fix(ci): unbreak workflow YAML and add a complete actions.lock - #51
Conversation
Remediates GitHub Workflow Dependency Locking (public preview), which rejects runs at startup_failure with zero jobs and no logs. See hyperpolymath/standards#657. Five steps, in order, because each blocks the next: 1. Unbroke any workflow whose `permissions:` carried a scalar with an indented mapping under it - blind-permissions-insertion damage. This matters beyond the one file: gh actions-lock refuses to run when ANY workflow in the repo fails to parse, so the repo could never acquire a lockfile and could never self-heal. 2. Repinned hyperpolymath/standards reusables off commits that have no actions.lock. The rejection requires the CALLEE to be covered at the pinned SHA, which is unsatisfiable at a pre-lockfile commit. 3. Generated the lockfile with gh actions-lock. 4. Hand-added the reusable-workflow caller entries the tool omits, as '<path>': []. Measured across 218 repos: P(startup_failure | has lockfile) = 91.7% vs 15.8% without, because every workflow a lockfile OMITS is rejected. A PARTIAL lock is worse than none - running gh actions-lock and stopping there is how this outage spread. 5. Restored SPDX-License-Identifier to line 1, which the tool displaces with its own banner and which the workflow-security linter greps with head -1. Verified before push: 0 unparseable workflows, lockfile covers every workflow with no omissions, SPDX on line 1 in every file. Proven on hyperpolymath/anamnesis: 6 of 6 workflows dead -> 0 startup_failure, 13 running. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Warning Review limit reachedNext included review available in 58 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
This PR aims to fix workflow YAML syntax and implement dependency locking, but several core objectives are unaddressed in the provided changes. The actions.lock file mentioned in the title is missing from the file list, and the expected fixes for permissions: syntax errors are not visible in the diff.
A consistent pattern of redundant header comments has been introduced on line 3 of all modified YAML files, likely an artifact of the gh actions-lock tool. Furthermore, no automated validation scripts were included to enforce the SPDX license identifier requirement or YAML validity as claimed.
About this PR
- The PR title and description mention adding a complete 'actions.lock' and fixing 'permissions:' syntax, but these changes are not present in the current diff. Please ensure all intended files and fixes are staged and pushed.
Test suggestions
- Validate that all YAML files in '.github/workflows/' are syntactically correct and parseable.
- Verify that line 1 of every workflow file starts with '# SPDX-License-Identifier:'.
- Verify that 'actions.lock' contains entries for all workflows, including those the tool might omit.
- Verify that all internal reusable workflow calls are pinned to full commit SHAs.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Validate that all YAML files in '.github/workflows/' are syntactically correct and parseable.
2. Verify that line 1 of every workflow file starts with '# SPDX-License-Identifier:'.
3. Verify that 'actions.lock' contains entries for all workflows, including those the tool might omit.
4. Verify that all internal reusable workflow calls are pinned to full commit SHAs.
Low confidence findings
- Consider adding a local validation script or a CI step to automatically verify that all workflows are syntactically correct and maintain the '# SPDX-License-Identifier:' on line 1.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| @@ -1,5 +1,6 @@ | |||
| # SPDX-License-Identifier: MPL-2.0 | |||
| # This workflow is managed by gh actions-lock. | |||
| # This workflow is managed by gh actions-lock. | |||
There was a problem hiding this comment.
⚪ LOW RISK
Nitpick: Redundant header comment. This line duplicates the existing management banner on line 2.
| # This workflow is managed by gh actions-lock. |
| @@ -1,5 +1,6 @@ | |||
| # SPDX-License-Identifier: MPL-2.0 | |||
| # This workflow is managed by gh actions-lock. | |||
| # This workflow is managed by gh actions-lock. | |||
There was a problem hiding this comment.
⚪ LOW RISK
Nitpick: This line appears to be a redundant duplication of the comment on line 2. This is likely an artifact of the tool used to pin dependencies.
| # This workflow is managed by gh actions-lock. |
| @@ -1,5 +1,6 @@ | |||
| # SPDX-License-Identifier: MPL-2.0 | |||
| # This workflow is managed by gh actions-lock. | |||
| # This workflow is managed by gh actions-lock. | |||
There was a problem hiding this comment.
⚪ LOW RISK
Nitpick: Redundant header comment. This line duplicates the existing management banner on line 2.
| # This workflow is managed by gh actions-lock. |
| @@ -1,5 +1,6 @@ | |||
| # SPDX-License-Identifier: MPL-2.0 | |||
| # This workflow is managed by gh actions-lock. | |||
| # This workflow is managed by gh actions-lock. | |||
There was a problem hiding this comment.
⚪ LOW RISK
Nitpick: Redundant header comment. This line duplicates the existing management banner on line 2.
| # This workflow is managed by gh actions-lock. |
| @@ -1,5 +1,6 @@ | |||
| # SPDX-License-Identifier: MPL-2.0 | |||
| # This workflow is managed by gh actions-lock. | |||
| # This workflow is managed by gh actions-lock. | |||
There was a problem hiding this comment.
⚪ LOW RISK
Nitpick: This line is a redundant duplication of the header on line 2: '# This workflow is managed by gh actions-lock.'. Removing this will maintain cleaner workflow files.
| # This workflow is managed by gh actions-lock. |
1 participant
Remediates GitHub Workflow Dependency Locking (public preview, no changelog entry), which rejects runs at
startup_failure— zero jobs, no logs, nothing in REST or GraphQL. Full analysis:hyperpolymath/standards#657.Proven on
hyperpolymath/anamnesis: 6 of 6 workflows dead → 0startup_failure, 13 running.Five steps, in order — each blocks the next
1. Unbreak the workflow YAML. Any
permissions:carrying a scalar with an indented mapping under it:This reaches past the one file:
gh actions-lockrefuses to run when any workflow in the repo fails to parse, so the repo can never acquire a lockfile and can never self-heal.2. Repin
standardsreusables off commits with noactions.lock. The rejection requires the callee to be covered at the pinned SHA — unsatisfiable at a pre-lockfile commit.3. Generate the lockfile with
gh actions-lock.4. Hand-add the reusable-caller entries the tool omits, as
'<path>': [].P(startup_failure | has lockfile) = 91.7%vs15.8%without — because every workflow a lockfile omits is rejected. A partial lock is worse than none. Runninggh actions-lockand stopping there is how this outage spread.5. Restore
SPDX-License-Identifierto line 1, which the tool displaces with its own banner and which the workflow-security linter greps viahead -1.Verified before this PR was opened
0unparseable workflows · lockfile covers every workflow, no omissions · SPDX on line 1 in every file. The script refuses to push if any of the three fails.🤖 Generated with Claude Code