fix(ci): re-pin standards reusables to lockfile-bearing ref - #342
Merged
Merged
Conversation
Caller-side lockfile enforcement requires actions.lock in the CALLED repo at the pinned ref. standards shipped its lockfile in #570 (gates repaired in #571/#572); these callers were still pinned to May-July SHAs whose trees predate it, so all 7 died as startup_failure even after echidna's own lockfile landed (#341). security-scan.yml is untouched: it calls hyperpolymath/panic-attack, which needs its own lockfile before that caller can start. Every new pin verified resolvable via the commits API (the first attempt fabricated a SHA tail — the exact phantom-pin failure mode this estate already measured 112 times). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedRe-pins CI standards reusables to lockfile-bearing ref
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 6 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
…eaked audit file The Governance run banner on this PR reads: 'The following workflows are missing a lockfile: .github/workflows/governance.yml' — enforcement requires EVERY workflow to appear in actions.lock, including pure reusable callers, which gh actions-lock skips. Empty entries added for the 8 callers (same cure as the zero-dep probe in #341). main-estate-audit.yml was untracked scratch swept in by 'git add' — removed from the branch; it references the nonexistent hyperpolymath/cicd-suite repo and lacks an SPDX header (it caused both the Central Estate CI/CD Audit startup_failure and the Workflow Security Linter red on this PR). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Third enforcement layer surfaced by the re-pin (banner: "The workflow is requesting 'actions: read', but is only allowed 'actions: none'"): a reusable may not request more GITHUB_TOKEN permissions than its caller grants. The fcb8669 reusables request actions: read (governance, hypatia-scan, spark-theatre-gate, mirror, scorecard) and security-events: write (hypatia-scan); the callers still granted the old pins' narrower sets. Proof of the layer: rust-ci and secret-scanner, whose reusables request only contents: read, ran real jobs (5 and 3) on the previous push while these five died. mirror and scorecard are patched proactively — they trigger on push/schedule, so they would have hit the same wall on main. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
hyperpolymath
force-pushed
the
fix/repin-standards-reusables
branch
from
August 4, 2026 04:02
cf53630 to
38f5f4d
Compare
hyperpolymath
disabled auto-merge
August 4, 2026 04:06
hyperpolymath
added a commit
that referenced
this pull request
Aug 4, 2026
…343) Completes #342: scorecard-reusable's **job** requests `security-events: write` + `id-token: write` beyond the workflow-level `actions: read`/`contents: read`; caller grants must cover job-level requests too, so OSSF Scorecard was the one re-pinned caller still dying at startup. One file, four permission lines. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Caller-side lockfile enforcement demands
actions.lockin the called repo at the pinned ref. standards shipped its lockfile (#570/#571/#572); these 7 callers still pinned pre-lockfile SHAs, so they remainedstartup_failureafter #341 unbricked the inline workflows.Re-pins governance, hypatia-scan, mirror, rust-ci, scorecard, secret-scanner, spark-theatre-gate to
fcb8669169b4(standards main, 2026-08-04). Every pin verified resolvable via the commits API.Expected on this PR: the callers start (real jobs/conclusions). Honest reds are possible — the governance/hypatia reusables float ahead of echidna's 07-28 baseline — and are follow-up content work, strictly better than a gate that never runs.
Not fixed here:
security-scan.ymlcallshyperpolymath/panic-attack, which needs its own lockfile first.🤖 Generated with Claude Code