Repository navigation
fix(ci): re-pin standards reusables past the lockfile boundary - #48
Merged
Merged
Conversation
…n caller perms The five standards-reusable callers were the last startup_failures: enforcement demands a lockfile in the CALLED repo at the pinned ref, and d135b05 predates standards' actions.lock (#570). Re-pin all five to 5a597720 (standards main, lockfile present). The 186-commit jump also raised the reusables' permission demands — governance/hypatia/mirror/scorecard now declare `actions: read`, and a reusable requesting more than its caller grants is itself a startup_failure. Callers now grant the exact union each reusable requests (job-level blocks replace, not merge, so scorecard's job block carries the full set). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedRe-pins standards reusables past the lockfile boundary and aligns caller permissions to satisfy current workflow demands. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 7 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
hyperpolymath
disabled auto-merge
August 3, 2026 18:51
hyperpolymath
added a commit
that referenced
this pull request
Aug 4, 2026
…etes #48) (#50) #48 was merged before this branch's final two commits, so main still lacks the pieces that actually revive the five reusable callers: 1. **Hand-added lockfile entries** for the reusable-caller workflows (`governance`/`hypatia-scan`/`mirror`/`scorecard`/`secret-scanner`: `[]`) — `gh actions-lock` v0.1.6 skips reusable-only workflows but enforcement still rejects them by name ("The following workflows are missing a lockfile: … hypatia-scan.yml"). 2. **Re-pin `5a59772` → `fcb8669`** — standards #571/#572 landed after the first re-pin, restoring its gates; `fcb8669` verified via the commits API. This PR's own wave is the decisive consumer-half test. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
hyperpolymath
pushed a commit
that referenced
this pull request
Nov 4, 2026
…standards@857ff09 (the repository was transferred) What was wrong: every workflow here that calls a hyperpolymath/standards reusable (.github/workflows/governance.yml .github/workflows/hypatia-scan.yml .github/workflows/mirror.yml .github/workflows/scorecard.yml .github/workflows/secret-scanner.yml ) has failed before any job was created since 2026-10-26: `hyperpolymath/standards` was transferred to `metadatastician/standards` and GitHub Actions does not follow repository redirects for `jobs.<id>.uses` (run annotation: "error parsing called workflow ... workflow was not found"). Because the ruleset's only required status check, `scan / gitleaks`, is a job of the called secret-scanner workflow, no pull request in this repository could satisfy it. The owner has already made the same move in trope-checker (#107, #110), where the scanner has been green on main since 2026-10-31, and in vocarium's own secret-scanner.yml (#48). What changed: only the `uses:` lines — each caller now names metadatastician/standards/.github/workflows/<same file>@857ff096af11451841fb10488fed1438523973a1, the commit trope-checker main uses. Every input and secret those reusables declare at that commit is optional, so the callers' with/secrets blocks are left as they were. Nothing else in the files changes. What this does NOT fix (owner-only, repository settings): the Actions policy "Allow select actions and reusable workflows" must also permit `metadatastician/standards/.github/workflows/*@*`; until it does, these runs end in a startup failure that names that policy (as vocarium's re-pointed scanner does today). The re-point is necessary either way. What I ran: actionlint -shellcheck= -pyflakes= over the changed files -> clean. What I did not run: the workflows themselves; the runs on this branch are the test, and the `scan / gitleaks` job appearing is the discriminating signal. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J4QvDh3p24SCUjyM9HHT31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes the revival begun in #46: the five standards-reusable callers (Governance, Hypatia scan, Secret scan, Mirror, Scorecard) were still
startup_failurebecause enforcement requires a lockfile in the called repo at the pinned ref, andd135b05predates standards'actions.lock(standards#570). This re-pins all five to5a597720and aligns caller permission grants with the reusables' current demands (actions: readadded; scorecard's job-level block carries the full union since job blocks replace top-level).If these five execute on this PR (or on main post-merge for the push-only ones), haec is the first estate repo fully through both lockfile stages — proving the consumer half of the template.
🤖 Generated with Claude Code