From 3e5f763951d1c3dffaf150a1b5f5abab6661611b Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 16:56:40 +0000 Subject: [PATCH] ci: repin the self-callers to the published name admission PR 94 is on main as 1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6. From that commit the suite admits hyperpolymath/proven-cicd-and-workflows as a caller name. Move the two self-callers to that name and that commit: - secret-scanner.yml called hyperpolymath/proven-cicd at a12b2b4. After this change no workflow in this repository calls the proven-cicd repository. - creusot-live-canary.yml called the new name at 6c6d772, whose resolver refuses that name. Move the call, the ancestry check and both literals in tests/creusot-live-canary.sh together. - config/workflow-lock-scope.json: the reason text named the PR70 pin. Make it name a published suite commit. Two minor review items from PR 94: - README.adoc: tell consumers to pin a commit that contains the migrated main-estate-audit.yml (1fd5e63 or later). - templates/track-estate-audit.yml: extract and replace a SHA only in a complete uses: reference to this suite under hyperpolymath. The earlier pattern had no owner prefix, and sed replaced the SHA in the whole file. Tracker step run on fixtures (bare, single-quoted and double-quoted callers; a fork reference, a near-name owner and an unrelated action at the same SHA): the 3 suite callers move to the new name and SHA, the other 3 references stay, and a second run reports changed=0. The step from main rewrites all 3 of the other references. Local checks: tests/suite-source-compatibility.sh and tests/published-scanner-pin.sh pass through a yq adapter; both --check builders pass; the pin is an ancestor of origin/main. The canary and the yq-based tests need the hosted run. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6 Signed-off-by: Claude --- .github/workflows/creusot-live-canary.yml | 4 ++-- .github/workflows/secret-scanner.yml | 2 +- README.adoc | 3 +++ config/workflow-lock-scope.json | 2 +- templates/track-estate-audit.yml | 7 +++++-- tests/creusot-live-canary.sh | 4 ++-- 6 files changed, 14 insertions(+), 8 deletions(-) diff --git a/.github/workflows/creusot-live-canary.yml b/.github/workflows/creusot-live-canary.yml index 36eb6fe..e0e6d09 100644 --- a/.github/workflows/creusot-live-canary.yml +++ b/.github/workflows/creusot-live-canary.yml @@ -27,7 +27,7 @@ jobs: shell: bash run: | set -euo pipefail - git merge-base --is-ancestor 6c6d772ebe82605ba22254db528faf54faec9f49 origin/main + git merge-base --is-ancestor 1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6 origin/main - name: Fixture prerequisites and missing-prerequisite mutants (not proof) shell: bash run: | @@ -38,7 +38,7 @@ jobs: git diff --exit-code -- tests/fixtures/creusot-live creusot: needs: fixture - uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/creusot-gate.yml@6c6d772ebe82605ba22254db528faf54faec9f49 # published PR70 repair + uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/creusot-gate.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6 # published PR 94 merge: admits this repository name with: working_directory: tests/fixtures/creusot-live creusot_version: '0.14.0' diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index c2e4a30..2f0516a 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -16,7 +16,7 @@ concurrency: cancel-in-progress: true jobs: scan: - uses: hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@a12b2b4644db1a1250bc50b58fd24c99f89f564e + uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6 with: # Keep false until an initial full audit passes and the security owner # accepts introduced-commit PR coverage. All non-PR runs remain full. diff --git a/README.adoc b/README.adoc index 6be1562..b9c67f0 100644 --- a/README.adoc +++ b/README.adoc @@ -312,6 +312,9 @@ jobs: Pin a full SHA, never `+@main+` or a tag: the account enforces `+sha_pinning_required+`, and `+@main+` would silently change the gate in every consuming repository at once. +Pin a commit that contains the migrated `+main-estate-audit.yml+` +(`+1fd5e63+` or later). An earlier commit still names +`+hyperpolymath/cicd-suite+` in its steps. . The caller must be *de-onboarded* from the repository's `+actions.lock+`. Onboarded, a cross-repository reusable-workflow call startup-fails with zero jobs. `+scripts/deonboard-estate-audit.sh +` diff --git a/config/workflow-lock-scope.json b/config/workflow-lock-scope.json index 30fad93..5b2b22c 100644 --- a/config/workflow-lock-scope.json +++ b/config/workflow-lock-scope.json @@ -24,7 +24,7 @@ { "path": ".github/workflows/creusot-live-canary.yml", "mode": "immutable", - "reason": "Narrow real-tool canary pinned to the published PR70 repair; not lock-map onboarding or broad consumer rollout." + "reason": "Narrow real-tool canary pinned to a published suite commit; not lock-map onboarding or broad consumer rollout." }, { "path": ".github/workflows/kanren-gate.yml", diff --git a/templates/track-estate-audit.yml b/templates/track-estate-audit.yml index 08c9f5f..b7b1a25 100644 --- a/templates/track-estate-audit.yml +++ b/templates/track-estate-audit.yml @@ -91,9 +91,12 @@ jobs: continue fi echo "$caller: ${pinned:0:7} -> ${head:0:7}" - sed -i "s/$pinned/$head/g" "$caller" + # Move the SHA only in a complete uses: reference to this + # suite under hyperpolymath. The same SHA in a reference to + # another owner (a fork) stays as it is. + sed -i -E "s#(uses:[[:space:]]*[\"']?hyperpolymath/(cicd-suite|proven-cicd-and-workflows)/\.github/workflows/[A-Za-z0-9_.-]+\.yml@)$pinned#\1$head#g" "$caller" changed=1 - done < <(grep -oE '(cicd-suite|proven-cicd-and-workflows)/\.github/workflows/[A-Za-z0-9_.-]+\.yml@[0-9a-f]{40}' "$caller" | sed 's/.*@//' | sort -u) + done < <(grep -oE 'uses:[[:space:]]*["'"'"']?hyperpolymath/(cicd-suite|proven-cicd-and-workflows)/\.github/workflows/[A-Za-z0-9_.-]+\.yml@[0-9a-f]{40}' "$caller" | sed 's/.*@//' | sort -u) # The suite was renamed from cicd-suite on 2026-11-09. A uses: line # naming the old repository startup-fails (Actions does not follow # renames), so move the coordinate along with the SHA. diff --git a/tests/creusot-live-canary.sh b/tests/creusot-live-canary.sh index 62b048a..03e3cb9 100644 --- a/tests/creusot-live-canary.sh +++ b/tests/creusot-live-canary.sh @@ -7,7 +7,7 @@ command -v cargo >/dev/null || { echo 'real Cargo required' >&2; exit 2; } yq --version | grep -q 'mikefarah/yq' || { echo 'mikefarah yq required' >&2; exit 2; } tmp=$(mktemp -d) trap 'rm -rf "$tmp"' EXIT -pin=hyperpolymath/proven-cicd-and-workflows/.github/workflows/creusot-gate.yml@6c6d772ebe82605ba22254db528faf54faec9f49 +pin=hyperpolymath/proven-cicd-and-workflows/.github/workflows/creusot-gate.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6 # Validate the bounded input and call contract. Every failure propagates even # when this function is called in an `if` (where Bash suppresses errexit). @@ -73,7 +73,7 @@ stage rm "$tmp/tree/tests/fixtures/creusot-live/Cargo.lock" reject 'missing Cargo.lock' stage -sed -i 's/6c6d772ebe82605ba22254db528faf54faec9f49/main/g' "$tmp/tree/.github/workflows/creusot-live-canary.yml" +sed -i 's/1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6/main/g' "$tmp/tree/.github/workflows/creusot-live-canary.yml" reject 'floating gate pin' stage sed -i 's/creusot-std = "=0.14.0"/creusot-std = "=0.13.0"/' "$tmp/tree/tests/fixtures/creusot-live/Cargo.toml"