_readable/contractiles/trust/trust.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
 ##[error]Hunt-level K9 file must include a 'signature' or 'signature_required' field
   Validating: ./.machine_readable/self-validating/examples/ci-config.k9.ncl
   Validating: ./.machine_readable/self-validating/examples/project-metadata.k9.ncl
   Validating: ./.machine_readable/self-validating/examples/setup-repo.k9.ncl
   Validating: ./.machine_readable/self-validating/methodology-guard.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'
 #...

GitHub Actions: Dogfood Gate / 5_Validate eclexiaiser manifest.txt: ci: pass only named secrets to the called workflows

Conclusion: failure

View job details

##[group]Run if [ ! -f "eclexiaiser.toml" ]; then
 �[36;1mif [ ! -f "eclexiaiser.toml" ]; then�[0m
 �[36;1m  # Check if repo has a Containerfile — if so, recommend eclexiaiser�[0m
 �[36;1m  if [ -f "Containerfile" ]; then�[0m
 �[36;1m    echo "::warning::Containerfile present but no eclexiaiser.toml. Run \`eclexiaiser init\` to scaffold energy/carbon budgets."�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "has_manifest=false" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mecho "has_manifest=true" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m�[0m
 �[36;1m# Validate eclexiaiser.toml structure (bash + grep; NO Python per estate policy).�[0m
 �[36;1m# Structural presence checks only — deep schema validation is eclexiaiser's own job.�[0m
 �[36;1merr=0�[0m
 �[36;1mgrep -qE '^[[:space:]]*\[project\]'        eclexiaiser.toml || { echo "::error file=eclexiaiser.toml::[project] section is required"; err=1; }�[0m
 �[36;1mgrep -qE '^[[:space:]]*name[[:space:]]*=[[:space:]]*"[^"]+"' eclexiaiser.toml || { echo "::error file=eclexiaiser.toml::a non-empty name is required"; err=1; }�[0m
 �[36;1mgrep -qE '^[[:space:]]*\[\[functions\]\]'  eclexiaiser.toml || { echo "::error file=eclexiaiser.toml::at least one [[functions]] entry is required"; err=1; }�[0m

GitHub Actions: Dogfood Gate / Validate eclexiaiser manifest: ci: pass only named secrets to the called workflows

Conclusion: failure

View job details

##[group]Run if [ ! -f "eclexiaiser.toml" ]; then
 �[36;1mif [ ! -f "eclexiaiser.toml" ]; then�[0m
 �[36;1m  # Check if repo has a Containerfile — if so, recommend eclexiaiser�[0m
 �[36;1m  if [ -f "Containerfile" ]; then�[0m
 �[36;1m    echo "::warning::Containerfile present but no eclexiaiser.toml. Run \`eclexiaiser init\` to scaffold energy/carbon budgets."�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "has_manifest=false" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mecho "has_manifest=true" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m�[0m
 �[36;1m# Validate eclexiaiser.toml structure (bash + grep; NO Python per estate policy).�[0m
 �[36;1m# Structural presence checks only — deep schema validation is eclexiaiser's own job.�[0m
 �[36;1merr=0�[0m
 �[36;1mgrep -qE '^[[:space:]]*\[project\]'        eclexiaiser.toml || { echo "::error file=eclexiaiser.toml::[project] section is required"; err=1; }�[0m
 �[36;1mgrep -qE '^[[:space:]]*name[[:space:]]*=[[:space:]]*"[^"]+"' eclexiaiser.toml || { echo "::error file=eclexiaiser.toml::a non-empty name is required"; err=1; }�[0m
 �[36;1mgrep -qE '^[[:space:]]*\[\[functions\]\]'  eclexiaiser.toml || { echo "::error file=eclexiaiser.toml::at least one [[functions]] entry is required"; err=1; }�[0m
Additional context used

Code guidelines: 1 

.github/copilot-instructions.md — auto-discovered
Path-based instructions: 1

Source excerpt: SPDX: `MPL-2.0` on all new files.

CodeRabbit inference engine (.github/copilot-instructions.md)

Files:

  • .github/workflows/secret-scanner.yml
  • .github/workflows/mirror.yml
  • .github/workflows/hypatia-scan.yml
Additional comments: 3

.github/workflows/hypatia-scan.yml: 1

29-33: LGTM!

.github/workflows/secret-scanner.yml: 1

24-24: LGTM!

.github/workflows/mirror.yml: 1

14-14: Functional Correctness

The configuration is unavailable, so the impact on this caller cannot be determined. GITEA_HOST is not a new requirement.

@hyperpolymath Claude

hyperpolymath commented Nov 10, 2026

Copy link
Copy Markdown
Owner Author

2 checks are red on this pull request, and both are red on main at b20e139 too. This pull request changes 3 workflow files only, so it is not the cause of either.

Check Run on main Cause Repair
Validate K9 contracts (Dogfood Gate) run 42891228457, job 130092566087: failure The validator reports 20 errors in the K9 contract files of the repository. None yet.
SonarQube run 42891228471: failure Fail to load the list of plugins installed on the server: Not authorized or organization not found. The scanner has no valid token or organization for this repository. gitbot-fleet has a recipe for it (fix-sonarqube-token-guard.sh). It is not applied here.

The SonarCloud app check (a different check) is green on this pull request. It reported the 3 secrets: inherit lines on #79.

Generated by Claude Code

@linear-code
linear-code Bot marked this pull request as ready for review November 10, 2026 20:21
@hyperpolymath
hyperpolymath merged commit f6e9b99 into main Nov 10, 2026
20 of 22 checks passed
@hyperpolymath
hyperpolymath deleted the claude/named-secrets-for-callers branch November 10, 2026 20:22
@sonarqubecloud

sonarqubecloud Bot commented Nov 10, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] approved these changes

Assignees

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@hyperpolymath @claude