fix(ci): unbreak workflow YAML and add a complete actions.lock - #48
Conversation
Remediates GitHub Workflow Dependency Locking (public preview), which rejects runs at startup_failure with zero jobs and no logs. See hyperpolymath/standards#657. Five steps, in order, because each blocks the next: 1. Unbroke any workflow whose `permissions:` carried a scalar with an indented mapping under it - blind-permissions-insertion damage. This matters beyond the one file: gh actions-lock refuses to run when ANY workflow in the repo fails to parse, so the repo could never acquire a lockfile and could never self-heal. 2. Repinned hyperpolymath/standards reusables off commits that have no actions.lock. The rejection requires the CALLEE to be covered at the pinned SHA, which is unsatisfiable at a pre-lockfile commit. 3. Generated the lockfile with gh actions-lock. 4. Hand-added the reusable-workflow caller entries the tool omits, as '<path>': []. Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without, because every workflow a lockfile OMITS is rejected. A PARTIAL lock is worse than none - running gh actions-lock and stopping there is how this outage spread. 5. Restored SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps with head -1. Verified before push: 0 unparseable workflows, lockfile covers every workflow with no omissions, SPDX on line 1 in every file. Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead -> 0 startup_failure, 13 running. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (16)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe pull request updates GitHub Actions management comments across workflow files. It also adds ChangesGitHub Actions workflow maintenance
Estimated code review effort: 2 (Simple) | ~10 minutes Poem
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔍 Hypatia Security ScanFindings: 28 issues detected
View findings[
{
"reason": "Action julia-actions/CompatHelper@v1 needs attention",
"type": "unpinned_action",
"file": "CompatHelper.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in push-email-notify.yml",
"type": "missing_timeout_minutes",
"file": "push-email-notify.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Required file missing (condition: public_repo)",
"type": "missing_requirement",
"file": "SECURITY.md",
"action": "create",
"rule_module": "cicd_rules",
"severity": "high"
},
{
"reason": "No SECURITY.md found in Cliodynamics.jl",
"type": "SecurityPolicy",
"file": "/home/runner/work/Cliodynamics.jl/Cliodynamics.jl",
"action": "auto_fix",
"rule_module": "scorecard",
"severity": "medium",
"remediation": "Add SECURITY.md documenting how to report vulnerabilities.",
"scorecard_check": "Security-Policy"
},
{
"reason": "14 workflow(s) with tag-pinned (not SHA-pinned) actions in Cliodynamics.jl",
"type": "DependencyPinning",
"file": "/home/runner/work/Cliodynamics.jl/Cliodynamics.jl",
"action": "auto_fix",
"rule_module": "scorecard",
"severity": "medium",
"remediation": "Pin GitHub Actions and Docker base images by SHA hash.",
"scorecard_check": "Pinned-Dependencies"
},
{
"reason": "Code scanning (Hypatia): hypatia/workflow_audit/missing_timeout_minutes -- Hypatia workflow_audit: missing_timeout_minutes -- 63 day(s) old [STALE]",
"type": "CSA001",
"file": "push-email-notify.yml",
"action": "update",
"rule_module": "code_scanning_alerts",
"severity": "medium"
},
{
"reason": "Code scanning (Scorecard): TokenPermissionsID -- Token-Permissions -- 74 day(s) old [STALE]",
"type": "CSA001",
"file": ".github/workflows/hypatia-scan.yml",
"action": "escalate",
"rule_module": "code_scanning_alerts",
"severity": "high"
},
{
"reason": "Code scanning (Scorecard): TokenPermissionsID -- Token-Permissions -- 74 day(s) old [STALE]",
"type": "CSA001",
"file": ".github/workflows/dependabot-automerge.yml",
"action": "escalate",
"rule_module": "code_scanning_alerts",
"severity": "high"
},
{
"reason": "Code scanning (Scorecard): TokenPermissionsID -- Token-Permissions -- 74 day(s) old [STALE]",
"type": "CSA001",
"file": ".github/workflows/TagBot.yml",
"action": "escalate",
"rule_module": "code_scanning_alerts",
"severity": "high"
},
{
"reason": "Code scanning (Scorecard): TokenPermissionsID -- Token-Permissions -- 74 day(s) old [STALE]",
"type": "CSA001",
"file": ".github/workflows/Documenter.yml",
"action": "escalate",
"rule_module": "code_scanning_alerts",
"severity": "high"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
The PR successfully implements dependency pinning for several workflows and introduces an actions.lock file; however, it introduces a critical syntax error in the Scorecards workflow. The analysis job in .github/workflows/scorecard.yml specifies both a reusable workflow (uses) and a steps block, which are mutually exclusive in GitHub Actions. This will prevent the CI from running successfully.
Additionally, there is a discrepancy between the PR description and the changes provided: the description claims to fix malformed YAML involving scalar permissions, but no such changes are visible in the diff. Finally, a systemic redundancy has been introduced across all modified files where the management header comment is duplicated on consecutive lines. The syntax error in the Scorecards workflow must be addressed before merging.
About this PR
- The PR description mentions fixing malformed YAML related to scalar permissions blocks (Step 1), but the diff does not show any instances where such structures were modified or corrected.
- A redundant duplicate comment '# This workflow is managed by gh actions-lock.' has been added to the header of every modified workflow file (typically on both line 2 and line 3). This should be cleaned up systemically.
Test suggestions
- Verify that all workflow YAML files are parseable after modification
- Verify that SPDX headers are correctly placed on the first line
- Verify that actions.lock covers all workflows and contains the specified manual entries
- Verify that reusable workflows are pinned to specific SHAs
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that all workflow YAML files are parseable after modification
2. Verify that SPDX headers are correctly placed on the first line
3. Verify that actions.lock covers all workflows and contains the specified manual entries
4. Verify that reusable workflows are pinned to specific SHAs
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| jobs: | ||
| analysis: | ||
| uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 | ||
| uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a |
There was a problem hiding this comment.
🔴 HIGH RISK
The 'analysis' job is invalid because it contains both a job-level uses key (to call a reusable workflow) and a steps block. These properties are mutually exclusive in GitHub Actions. To fix this, either remove the steps block if the logic is contained in the reusable workflow, or move the uses call into a step if it was intended to be a local action step.
| @@ -1,5 +1,6 @@ | |||
| # SPDX-License-Identifier: MPL-2.0 | |||
| # This workflow is managed by gh actions-lock. | |||
| # This workflow is managed by gh actions-lock. | |||
There was a problem hiding this comment.
⚪ LOW RISK
Nitpick: This line is redundant as line 2 already contains the identical 'managed by gh actions-lock' banner.
| @@ -1,5 +1,6 @@ | |||
| # SPDX-License-Identifier: MPL-2.0 | |||
| # This workflow is managed by gh actions-lock. | |||
| # This workflow is managed by gh actions-lock. | |||
There was a problem hiding this comment.
⚪ LOW RISK
Nitpick: This header comment is duplicated. It appears on both line 2 and line 3, which is redundant. This suggests the version pinning tool may be misconfigured or was run repeatedly on the same file.
1 participant
Remediates GitHub Workflow Dependency Locking (public preview, no changelog entry), which rejects runs at
startup_failure— zero jobs, no logs, nothing in REST or GraphQL. Full analysis:hyperpolymath/standards#657.Proven on
hyperpolymath/anamnesis: 6 of 6 workflows dead → 0startup_failure, 13 running.Five steps, in order — each blocks the next
1. Unbreak the workflow YAML. Any
permissions:carrying a scalar with an indented mapping under it:This reaches past the one file:
gh actions-lockrefuses to run when any workflow in the repo fails to parse, so the repo can never acquire a lockfile and can never self-heal.2. Repin
standardsreusables off commits with noactions.lock. The rejection requires the callee to be covered at the pinned SHA — unsatisfiable at a pre-lockfile commit.3. Generate the lockfile with
gh actions-lock.4. Hand-add the reusable-caller entries the tool omits, as
'<path>': [].P(startup_failure | has lockfile) = 91.7%vs15.8%without — because every workflow a lockfile omits is rejected. A partial lock is worse than none. Runninggh actions-lockand stopping there is how this outage spread.5. Restore
SPDX-License-Identifierto line 1, which the tool displaces with its own banner and which the workflow-security linter greps viahead -1.Verified before this PR was opened
0unparseable workflows · lockfile covers every workflow, no omissions · SPDX on line 1 in every file. The script refuses to push if any of the three fails.🤖 Generated with Claude Code