CI: pre-existing reds on main (Cargo Audit, governance linters, 3 startup_failures from lock drift)

These reds on main (ba373a8) were present before #399 and are identical on its head (cf51b64). #399 fixes only CodeQL, which moves from startup_failure to success.

Check context	Workflow	State on main and on #399
`Dependency audit`	Cargo Audit	failure
`governance / Workflow security linter`	Governance	failure
`governance / Validate Hypatia Baseline`	Governance	failure (baseline re-arm tracked in #314)
`lint-workflows`	Workflow Security Linter	failure
(no check-run: dies at startup)	Rust CI, MVP Smoke (Best Effort), Agda Meta-Checker	`startup_failure`

The startup failures match the 3 error findings that gh actions-lock --no-fix still reports on #399's head. They are in the agda-meta-checker, mvp-smoke and s4-loop lock entries, where the lock and the workflow refs disagree.

Acceptance criteria

gh actions-lock --no-fix --json reports 0 error findings. Fix the lock by hand; never use write mode, which corrupts local action refs.
Rust CI, MVP Smoke and Agda Meta-Checker start and report check-runs on main.
Dependency audit, governance / Workflow security linter and lint-workflows are each green, or each remaining finding has its own issue.
governance / Validate Hypatia Baseline resolved via Re-arm the hypatia baseline gate: generate .hypatia-baseline.json (152 findings to grandfather + burn down) #314.

🤖 Generated with Claude Code

fix(ci): SHA-pinned Security Scan callee + re-key CodeQL lock entry (#…

chore: echidna first-run start point (CI restore, drift, ids, templat…

ci: pin cicd-suite, dtolnay/rust-toolchain and the Hypatia clone (#401)…

Close-out evidence for the acceptance criteria. Read 2026-10-06 from the runs on main c28d09a (#410 squash). All 19 runs on that head are listed; none is startup_failure.

Lock clean. gh actions-lock --no-fix --verify on c28d09a reports valid: true with 0 errors. One warning remains: hyperpolymath/cicd-suite@4c772eb sha-as-ref, which can't be avoided because cicd-suite has no tags. Plain --no-fix mode cannot see a corrupted pin; --verify can, and a planted one-digit corruption reports unreachable-pin.
Workflows start. Rust CI https://github.com/hyperpolymath/echidna/actions/runs/37471899251, CodeQL https://github.com/hyperpolymath/echidna/actions/runs/37471899489, MVP Smoke https://github.com/hyperpolymath/echidna/actions/runs/37471899344 and Zig FFI CI https://github.com/hyperpolymath/echidna/actions/runs/37471899210 are all success.
Previously red gates. Cargo Audit https://github.com/hyperpolymath/echidna/actions/runs/37471899309, Governance https://github.com/hyperpolymath/echidna/actions/runs/37471901129 and Workflow Security Linter https://github.com/hyperpolymath/echidna/actions/runs/37471899351 are all success.
Hypatia baseline burn-down. Tracked in Re-arm the hypatia baseline gate: generate .hypatia-baseline.json (152 findings to grandfather + burn down) #314, not here.

Two reds remain on main, and neither is lock drift:

Mirror to Git Forges https://github.com/hyperpolymath/echidna/actions/runs/37471900931 (forge credentials).
Security Scan https://github.com/hyperpolymath/echidna/actions/runs/37471901353 (HTTP 401 at the verisimdb send, Security Scan red: VERISIMDB_PAT is a dead token (401 Bad credentials) — rotate or delete #310, an owner-held secret).

#410 also pinned the floating refs: dtolnay/rust-toolchain@master to @v1 through the lock, cicd-suite @main to a SHA, and the unpinned hypatia clone to 51ab6496. The standards reusable bump (571cc734 → 5751b97e) was held back. On 5751b97e, the governance R5 step exits silently under bash -e, and a new UUID-v7 job flags Project.toml. That bump will return in its own PR.

From Claude's side this issue is closeable. Jonathan decides.

🤖 Generated with Claude Code

This is a related latent red, not a current one. Standards now has a lock pin contract gate (scripts/check-lock-pin-contract.sh, standards#1381). echidna's actions.lock currently fails it in 18 places: tag-keyed records such as swatinem/rust-cache@v2.9.3 and taiki-e/install-action@v2.87.32, which break canon rule 10 (keys must be SHA pins), plus one self-SHA ref on slsa-framework/slsa-github-generator@f7dd8c5….

The gate does not run at echidna's current standards pin (3c00687), so nothing is red today. It will turn red when echidna moves its standards pin to a commit whose governance runs the contract. The fix is upstream of the lock: SHA-pin those workflow uses: (tag in a trailing comment), then regenerate the lock with the estate order (gh actions-lock → relock-sha-keys → complete-job-refs → close-lock).

#458 has the same 18 findings as main and adds none.

Generated by Claude Code

fix(ci): call standards reusables at metadatastician/standards (#458)

Status after #458 (merged 2026-11-05). The workflows that used to die at startup now run on main, which shows reds they used to hide. Classified from main's push runs at 2ab7574 (2026-11-07):

Workflow (run)	What fails	Cause	Where it is handled
Governance (42351376421)	only `Validate Hypatia Baseline`; 19 of 20 jobs pass	scan findings vs baseline	#314
Rust CI (42351375993)	`cargo fmt` diff in `src/rust/proof_search.rs`	formatting	fixed in #473
Secret Scanner (every PR)	gitleaks `generic-api-key` on `authority_sha=d3e4b48…` in `workflow-linter.yml`	a public commit SHA, false positive	fixed in #473 (anchored single-value exemption, tested both ways)
Mirror (42351376331)	disroot, gitea and sourcehut fail "Verify … SSH host"; bitbucket push fails. Codeberg, GitLab and Radicle pass	forge configuration: `*_SSH_FINGERPRINT` repo variables and keys	owner; estate tracker metadatastician/standards#1002
Static Analysis Gate (42351375995)	`panic-attack assail`: scanner incomplete coverage (exit 2); Deposit job fails as a knock-on	panic-attack at `410a8f8`	panic-attack repo
Security Scan (42351376316)	`./target/release/panic-attack: No such file or directory`	the panic-attack `scan-and-report.yml@be6ac46` reusable never builds its binary. Not the #310 token: the verisimdb step is skipped	panic-attack repo

One regression to note: #455's merge put mirror.yml back on the pre-transfer pin 3c00687, with its old comment. Main now pins standards at three SHAs:

Pin	Workflows
`a797d30`	governance
`d3e4b48`	hypatia, scorecard, spark
`3c00687`	mirror

The lock still closes and lock-sync passes, but standards' relock-standards-pin.sh refuses mixed pins. The next repin has to move all three together. See the §4 amendment in metadatastician/standards#1439.

Generated by Claude Code

Navigation Menu

Repository navigation

CI: pre-existing reds on main (Cargo Audit, governance linters, 3 startup_failures from lock drift) #401

Acceptance criteria

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

CI: pre-existing reds on main (Cargo Audit, governance linters, 3 startup_failures from lock drift) #401

Description

Acceptance criteria

Activity

hyperpolymath commented on Oct 6, 2026

hyperpolymath commented on Nov 4, 2026

hyperpolymath commented on Nov 9, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions