fix(ci): green the Registry+topology check — regen registry drift + de-TruffleHog a2ml/S4 scorecard (#525 fallout) - #531
Merged
Conversation
…drift on main `.machine_readable/REGISTRY.a2ml` drifted on main (stale hashes present by 2026-07-26): tracked files under spec homes changed without regenerating the derived registry, so the required "Registry + topology in sync" check has been red and blocking every PR — the exact recurrence #381 guard exists to prevent (the pre-commit hook catches this locally; this instance reached main anyway). Regenerated with scripts/build-registry.sh. Only 7 source_hash values updated to match the current tree; no entries added/removed, TOPOLOGY.md unchanged, and build-registry.sh --check now passes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
hyperpolymath
marked this pull request as ready for review
July 27, 2026 12:58
The a2ml/S4 secret-scanning scorecard required BOTH trufflesecurity/trufflehog AND gitleaks in a2ml/.github/workflows/secret-scanner.yml. #525 deliberately removed the redundant TruffleHog job estate-wide, so the check trufflehog grep started failing — surfacing as "a2ml/S4: claimed PASS but check exited 1" in build-scorecards --verify. That is the second, previously-masked failure in the "Registry + topology in sync" job (masked on main because the registry-drift step failed first). Updated S4 check/evidence/system to the post-#525 reality: gitleaks + rust/shell secret jobs. Verified the new check holds and the dashboard is current. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
hyperpolymath
changed the title
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Greens the required
Registry + topology in synccheck, which has been red on main and blocking every PR. That job had two failures — the first masking the second:1. Registry drift (step 4).
build-registry.sh --checkreportedREGISTRY.a2ml is stale. Regenerated from a clean clone ofmain: only 7source_hashvalues updated to match the tree, no entries added/removed,TOPOLOGY.mdunchanged. This is the recurrence #381's pre-commit guard is meant to prevent (it reached main without the hook).2. Stale scorecard
a2ml/S4(step 6, previously masked). Once the registry step passes,build-scorecards.sh --verifyruns and fails:a2ml/S4: claimed PASS but check exited 1. The check still requiredtrufflesecurity/trufflehogina2ml/.github/workflows/secret-scanner.yml, but #525 deliberately removed TruffleHog estate-wide. Updated S4'scheck/evidence/systemto the post-#525 reality (gitleaks + rust/shell secret jobs).Verified locally:
build-registry.sh --checkpasses, the new S4 check holds (gitleaks present), dashboard is current. (--verify's full run needs ripgrep/xmllint/jq — the env-preflight guard correctly declines to judge without them; CI has them.)Follow-up (#381 option 2): a CI job that auto-regenerates + commits the registry on drift would stop this reaching main again.