From f7dc0dec20964e09393e2dd675a76fe4ce85c66f Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 20:16:29 +0000 Subject: [PATCH] fix(ci): call the secret scanner from proven-cicd-and-workflows hyperpolymath/proven-cicd is being retired; its commits were merged into hyperpolymath/proven-cicd-and-workflows (proven-cicd-and-workflows#95). The fleet scanner moves from proven-cicd@03e858b to proven-cicd-and-workflows@1fd5e63 (the #94 merge). 03e858b is an ancestor of 1fd5e63. The reusable differs in one line: its caller check also admits the new repository name, which this call needs. Its steps (actions/checkout@3d3c42e at lines 28 and 55) are unchanged. The pin is bound in several places, and each moves with it: - scripts/check-scanner-caller.rb and its contract test (expected pin); - scripts/lib/pinned-reusable-sources.json: the active source (blob 3ac563a, content sha256 21ae8d1b...) and its dependency record (repo_id 1326697643, the id of proven-cicd-and-workflows); - scripts/lib/lock-closure-receipts.tsv: the reviewed receipt; - tools/workflow-lock-audit/tests/contracts.rs; - the historical-projection fixture, the preflight and the entrypoint test, which recognise the live caller before they restore the archived 4404c3c proposal; fixtures/SHA256SUMS is updated for the fixture. The full-history policy, permissions, secrets boundary and required contexts are unchanged. Dated migration records are not rewritten. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6 --- .github/workflows/secret-scanner.yml | 2 +- .../fixtures/SHA256SUMS | 2 +- .../fixtures/restore-historical-source.sh | 10 +++++----- .../secret-scanner-cicd-suite/preflight.sh | 2 +- scripts/check-scanner-caller.rb | 2 +- scripts/lib/lock-closure-receipts.tsv | 4 ++-- scripts/lib/pinned-reusable-sources.json | 18 +++++++++--------- .../tests/pinned-source-entrypoints-test.sh | 2 +- scripts/tests/scanner-caller-contract-test.sh | 2 +- tools/workflow-lock-audit/tests/contracts.rs | 8 ++++---- 10 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index f4eb86e0..fff35329 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -36,7 +36,7 @@ jobs: # authority, granting less rejects the run at startup with zero jobs. permissions: contents: read - uses: hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409 + uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6 with: # The old-pin canary does not attest this new pin. Introduced-commit # PR coverage is not approved; every run still scans full history. diff --git a/docs/migrations/secret-scanner-cicd-suite/fixtures/SHA256SUMS b/docs/migrations/secret-scanner-cicd-suite/fixtures/SHA256SUMS index b38f4641..491d50a3 100644 --- a/docs/migrations/secret-scanner-cicd-suite/fixtures/SHA256SUMS +++ b/docs/migrations/secret-scanner-cicd-suite/fixtures/SHA256SUMS @@ -1,3 +1,3 @@ 4745e9318346b1a3eae2e0bf65c6732f73d2ead78ef29de9e20659a71f8057d8 cicd-suite-4404c3c0474e17753fe7689f3485c02890aac113-secret-scanner-reusable.yml cba6cd207cb474563a7bc53bf31c72eaf1c42b4dcd3451d2cce0d8581949b5e8 historical-source.json -bbe92a3a3e1e78bc145f9397ad073e7a5e783c323127e0c1c701facabbcc4379 restore-historical-source.sh +bc601a927657f973d96f228590d667bad93b73d9b42d132419d98ca792b6f5c8 restore-historical-source.sh diff --git a/docs/migrations/secret-scanner-cicd-suite/fixtures/restore-historical-source.sh b/docs/migrations/secret-scanner-cicd-suite/fixtures/restore-historical-source.sh index 3acfb714..2bfaa2ae 100644 --- a/docs/migrations/secret-scanner-cicd-suite/fixtures/restore-historical-source.sh +++ b/docs/migrations/secret-scanner-cicd-suite/fixtures/restore-historical-source.sh @@ -8,7 +8,7 @@ manifest="$tree/scripts/lib/pinned-reusable-sources.json" workflow="$tree/.github/workflows/secret-scanner.yml" receipts="$tree/scripts/lib/lock-closure-receipts.tsv" old='hyperpolymath/cicd-suite/.github/workflows/secret-scanner-reusable.yml@4404c3c0474e17753fe7689f3485c02890aac113' -new='hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409' +new='hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6' # Refuse anything other than the known deployed successor; do not silently # reinterpret a later caller or a damaged source catalog as this old plan. OLD_CALL="$old" NEW_CALL="$new" python3 - "$workflow" <<'PY' @@ -22,15 +22,15 @@ if s.count(new) != 1 or old in s: raise SystemExit('historical projection: unexpected scanner caller') p.write_text(s.replace(new, old)) PY -jq -e '[.sources[] | select(.repository=="hyperpolymath/proven-cicd" and .commit=="03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409" and .role=="active")] | length == 1' "$manifest" >/dev/null +jq -e '[.sources[] | select(.repository=="hyperpolymath/proven-cicd-and-workflows" and .commit=="1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6" and .role=="active")] | length == 1' "$manifest" >/dev/null jq --slurpfile prior "$fixture" ' - .sources |= (map(select(.repository != "hyperpolymath/proven-cicd" or .commit != "03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409")) + [$prior[0].source]) | - del(.dependencies["hyperpolymath/proven-cicd@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409"]) | + .sources |= (map(select(.repository != "hyperpolymath/proven-cicd-and-workflows" or .commit != "1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6")) + [$prior[0].source]) | + del(.dependencies["hyperpolymath/proven-cicd-and-workflows@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6"]) | .dependencies["hyperpolymath/cicd-suite@4404c3c0474e17753fe7689f3485c02890aac113"] = $prior[0].dependency ' "$manifest" > "$manifest.tmp" mv "$manifest.tmp" "$manifest" # The archived proposal has its own source receipt; keep unrelated receipts. -awk '$0 !~ /^# Reviewed source: hyperpolymath\/proven-cicd\// && $0 !~ /^hyperpolymath\/proven-cicd\t/' "$receipts" > "$receipts.tmp" +awk '$0 !~ /^# Reviewed source: hyperpolymath\/proven-cicd-and-workflows\// && $0 !~ /^hyperpolymath\/proven-cicd-and-workflows\t/' "$receipts" > "$receipts.tmp" printf '%s\n' '# Reviewed historical cicd-suite scanner source' >> "$receipts.tmp" printf 'hyperpolymath/cicd-suite\t4404c3c0474e17753fe7689f3485c02890aac113\tactions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1\n' >> "$receipts.tmp" mv "$receipts.tmp" "$receipts" diff --git a/docs/migrations/secret-scanner-cicd-suite/preflight.sh b/docs/migrations/secret-scanner-cicd-suite/preflight.sh index 38d30091..1baf0f89 100755 --- a/docs/migrations/secret-scanner-cicd-suite/preflight.sh +++ b/docs/migrations/secret-scanner-cicd-suite/preflight.sh @@ -87,7 +87,7 @@ fi # this disposable tree. This preserves the historical canary gate without # pretending it verifies the newer deployed caller; E2E separately authenticates # the live source and tests its scanner contract. -if grep -Fq 'uses: hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409' "$TMP/tree/.github/workflows/secret-scanner.yml" 2>/dev/null; then +if grep -Fq 'uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6' "$TMP/tree/.github/workflows/secret-scanner.yml" 2>/dev/null; then if ! bash "$MIG/fixtures/restore-historical-source.sh" "$TMP/tree" "$MIG/fixtures/historical-source.json"; then finding TREE "could not reconstruct the historical scanner proposal" fi diff --git a/scripts/check-scanner-caller.rb b/scripts/check-scanner-caller.rb index b62af3f7..1d329c26 100644 --- a/scripts/check-scanner-caller.rb +++ b/scripts/check-scanner-caller.rb @@ -4,7 +4,7 @@ require 'psych' path = ARGV.fetch(0, '.github/workflows/secret-scanner.yml') -expected = 'hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409' +expected = 'hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6' # Validate a Psych node and its descendants before loading the workflow. # Raises RuntimeError for aliases, non-scalar mapping keys, or duplicate keys diff --git a/scripts/lib/lock-closure-receipts.tsv b/scripts/lib/lock-closure-receipts.tsv index 16f45ecb..61299ce2 100644 --- a/scripts/lib/lock-closure-receipts.tsv +++ b/scripts/lib/lock-closure-receipts.tsv @@ -61,5 +61,5 @@ metadatastician/standards ea2f4d8a886585ed442687ae63d4ad7493379ba4 editorconfig- metadatastician/standards ea2f4d8a886585ed442687ae63d4ad7493379ba4 erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 metadatastician/standards ea2f4d8a886585ed442687ae63d4ad7493379ba4 oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 -# Reviewed source: hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409 -hyperpolymath/proven-cicd 03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409 actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 +# Reviewed source: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6 +hyperpolymath/proven-cicd-and-workflows 1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6 actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 diff --git a/scripts/lib/pinned-reusable-sources.json b/scripts/lib/pinned-reusable-sources.json index 75186a0a..88a592a2 100644 --- a/scripts/lib/pinned-reusable-sources.json +++ b/scripts/lib/pinned-reusable-sources.json @@ -699,11 +699,11 @@ "local_file": "C:\\Users\\sudoodle\\OneDrive\\Documents\\ChatGPT\\TYPE THEORY\\echo-reader-compat-20261106\\closure-cycle-20261107\\sources\\metadatastician\\standards\\75bd5994470661a099df562d6d5ad2fe744dbd66\\.github\\workflows\\secret-scanner-reusable.yml" }, { - "repository": "hyperpolymath/proven-cicd", - "commit": "03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409", + "repository": "hyperpolymath/proven-cicd-and-workflows", + "commit": "1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6", "path": ".github/workflows/secret-scanner-reusable.yml", - "blob": "b75b630ab6bee9943573502f0ace580078ef92ae", - "content_sha256": "02e34046c20f25c6b1e9ada99bd46294e33cc90a792fefa427f09aef098dcad9", + "blob": "3ac563a8da07619459d190a2e75d1742216a9818", + "content_sha256": "21ae8d1ba45cf078106fcce5314f68635e17f6636991b8466f1c2a5e1d6e9cbf", "role": "active", "callers": [ { @@ -724,7 +724,7 @@ "line": 55 } ], - "source_url": "https://github.com/hyperpolymath/proven-cicd/blob/03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409/.github/workflows/secret-scanner-reusable.yml" + "source_url": "https://github.com/hyperpolymath/proven-cicd-and-workflows/blob/1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6/.github/workflows/secret-scanner-reusable.yml" } ], "dependencies": { @@ -833,11 +833,11 @@ "owner_id": 44036562, "repo_id": 192625955 }, - "hyperpolymath/proven-cicd@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409": { - "ref": "03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409", - "commit": "sha1-03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409", + "hyperpolymath/proven-cicd-and-workflows@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6": { + "ref": "1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6", + "commit": "sha1-1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6", "owner_id": 6759885, - "repo_id": 1446155688, + "repo_id": 1326697643, "uses": [ "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" ] diff --git a/scripts/tests/pinned-source-entrypoints-test.sh b/scripts/tests/pinned-source-entrypoints-test.sh index d00f13a5..d70e3ea7 100644 --- a/scripts/tests/pinned-source-entrypoints-test.sh +++ b/scripts/tests/pinned-source-entrypoints-test.sh @@ -24,7 +24,7 @@ cp "$ROOT/$MIG/preflight.sh" "$ROOT/$MIG/required-contexts.txt" "$BASE/$MIG/" cp -R "$ROOT/$MIG/fixtures" "$ROOT/$MIG/patches" "$BASE/$MIG/" # Exercise the original migration proposal, not the newer live caller. # Its archived source and receipt are reconstructed only in this fixture. -if grep -Fq 'uses: hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409' "$BASE/.github/workflows/secret-scanner.yml"; then +if grep -Fq 'uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6' "$BASE/.github/workflows/secret-scanner.yml"; then bash "$BASE/$MIG/fixtures/restore-historical-source.sh" "$BASE" "$BASE/$MIG/fixtures/historical-source.json" fi # Deliberately omit the canary directory. Every invocation binds --receipt to diff --git a/scripts/tests/scanner-caller-contract-test.sh b/scripts/tests/scanner-caller-contract-test.sh index 2a5d0271..cba42e16 100644 --- a/scripts/tests/scanner-caller-contract-test.sh +++ b/scripts/tests/scanner-caller-contract-test.sh @@ -19,7 +19,7 @@ reject() { sed -i 's/fast-pr: false/fast-pr: true/' "$wf"; reject 'fast PR scanning' printf ' secrets: inherit\n' >> "$wf"; reject 'inherited secrets' sed -i 's/contents: read/contents: write/' "$wf"; reject 'excess permissions' -sed -i 's/03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409/main/' "$wf"; reject 'mutable suite ref' +sed -i 's/1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6/main/' "$wf"; reject 'mutable suite ref' printf '\n scan:\n uses: bad/repo/.github/workflows/bad.yml@main\n' >> "$wf"; reject 'duplicate job' echo 'scanner caller negative controls passed' diff --git a/tools/workflow-lock-audit/tests/contracts.rs b/tools/workflow-lock-audit/tests/contracts.rs index 7bb4c199..35292e80 100644 --- a/tools/workflow-lock-audit/tests/contracts.rs +++ b/tools/workflow-lock-audit/tests/contracts.rs @@ -367,11 +367,11 @@ fn scanner_source_pin_and_supported_lock_scope() { let lock: Value = parse_yaml(&fs::read_to_string(repo().join(".github/workflows/actions.lock")).unwrap()) .unwrap(); - let pin = "03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409"; + let pin = "1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6"; assert_eq!( workflow["jobs"]["scan"]["uses"], text(&format!( - "hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@{pin}" + "hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@{pin}" )) ); assert_eq!( @@ -379,7 +379,7 @@ fn scanner_source_pin_and_supported_lock_scope() { value("[]") ); assert!(lock["dependencies"] - .get(format!("hyperpolymath/proven-cicd@{pin}")) + .get(format!("hyperpolymath/proven-cicd-and-workflows@{pin}")) .is_none()); // Job-level reusables are outside the supported lock generator's scope. // Require a separately source-verified active root for this exact caller. @@ -392,7 +392,7 @@ fn scanner_source_pin_and_supported_lock_scope() { .unwrap() .iter() .filter(|source| { - source["repository"] == "hyperpolymath/proven-cicd" + source["repository"] == "hyperpolymath/proven-cicd-and-workflows" && source["commit"] == pin && source["role"] == "active" && source["callers"].as_array().unwrap().iter().any(|caller| {