From e4f0fbcbad3f386d9d1d5cacb8a3cf2f6ec38861 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 22:54:08 +0000 Subject: [PATCH 1/2] fix(ci): start the Governance job again and re-sync the coaptation receipt Two reds on main, fixed together because both are small and both are about main drifting from what it declares. Governance: the workflow called the reusable governance-reusable.yml of the standards repository, and the call fails with startup_failure and no job (main runs of 21:35, 21:45 and 22:13 UTC). systemet hit the same thing and replaced the call with a self-contained job, which is green there. This takes that file unchanged: the same TypeScript and package-manager policy, with the policy script checked out from metadatastician/standards at a pinned commit. Checked locally that anytype has no unallowlisted .ts files, no npm/yarn/pnpm lockfiles and no root tsconfig.json or Makefile, so the job should pass here. Coaptation receipt: #87 (6a2 to descriptiles) changed Mustfile.a2ml, so the must hash in the receipt went stale and `just validate-coapt` reported drift. Regenerated with `just coapt`. The only change is the must hash; the band stays green and no reading moved. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01J1XmMC49T8sZ3uUuvrgB7y --- .github/workflows/governance.yml | 64 +++++++++++++++++-- .../coaptation/receipts/latest.a2ml | 2 +- 2 files changed, 61 insertions(+), 5 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index e7940f7..2859f12 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,23 +1,79 @@ # SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. +# +# Self-contained estate governance policy checks, after `governance.yml` of the +# estate template (hyperpolymath/rsr-template-repo). The policy script comes +# from metadatastician/standards at the commit in STANDARDS_PIN. +# +# The earlier form of this file called the reusable workflow `governance-reusable.yml` of the +# standards repository. That call did not start: each run failed with no job. +# This form runs the TypeScript and package-manager policy only. name: Governance on: push: branches: [main, master] pull_request: - branches: [main, master] workflow_dispatch: concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true + permissions: contents: read jobs: governance: - uses: metadatastician/standards/.github/workflows/governance-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd + name: Estate Governance Policy + runs-on: ubuntu-24.04 + timeout-minutes: 15 permissions: - actions: read contents: read - security-events: write + env: + STANDARDS_PIN: 'e064539116c2dcfdf282a4749dbd58c69961c7e6' + steps: + - name: Checkout repository + uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + + - name: Checkout pinned standards policy scripts + uses: actions/checkout@v7.0.1 + with: + repository: metadatastician/standards + ref: e064539116c2dcfdf282a4749dbd58c69961c7e6 + path: .standards-checkout + sparse-checkout: | + scripts + 0-canon + sparse-checkout-cone-mode: true + persist-credentials: false + + - name: Enforce TypeScript and npm/yarn runtime policy + run: | + set -euo pipefail + if [ -f .standards-checkout/scripts/check-ts-allowlist.sh ]; then + bash .standards-checkout/scripts/check-ts-allowlist.sh + fi + rm -rf .standards-checkout + + bad_ts="$(git ls-files '*.ts' '*.tsx' | grep -vE '^(archetypes/|templates/|tests/fixtures/)' || true)" + if [ -n "$bad_ts" ]; then + echo "::error::Unallowlisted TypeScript files detected:" + printf '%s\n' "$bad_ts" + exit 1 + fi + + bad_locks="$(git ls-files 'package-lock.json' '**/package-lock.json' 'yarn.lock' '**/yarn.lock' 'pnpm-lock.yaml' '**/pnpm-lock.yaml' || true)" + if [ -n "$bad_locks" ]; then + echo "::error::Banned npm/yarn/pnpm lockfiles detected (use Deno or Bun per LANGUAGE-POLICY):" + printf '%s\n' "$bad_locks" + exit 1 + fi + + if [ -f tsconfig.json ] || [ -f Makefile ] || [ -f GNUmakefile ]; then + echo "::error::Banned root config (tsconfig.json / Makefile) detected" + exit 1 + fi + echo "Governance runtime and language anti-pattern checks passed." diff --git a/.machine_readable/coaptation/receipts/latest.a2ml b/.machine_readable/coaptation/receipts/latest.a2ml index bd7087b..c4c394f 100644 --- a/.machine_readable/coaptation/receipts/latest.a2ml +++ b/.machine_readable/coaptation/receipts/latest.a2ml @@ -86,5 +86,5 @@ bust.sync-drift-between-repos = latent bust.contractile-parse-error = latent [provenance] -contractiles = "intend@b5248bb14c9b must@20748d123686 trust@32805d174f53 adjust@8faad9ca0650 dust@c9b96a1959f8 bust@dd6a53e1fc9b" +contractiles = "intend@b5248bb14c9b must@fbbcf90bc87f trust@32805d174f53 adjust@8faad9ca0650 dust@c9b96a1959f8 bust@dd6a53e1fc9b" descriptiles = "clade@1774a0b6a688 deed@f8d9d5bbaba0 ecosystem@f490b124bb19 agentic@f1102d5cb5ba anchor@f0707388115d" From d6915dc6043fb5fb8ef9e27a9b610001b14f86eb Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 22:54:54 +0000 Subject: [PATCH 2/2] fix(ci): SHA-pin the two checkout steps in the ported governance workflow lint-workflows failed on this PR: the governance.yml taken from systemet uses actions/checkout@v7.0.1, and anytype's Workflow Security Linter requires every uses: to be pinned to a 40-character commit. Pinned both to the commit the repository's other workflows already use for checkout v7.0.1. Reproduced the linter's pinning check locally: it listed the two lines before and lists none after. The SPDX-header and permissions checks pass on the file too. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01J1XmMC49T8sZ3uUuvrgB7y --- .github/workflows/governance.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 2859f12..3c401e8 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -34,12 +34,12 @@ jobs: STANDARDS_PIN: 'e064539116c2dcfdf282a4749dbd58c69961c7e6' steps: - name: Checkout repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Checkout pinned standards policy scripts - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: metadatastician/standards ref: e064539116c2dcfdf282a4749dbd58c69961c7e6