From d9ed540a605c951497e824bcb0ae239fa63d1a85 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 19:39:26 +0000 Subject: [PATCH 1/3] ci: name the standards repository by its current owner in 5 callers 5 callers name `hyperpolymath/standards` at 740c9d7: `codeql.yml`, `hypatia-scan.yml`, `mirror.yml`, `rust-ci.yml` and `scorecard.yml`. None of them starts. For `rust-ci.yml`, GitHub Actions says: `error parsing called workflow ... hyperpolymath/standards/.github/workflows/ rust-ci-reusable.yml@740c9d7...: workflow was not found` (run 42874779657). The repository now has the owner `metadatastician`. `git` follows the old name, GitHub Actions does not. The commit 740c9d7 is in that repository, on its `main` branch, and has each of the 5 called files. This change replaces only the owner name in the 5 `uses:` lines. Each caller keeps its own pinned commit. The inputs, secrets and permissions of each caller agree with the called file at that commit. The callers start only when the Actions settings of this repository permit reusable workflows from `metadatastician/standards`. Until then each run ends at creation, as the governance caller does. `actions.lock` is not changed. It is owned by `gh actions-lock`. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK --- .github/workflows/codeql.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index af3eeaa..faeae87 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,4 +31,4 @@ jobs: actions: read contents: read security-events: write - uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main as of 2026-06-01 + uses: metadatastician/standards/.github/workflows/codeql-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main as of 2026-06-01 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 4756b4a..8e31dfb 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -19,4 +19,4 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 + uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 0586a77..e2259f2 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -11,7 +11,7 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main 2026-05-30 (Radicle + Instant-Sync secret-presence gating #305) + uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main 2026-05-30 (Radicle + Instant-Sync secret-presence gating #305) secrets: GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 133fbd4..8966e42 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -13,7 +13,7 @@ permissions: contents: read jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main 2026-05-31 (CI/CD campaigns C001-C005) + uses: metadatastician/standards/.github/workflows/rust-ci-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main 2026-05-31 (CI/CD campaigns C001-C005) # The crate's library suite is known to hang past 20 minutes. Keep the # ordinary PR gate aligned with publish.yml: run every named integration # suite explicitly while the library-test deadlock is tracked separately. diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 01b7929..a88a75e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -13,7 +13,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 + uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 permissions: actions: read contents: read From e8276e526fcea2b20fb263eb9810a68ffb76d8b2 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 19:48:05 +0000 Subject: [PATCH 2/3] ci(codeql): scan Rust, the language of this crate The CodeQL caller passed no `language` input, so the called workflow used its default, `javascript-typescript`. A comment in the caller said that echidnabot is JS/TS. It is not: the repository has 55 `.rs` files and no JavaScript or TypeScript file. When the caller starts, a scan for JavaScript finds no source. The caller now passes `language: rust`. This is the Rust-only form that the called workflow documents in its header. `build-mode` stays at its default, `none`. The comment now says what the crate is, and names the standards repository by its current owner. Found in review (CodeRabbit, on line 34). Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK --- .github/workflows/codeql.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index faeae87..fa93c7d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,13 +1,13 @@ # This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# Thin wrapper around hyperpolymath/standards codeql-reusable.yml. +# Thin wrapper around metadatastician/standards codeql-reusable.yml. # Matches the echidna sibling-repo pattern (estate-wide consolidation: # 263 deployments, 69 unique SHAs, 26% structural drift). Default # language is javascript-typescript (84.8% of estate); the reusable is # single-language / single-job by design — multi-language wrappers -# call the reusable once per language. echidnabot is JS/TS today, so -# the default suffices. +# call the reusable once per language. echidnabot is a Rust crate with no +# JavaScript or TypeScript file, so this caller passes `language: rust`. name: CodeQL Security Analysis on: push: @@ -32,3 +32,5 @@ jobs: contents: read security-events: write uses: metadatastician/standards/.github/workflows/codeql-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main as of 2026-06-01 + with: + language: rust From 6f1a76d5a0c4feccd053f47ebb7e5d5639aa50e5 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 10 Nov 2026 20:05:20 +0000 Subject: [PATCH 3/3] ci(codeql): scan the workflow files also (#206) Depends on: #203 ## Summary This pull request is stacked on #203. Its base is the branch of #203, so the diff shows only this change. Merge #203 first. After #203, the CodeQL caller scans the Rust code. The 29 workflow files of this repository have no CodeQL scan. gitbot-fleet scans its workflow files with `language: actions`. This pull request adds the same scan here. ## Changes - `.github/workflows/codeql.yml`: a second job, `analyze-actions`. It calls the same reusable workflow as the job `analyze`, at the same pinned commit (`740c9d7`), with `language: actions` and the same permissions. - 1 comment line in the header of the file. The called workflow takes 1 language for each call. Its header shows this form for more than 1 language: 1 job for each language. ## Testing - `yq` reads the file: 2 jobs, `analyze` with `rust` and `analyze-actions` with `actions`, each with the same `uses:` value. - The called workflow at `740c9d7` passes the language to `languages:` and sets the result category to `/language:`. So the 2 jobs do not write to the same category. Not verified: - A real run. Like the other callers, this job starts only when the Actions settings of this repository permit reusable workflows from `metadatastician/standards`. The first scan can show findings in the workflow files. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK)_ Co-authored-by: Claude --- .github/workflows/codeql.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index fa93c7d..faf95df 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -8,6 +8,7 @@ # single-language / single-job by design — multi-language wrappers # call the reusable once per language. echidnabot is a Rust crate with no # JavaScript or TypeScript file, so this caller passes `language: rust`. +# A second job scans the workflow files (`language: actions`). name: CodeQL Security Analysis on: push: @@ -34,3 +35,11 @@ jobs: uses: metadatastician/standards/.github/workflows/codeql-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main as of 2026-06-01 with: language: rust + analyze-actions: + permissions: + actions: read + contents: read + security-events: write + uses: metadatastician/standards/.github/workflows/codeql-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 + with: + language: actions