Worktree maa ci repair - #147
Merged
Merged
Conversation
…e 2026-06-17 `Config::load_config` opened three blocks on one collapsed line but closed only two, so `cargo build` failed with "this file contains an unclosed delimiter". Introduced by b5322c2 ("security: remediate Track C and Track E findings"), which correctly added a 1 MiB read cap to stop a hostile `.aletheia.toml` exhausting memory, but collapsed the block onto a single line and dropped a brace. The crate has therefore not built for over a month. Nothing caught it because nothing ever built this code: `aletheia/` is vendored as plain files, so its 16 nested workflows never execute, and no root workflow referenced cargo. A root Rust CI gate lands separately in this branch. The security intent is preserved exactly — the 1 MiB `take()` cap is retained and now commented. `mut` is dropped from the binding because `Read::take` consumes `self`, so it was an unused-mut warning waiting to happen. Verified: cargo build clean; 26/26 unit tests pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Mechanical `cargo fmt` across the crate; no behavioural change. This makes the `cargo fmt --check` gate added in this branch pass from the outset rather than landing pre-broken. Note: `rustfmt.toml` sets 18 nightly-only options (wrap_comments, imports_granularity, group_imports, brace_style, …) which stable rustfmt silently ignores. The formatting here is therefore stable-rustfmt's, not the configured intent. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Two independent CI defects. 1. aletheia had no CI anywhere. `aletheia/` is vendored as plain tracked files (mode 100644), not a submodule. GitHub Actions only reads `.github/workflows/` at the repository root, so the 16 workflow files under `aletheia/.github/workflows/` — rust-ci, codeql, cflite, SLSA3 provenance, ghcr-publish — have never executed. No standalone `hyperpolymath/aletheia` repo runs them either; it was removed from GitHub in early 2026. No root workflow mentioned cargo or rust, and root codeql.yml's language matrix excludes Rust, so ~962 lines went entirely ungated. The consequence is the month-long compile break fixed earlier in this branch. Adds `.github/workflows/rust-ci.yml` at the root: debug + release build, the 26 unit tests, `cargo fmt --check`, and an explicit zero-dependency check enforcing the RSR Bronze constraint from aletheia/CLAUDE.md. It uses the runner's preinstalled Rust rather than a third-party toolchain action, so it adds no new supply-chain surface. Deliberately NOT gated, because both are genuinely red and a hollow green job is worse than none: the 27/29 failing integration tests (they exercise a CLI surface src/main.rs does not implement) and `clippy -D warnings` (25 findings, mostly dead code from modules main.rs never wires up). Both are filed as issues and documented in the workflow header. Neither is masked with continue-on-error. Adds `aletheia/.github/workflows/README.md` so the next person does not edit an inert workflow and wonder why nothing happens. 2. Governance was red on main. `.github/workflows/pages.yml` was missing its SPDX header — a real gate catching a real defect. Header added to match every other workflow in the directory. All commands verified locally before committing: build, unit tests, fmt check and the zero-dependency check all pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The gitlink pointed at ad085baa7d25de23fd9cf4de3e88e5896e35c708, which does not exist in hyperpolymath/absolute-zero (GitHub API returns 422) and is absent from the GitLab and Codeberg mirrors. It was orphaned by an upstream history rewrite during the estate-wide Ddraig SSG rollout. Consequences: Dependabot has failed since 2026-07-20 with "upload-pack: not our ref ad085baa…"; any `submodules: recursive` checkout fails; the local submodule could not be initialised; and the CNO reference implementation was unreachable. Re-pinned to current upstream main, 87902bb770e767c10e065d9ac75d111e80a01be1. NOTE FOR REVIEW: this is a semantic bump, not a restore. The content of the old pin is unrecoverable, so it cannot be verified that 87902bb7 is the intended CNO state — please confirm. Per .gitmodules, pointer bumps are a deliberate act. Re-pinning may also not be durable on its own: the pin was orphaned by an upstream force-push, so the next sweep can re-orphan it. This repo has already oscillated three times (#89 convert to submodule, bef4c92 remove it, #117 restore .gitmodules). Worth settling submodule-vs-vendor, or barring force-push on absolute-zero main. Verified: `git submodule update --init absolute-zero` now succeeds and checks out 87902bb7 cleanly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Fixing the missing SPDX header earlier in this branch advanced the Governance
workflow-security linter *past* its first gate — it `exit 1`s immediately after the
SPDX/permissions block — which uncovered a second defect in the same file that had
been masked all along:
ERROR: Found unpinned actions:
.github/workflows/pages.yml:25 actions/checkout@v4
.github/workflows/pages.yml:27 actions/checkout@v4
.github/workflows/pages.yml:44 actions/upload-pages-artifact@v3
.github/workflows/pages.yml:57 actions/deploy-pages@v4
Same root cause as the missing header: pages.yml was dropped in by the Ddraig SSG
mass-rollout (#121) without this repo's SPDX + SHA-pinning conventions.
Pins are copied verbatim from .github/workflows/casket-pages.yml — the active,
already-compliant Pages workflow in this repo — rather than newly chosen, so the two
Pages workflows now agree. That also moves upload-pages-artifact v3 -> v5.0.0 and
deploy-pages v4 -> v5.0.0, which is what makes them consistent.
No runtime risk today: "GitHub Pages (Ddraig SSG)" is disabled_manually, so this
unblocks a linter on a workflow that does not currently run.
Verified: every action under .github/workflows/ is now SHA-pinned (no @vN/@main/@master
remains), and both modified workflows parse as valid YAML.
Note: `governance / Check Workflow Staleness` remains red and is NOT addressed here.
It was already failing on main before this branch existed (run 29688088909) — the
standards reusable pins d7c2271 are 59 commits/24d behind HEAD 8813ecf. That refresh
is shared across all callers and is being coordinated centrally, so it is deliberately
left alone.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedRepairs broken compilation and missing Rust CI for aletheia, SHA-pins GitHub Actions in pages.yml, and re-pins the absolute-zero submodule. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
|
|
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
hyperpolymath
added a commit
that referenced
this pull request
Aug 3, 2026
Rebased onto current main and brought the two documents back into agreement
with reality. All figures re-checked; none needed changing.
- OSSF Scorecard is now PASS. It was dying at checkout on the stray gitlink;
#145 merged and it has been green on main since. Recorded, with the reason
it could not be proven on the PR: scorecard.yml triggers only on
push-to-main / schedule / workflow_dispatch, never on pull_request.
- #145 marked MERGED rather than open.
New landmine, found while re-baselining: **a merged PR can change nothing.**
Both #146 ("ci(codeql): cron weekly→monthly") and #147 ("Worktree maa ci
repair") are empty — `git diff` between their parents and merge commits is
completely blank. #146's stated change was already present; codeql.yml has read
`cron: '0 6 1 * *'` (monthly) since before it merged.
This is the sibling of the landmine already recorded above it. That one says a
merged PR may not contain the work you pushed; this one says a merged PR may not
contain any work at all. A PR title is not evidence the change happened —
check `git diff --stat <parent> <merge>`.
Verified: asciidoctor renders clean; `yq -p toml` parses STATE.a2ml in full.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #
Type of change
How has this been verified?
Checklist
git commit -S).SPDX-License-Identifier(code/configMPL-2.0,prose
CC-BY-SA-4.0); I did not relicense existing files.Notes for reviewers