You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
ci: pause Bitbucket, SourceHut and Disroot mirrors - #178
Pause these three targets at the owner's explicit request while their approved host/credential details are prepared. Omit only their forwarded keys, using the pinned reusable workflow's existing key-presence guards. The secrets remain stored, and GitLab, Codeberg and Radicle keep their current configuration.
Validation: inspected every paused target's pinned reusable steps; agent setup, host verification and push are guarded by the corresponding nonempty key. Hosted checks and a branch mirror dispatch will verify the pause before merge.
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 1cb41987-4384-4ec4-b059-dd1ed0d01e02
Commits
Reviewing files that changed from the base of the PR and between 8d816c8 and a26a9fa.
Files selected for processing: 1
.github/workflows/mirror.yml
Summary
Summary by CodeRabbit
Changes
Mirroring to Bitbucket, SourceHut and Disroot is paused while host and credential configuration is pending. Codeberg mirroring continues.
The mirror workflow continues to pass CODEBERG_SSH_KEY. It no longer passes keys for Bitbucket, SourceHut or Disroot. Comments state that these targets are paused pending approved host and credential configuration.
Changes: Mirror key mapping
Layer / File(s)
Summary
Pause targets without configured keys .github/workflows/mirror.yml
The workflow removes the BITBUCKET_SSH_KEY, SOURCEHUT_SSH_KEY and DISROOT_SSH_KEY mappings. Comments state that targets without a passed key are skipped and that each mapping can be restored when its configuration is ready.
hyperpolymath/panll#171: Pins the reusable mirror workflow that provides the key-presence guards.
hyperpolymath/panll#172: Uses key omission to pause a mirror target pending host configuration.
Suggested reviewers:metadatastician
Merge Risk: Minimal · previous review 8d816
The change omits the three paused mirror credentials while retaining the other mappings. No concrete merge-blocking defect was established; the pinned workflow’s handling of omitted credentials remains unverified.
Pre-merge checks: 5
Check name
Status
Explanation
Title check
The title clearly identifies the three mirror targets that the PR pauses.
Description check
The description explains the paused mirror targets and the changes to their forwarded keys.
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
🟢 no graded findings (job: success) · advisory in grid scope: 🟢 green (0 critical, 0 high, not grading)
same run
Scope: the three lanes below are static checks at the named commit. A
green row means every applicable check in its declared scope passed;
orange means evidence is missing, not that nothing was found. The
Hypatia verdict covers GATING rows only; advisory reporters are listed
in its grid and their severity counts are limited to the grid scope.
A blocking gate may inspect findings outside the delta grid’s grade; open
the linked run and check annotations for the failing step and, where
applicable, the finding. No row is a security certification.
K9 live corpus (L0–L2): 1 finding(s) / scope notes
coordination.k9 — not_applicable: Routed to another dialect; not validated as a K9 contract.
Scope: K9 components L0–L2 against contract v1.0.0 at the named standards commit. L3 signature verification and routed coordination-dialect files are not certified. Green is limited to this scope. Orange is missing evidence; yellow is grandfathered debt or warnings; grey is an explicit scope exclusion. report.json, badge.json and the validator logs are in the k9-grid artifact on the linked run.
Hypatia verdict grid
🟢 clean · commit a26a9fa0fec2 · run 42243537718 · scope: this change (1 file(s)) · excludes 9-archive/
Advisory: 2 row(s), worst 🟢 clean (0 critical, 0 high in grid scope) — reported, never grading the change.
Unique graded findings across gating and advisory rows: 0 (0 reporter observations; 0 without sufficient identity to corroborate). Row counts remain per reporter; unique totals do not change gating.
Raw Hypatia alert-derived observations: 31 (code-scanning, Dependabot and secret-scanning; some may also be in SARIF; not an extra total).
Reporter
Gate
Status
Critical
High
Medium
Minor
Since previous revision
Hypatia scan
gating
🟢 clean
0
0
0
0
— no comparable baseline (no prior PR grid or unreadable snapshot)
panic-attack assail
advisory
🟢 clean
0
0
0
0
— no comparable baseline (no prior PR grid or unreadable snapshot)
pons asinorum
advisory
🟢 clean
0
0
0
0
— no comparable baseline (no prior PR grid or unreadable snapshot)
Hypatia scan: 57 finding(s)
57 further finding(s) in files this change does not touch: reported, not graded (7 critical, 4 high).
panic-attack assail: 59 finding(s)
59 further finding(s) in files this change does not touch: reported, not graded (4 critical, 0 high).
pons asinorum: 9 finding(s)
9 further finding(s) in files this change does not touch: reported, not graded (0 critical, 0 high).
Scope: static findings reported by each row's tool at the named commit. The table grades only findings in files this change touches, so the colour answers "does this change introduce anything?", not "what does the whole repository still carry?". Standing findings are counted in each accordion and in report.json; the baseline filter remains the place where acknowledged debt is recorded. The lane state is the worst GATING row; advisory rows are listed and counted but never set it. Purple, red, yellow and blue grade the worst GRADED finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run.
The reason will be displayed to describe this comment to others. Learn more.
Additional comments: 1
.github/workflows/mirror.yml: 1
20-23: Minor · Potential issue · Heavy lift
Unverified finding
We couldn't verify this from the code. It is shown for review, not as a verified issue.
The pause removes keys only from this reusable-workflow call; another mirror entry point could still pass the retained secrets.
Bitbucket, SourceHut or Disroot can continue receiving updates through that path.
This can occur when: Another workflow or automation path runs a mirror operation for the same repository after this change.
Review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 94e7412e-246a-4f82-9817-994321e5738f
Commits
Reviewing files that changed from the base of the PR and between 10b032c and 8d816c8.
Files selected for processing: 1
.github/workflows/mirror.yml
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
Source excerpt: **Rule:** Do not introduce Tauri references or dependencies — Gossamer is the desktop backend Source excerpt: **Rule:** All state management uses TEA (Model -> Msg -> Update -> View) — no MVC, Redux, hooks, or other patterns...
)
PanLL's proof guidance still deferred Rust verification to ordinary
tests and did not name the default first-party Rust toolset. Allocate
concrete provenance and IPC/PCC obligations to Creusot with Pearlite and
Verus under standards §1.2, keeping unexecuted implementation proofs
OPEN and dependency behavior ASSUMED.
The ledger separates implementation evidence from cryptographic
hardness, civil identity approval, independent witnesses and checkpoint
operation. No proof is claimed by this documentation change.
Reconciliation evidence: the existing markerless-worktree example test
was explicitly rerun on current main with `cargo test --manifest-path
Cargo.toml -p panll-provenance --example record --locked`: 1 passed, 0
failed. The old #175 thread now links the merged fix and this receipt
and is resolved. Current-main Build Validation 42247456170 and Rust CI
42247457884 pass after #177/#178. Documentation whitespace check passed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Pause these three targets at the owner's explicit request while their approved host/credential details are prepared. Omit only their forwarded keys, using the pinned reusable workflow's existing key-presence guards. The secrets remain stored, and GitLab, Codeberg and Radicle keep their current configuration.
Validation: inspected every paused target's pinned reusable steps; agent setup, host verification and push are guarded by the corresponding nonempty key. Hosted checks and a branch mirror dispatch will verify the pause before merge.