Skip to content

fix(scaffolds): repair broken actions/upload-artifact SHA in 30 template workflows - #83

Merged
hyperpolymath merged 2 commits into
mainfrom
claude/fix-broken-upload-artifact-sha-templates
May 27, 2026
Merged

fix(scaffolds): repair broken actions/upload-artifact SHA in 30 template workflows#83
hyperpolymath merged 2 commits into
mainfrom
claude/fix-broken-upload-artifact-sha-templates

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Summary

  • Replace dead pin actions/upload-artifact@65c79d...c478 with current v4 head ea165f8d...fa02 in 30 nested template scaffolds
  • These don't run on this monorepo's CI (only root .github/workflows/ does), but they propagate to every repo templated from these sub-cartridges
  • Companion PRs landing in parallel: rsr-template-repo#69, me-dialect#1

Why

The dead SHA does not exist on upstream actions/upload-artifact (verified via gh api repos/actions/upload-artifact/commits/65c79d...No commit found for SHA). Any future repo cloned from these scaffolds would inherit the broken pin and fail CI immediately.

🤖 Generated with Claude Code

…ate workflows

These nested .github/workflows/hypatia-scan.yml files don't execute on this
monorepo's own GitHub Actions (only the root workflow does), but they ship
as template scaffolds when any of these sub-cartridges (composer/, ambulances/disk/,
emergency-button/, observatory/, etc.) is used as a starting point for a new repo.

The pin `actions/upload-artifact@65c79d7f...c478` references a commit that
does not exist on upstream (verified via gh api — "No commit found for SHA").
Any repo templated from these scaffolds inherits the broken pin.

Replacing with current v4 head SHA `ea165f8d65b6e75b540449e92b4886f43607fa02`.
@hyperpolymath
hyperpolymath enabled auto-merge (squash) May 26, 2026 11:43
@github-actions

Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 91 issues detected

Severity Count
🔴 Critical 29
🟠 High 38
🟡 Medium 24

⚠️ Action Required: Critical security issues found!

View findings
[
  {
    "reason": "Ada Unchecked_Access bypasses accessibility checks (2 occurrences, CWE-676)",
    "type": "ada_unchecked_access",
    "file": "/home/runner/work/ambientops/ambientops/nerdsafe-restart/src/ada/nerdsafe_tui.adb",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Ada pragma Suppress disables runtime checks (1 occurrences, CWE-704)",
    "type": "ada_pragma_suppress",
    "file": "/home/runner/work/ambientops/ambientops/system-tools/ambulances/network/obj/ada/b__network_ambulance_tui.adb",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "getExn on external data -- use pattern matching (1 occurrences, CWE-754)",
    "type": "getexn_on_external",
    "file": "/home/runner/work/ambientops/ambientops/_pathroot/src/nicaug/NicaugCLI.res",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "getExn on external data -- use pattern matching (1 occurrences, CWE-754)",
    "type": "getexn_on_external",
    "file": "/home/runner/work/ambientops/ambientops/_pathroot/src/nicaug/PlatformOrchestrator.res",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "getExn on external data -- use pattern matching (7 occurrences, CWE-754)",
    "type": "getexn_on_external",
    "file": "/home/runner/work/ambientops/ambientops/_pathroot/src/Discovery.res",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "expect() in hot path (1 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/ambientops/ambientops/panoptes/src/ollama.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (2 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/ambientops/ambientops/panoptes/src/web/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/ambientops/ambientops/personal-sysadmin/src/correlation.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (12 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/ambientops/ambientops/contracts-rust/benches/contracts_bench.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (3 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/ambientops/ambientops/hardware-crash-team/src/scanner/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

@hyperpolymath
hyperpolymath merged commit 02eb686 into main May 27, 2026
29 of 31 checks passed
@hyperpolymath
hyperpolymath deleted the claude/fix-broken-upload-artifact-sha-templates branch May 27, 2026 12:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant