ci: vendor validation scripts and remove remote action pins

[hyperpolymath]

Automated PR to fix CI after deleted actions.

[gitar-bot]

CI failed: A2ML manifest validation failed due to missing required identity fields in a manifest file, and CodeQL failed because no JavaScript/TypeScript source code was found to analyze.

Overview

Two failures occurred during CI execution: an A2ML manifest validation failure (likely related to the PR changes regarding validation scripts) and a CodeQL configuration error due to missing JavaScript/TypeScript source files.

Failures

A2ML Validation Failure (confidence: high)

• Type: test
• Affected jobs: 90125205921
• Related to change: yes
• Root cause: The A2ML validation script failed because a scanned .a2ml manifest file is missing a required identity field (agent-id, name, or project).
• Suggested fix: Review the .a2ml manifest files in the repository and ensure all required identity fields and headers are correctly populated.

CodeQL Configuration Error (confidence: high)

• Type: configuration
• Affected jobs: 90125206326
• Related to change: unclear
• Root cause: CodeQL analysis failed because no JavaScript or TypeScript source code was found or processed in the repository during extraction.
• Suggested fix: Remove 'javascript-typescript' from the languages matrix in the CodeQL workflow configuration if the repository does not contain JavaScript or TypeScript code.

Summary

• Change-related failures: 1 (A2ML validation failure due to missing identity fields in manifest files)
• Infrastructure/flaky failures: 0
• Recommended action: Fix the missing required identity field in the .a2ml manifest file(s), and review the CodeQL workflow language matrix if JavaScript/TypeScript analysis is not applicable.

Code Review ✅ Approved 2 resolved / 2 findings

Vendors validation scripts and removes remote action pins to fix CI. Consider addressing the while-read loops skipping a file's final line and the empty PATHS_IGNORE array causing aborts on bash < 4.4.

Auto-approved: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria.

✅ 2 resolved

✅ Edge Case: while-read loops skip a file's final line if no trailing newline

📄 .githooks/validate-k9.sh:122-131 📄 .githooks/validate-k9.sh:141-150 📄 .githooks/validate-k9.sh:169-183 📄 .githooks/validate-a2ml.sh:102-111 📄 .githooks/validate-a2ml.sh:128-142 📄 .githooks/validate-a2ml.sh:239-253 📄 .githooks/validate-a2ml.sh:270-280
All validation passes use while IFS= read -r line; ...; done < "$file". read returns non-zero on the last line when the file has no trailing newline, so the loop body never processes that line. A K9 file whose final line is e.g. leash = 'hunt', or a single-line K9! file without a terminating newline, will be mis-validated (e.g. Check 1 reports a false 'Missing K9! magic number' for a lone-line file, or a hunt-level leash/signature field on the last line is silently ignored). Guard the loop with || [[ -n "$line" ]] so the trailing partial line is still handled.

✅ Bug: Empty PATHS_IGNORE array under set -u aborts on bash < 4.4

📄 .githooks/validate-k9.sh:48-54 📄 .githooks/validate-k9.sh:38-45 📄 .githooks/validate-a2ml.sh:47-53 📄 .githooks/validate-a2ml.sh:37-44
path_ignored iterates for frag in "${PATHS_IGNORE[@]}" and the array is typically empty (INPUT_PATHS_IGNORE is not set by dogfood-gate.yml). With set -u, expanding an empty array errors with 'unbound variable' on bash prior to 4.4, which would abort the whole script mid-scan. GitHub's ubuntu-latest ships bash 5.x so CI is safe, but these live in .githooks/ and may run as local git hooks on older shells (e.g. macOS default bash 3.2). Guard the expansion to be robust.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Gitar has auto-approved this PR (configure)