From 047fd36d58d891a47a6b3a286f46e535dfba10ae Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 31 Oct 2026 11:06:24 +0000 Subject: [PATCH 1/4] ci: add pinned, read-only squabbler canary gate --- .github/workflows/cicd-squabbler.yml | 36 ++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 .github/workflows/cicd-squabbler.yml diff --git a/.github/workflows/cicd-squabbler.yml b/.github/workflows/cicd-squabbler.yml new file mode 100644 index 00000000..d2cb7206 --- /dev/null +++ b/.github/workflows/cicd-squabbler.yml @@ -0,0 +1,36 @@ +# SPDX-License-Identifier: MPL-2.0 +# This workflow is managed by gh actions-lock. +# +# Independent CI/CD steward canary. The hard chains job fails closed on +# cycles, dead upstreams, and tool errors; the optional fight report is +# advisory only, never --apply or an override of a required check. +# This checks the repo on PRs, pushes, and periodically for upstream drift. +name: CICD Squabbler + +on: + pull_request: + push: + branches: [main] + schedule: + - cron: '17 7 * * 1' + workflow_dispatch: + +concurrency: + group: squabbler-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + squabbler: + name: Squabbler gate and advisory + permissions: + contents: read + pull-requests: read + attestations: read + uses: metadatastician/standards/.github/workflows/cicd-squabbler-reusable.yml@1725bebd3773ea25627479f813283abf1c497a85 + with: + pr-number: ${{ github.event.pull_request.number && format('{0}', github.event.pull_request.number) || '' }} + secrets: + ADMINISTRATION_READ_TOKEN: ${{ secrets.HYPATIA_SCAN_PAT }} From 2e74e4d998ffdb5acdb14219662e56d56ebacdcd Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 31 Oct 2026 11:06:36 +0000 Subject: [PATCH 2/4] ci: register squabbler canary in Actions lock closure --- .github/workflows/actions.lock | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 533cd389..329b3239 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -15,6 +15,8 @@ workflows: - 'actions/upload-artifact@v7.0.2' - 'dtolnay/rust-toolchain@v1' - 'taiki-e/install-action@v2.88.0' + '.github/workflows/cicd-squabbler.yml': + - 'metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85' '.github/workflows/ci-health-sweep.yml': - 'actions/checkout@v7.0.1' - 'step-security/harden-runner@v2.22.3' From 3f9b52b1834a3e2f43adad4ee4e517411e80c8b8 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 31 Oct 2026 11:08:06 +0000 Subject: [PATCH 3/4] ci: use same-owner pinned squabble action to avoid cross-owner startup failure --- .github/workflows/cicd-squabbler.yml | 66 +++++++++++++++++++++------- 1 file changed, 51 insertions(+), 15 deletions(-) diff --git a/.github/workflows/cicd-squabbler.yml b/.github/workflows/cicd-squabbler.yml index d2cb7206..b3be48c5 100644 --- a/.github/workflows/cicd-squabbler.yml +++ b/.github/workflows/cicd-squabbler.yml @@ -1,10 +1,10 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # -# Independent CI/CD steward canary. The hard chains job fails closed on -# cycles, dead upstreams, and tool errors; the optional fight report is -# advisory only, never --apply or an override of a required check. -# This checks the repo on PRs, pushes, and periodically for upstream drift. +# Independent squabbler canary: use the same-owner, commit-pinned action. +# Cross-owner reusable startup is blocked in this caller's effective Actions +# policy; this avoids silently equating a zero-job startup_failure to green. +# No administration token, no --apply, and no write permissions. name: CICD Squabbler on: @@ -21,16 +21,52 @@ concurrency: permissions: contents: read + attestations: read jobs: - squabbler: - name: Squabbler gate and advisory - permissions: - contents: read - pull-requests: read - attestations: read - uses: metadatastician/standards/.github/workflows/cicd-squabbler-reusable.yml@1725bebd3773ea25627479f813283abf1c497a85 - with: - pr-number: ${{ github.event.pull_request.number && format('{0}', github.event.pull_request.number) || '' }} - secrets: - ADMINISTRATION_READ_TOKEN: ${{ secrets.HYPATIA_SCAN_PAT }} + chains: + name: Squabble chains (hard gate) + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - name: Check out repository at the event SHA + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Install pinned and attested squabble + id: squabble + uses: hyperpolymath/cicd-squabbler/.github/actions/squabble@1ab1507a424c9edfe6cb53dea4e33a2f3cc558e3 + with: + args: "" + + - name: Audit dependency chains (fail closed) + env: + GH_TOKEN: ${{ github.token }} + REPO: ${{ github.repository }} + SQUABBLE_BIN: ${{ steps.squabble.outputs.path }} + run: | + set -uo pipefail + if [ ! -x "$SQUABBLE_BIN" ]; then + echo "::error::Pinned squabble did not install" + exit 1 + fi + rc=0 + "$SQUABBLE_BIN" chains ".=$REPO" --follow 1 | tee "$RUNNER_TEMP/squabble-chains.txt" || rc=$? + { + echo "### Squabble chains" + echo + echo '~~~' + cat "$RUNNER_TEMP/squabble-chains.txt" + echo '~~~' + echo + echo "Exit code: $rc; no remediation was applied." + } >> "$GITHUB_STEP_SUMMARY" + if [ "$rc" -eq 4 ]; then + echo "::error::Cycle or dead upstream blocked the CI dependency graph" + exit 1 + fi + if [ "$rc" -ne 0 ]; then + echo "::error::Squabble could not establish the CI dependency graph (exit $rc)" + exit 1 + fi From a04ca1aeb352cc0fb27841ca0992a772da33ac92 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 31 Oct 2026 11:08:16 +0000 Subject: [PATCH 4/4] ci: update squabbler action lock closure for direct canary --- .github/workflows/actions.lock | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 329b3239..3ae53ce2 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -16,7 +16,8 @@ workflows: - 'dtolnay/rust-toolchain@v1' - 'taiki-e/install-action@v2.88.0' '.github/workflows/cicd-squabbler.yml': - - 'metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85' + - 'actions/checkout@v7.0.1' + - 'hyperpolymath/cicd-squabbler@1ab1507a424c9edfe6cb53dea4e33a2f3cc558e3' '.github/workflows/ci-health-sweep.yml': - 'actions/checkout@v7.0.1' - 'step-security/harden-runner@v2.22.3'