chore: R-16 toolchain pin + reconciliation #50
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -16,10 +16,7 @@ concurrency: | |
| # at plan time with zero jobs. | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| scan: | ||
| uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@db12a6ad3ef9076d5f7bdcf98d7d15cf8547555a | ||
| secrets: inherit | ||
|
Comment on lines
+21
to
22
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
sha='db12a6ad3ef9076d5f7bdcf98d7d15cf8547555a'
curl --fail --silent --show-error \
"https://raw.githubusercontent.com/hyperpolymath/standards/${sha}/.github/workflows/secret-scanner-reusable.yml" |
rg -n -C 8 'workflow_call:|secrets:|secrets\.'Repository: hyperpolymath/patch-bridge Length of output: 4880 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
file='.github/workflows/secret-scanner.yml'
printf '%s\n' '--- caller workflow ---'
sed -n '1,45p' "$file"
printf '%s\n' '--- pinned reusable workflow contract and token use ---'
sha='db12a6ad3ef9076d5f7bdcf98d7d15cf8547555a'
curl --fail --silent --show-error \
"https://raw.githubusercontent.com/hyperpolymath/standards/${sha}/.github/workflows/secret-scanner-reusable.yml" |
sed -n '65,105p'Repository: hyperpolymath/patch-bridge Length of output: 2269 🌐 Web query:
💡 Result: In GitHub Actions, the GITHUB_TOKEN is automatically available to reusable workflows without needing to be passed via the secrets keyword or the inherit option [1][2]. When a reusable workflow is triggered by a caller workflow, the called workflow is automatically granted access to the github.token context and secrets.GITHUB_TOKEN [1][2]. Key points regarding GITHUB_TOKEN and secrets in reusable workflows: 1. Automatic Availability: You do not need to use secrets: inherit or explicitly map GITHUB_TOKEN to make it available in a reusable workflow [1][2]. It is provided by the platform by default [1][2]. 2. Permissions: Reusable workflows inherit permissions from the job or workflow that calls them [3]. If permissions are not explicitly specified in the calling job, the called workflow will use the default GITHUB_TOKEN permissions [1][2]. Importantly, the GITHUB_TOKEN permissions passed from the caller can only be downgraded, not elevated, by the called workflow [1][2]. 3. The inherit Keyword: The secrets: inherit keyword is used to implicitly pass all secrets (such as repository, organization, or environment secrets) from the caller workflow to the called workflow [4][5]. It is not required for the GITHUB_TOKEN itself, as that token is handled automatically as part of the workflow execution context [1][2]. 4. Context Consistency: When a reusable workflow is triggered, the github context is associated with the caller workflow [1][2]. In summary, the GITHUB_TOKEN behaves differently from custom repository secrets; while custom secrets must be explicitly passed or inherited via secrets: inherit to be accessible within a reusable workflow, the GITHUB_TOKEN is granted automatically [4][1][2]. Citations:
Remove The reusable workflow only uses 🧰 Tools🪛 zizmor (1.29.0)[warning] 21-21: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow (secrets-inherit) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| [tools] | ||
| # = "Uncomment and customize for your project" | ||
| # = "rust nightly" | ||
| # = "just 1.40.0" | ||
| # = "nickel 1.10.0" | ||
| # = "gleam 1.8.0" | ||
| # = "elixir 1.18.0" | ||
| # = "erlang 27.2" | ||
| # = "zig 0.14.0" | ||
| # = "idris2 0.7.0" | ||
| rust = "nightly" | ||
|
There was a problem hiding this comment. 🟡 MEDIUM RISK Suggestion: Avoid pinning to a floating 'nightly' version in There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win Update the bootstrap script before removing Line 11 makes 🤖 Prompt for AI Agents🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: printf '%s\n' '--- .mise.toml ---'
cat -n .mise.toml
printf '%s\n' '--- installer ---'
sed -n '1,80p' .machine_readable/scripts/lifecycle/install-tools.sh
printf '%s\n' '--- CI Rust section ---'
sed -n '70,115p' .gitlab-ci.yml
printf '%s\n' '--- tool configuration references ---'
rg -n --hidden --glob '!node_modules' --glob '!dist' --glob '!build' '(mise|tool-versions|rust:|rustup|R-16|install-tools)' .mise.toml .machine_readable .gitlab-ci.yml README.md 2>/dev/nullRepository: hyperpolymath/patch-bridge Length of output: 3657 🏁 Script executed: printf '%s\n' '--- tracked configuration files ---'
git ls-files '.mise.toml' '.tool-versions' '.machine_readable/scripts/lifecycle/install-tools.sh' '.gitlab-ci.yml' 'README.md'
printf '%s\n' '--- repository references to mise and lifecycle tooling ---'
rg -n --hidden --glob '!node_modules' --glob '!dist' --glob '!build' '(mise|tool-versions|install-tools\.sh|R-16)' . 2>/dev/null | head -200Repository: hyperpolymath/patch-bridge Length of output: 4203 🌐 Web query:
💡 Result: To use the Rust nightly toolchain with mise, you can configure it in your.mise.toml file. Mise integrates with rustup to manage these toolchains [1][2]. Rolling Nightly Channel To track the latest available Rust nightly, configure your.mise.toml to use the nightly channel [1][2]: [tools] rust = "nightly" When you use the "nightly" channel, mise resolves this to a concrete, dated nightly toolchain (e.g., nightly-YYYY-MM-DD) for installation and records it in your lockfile [1][2][3]. This ensures your environment remains reproducible while still allowing you to update to the newest nightly when desired [1][2]. Updating Nightly Because the configuration is pinned to a concrete date in your lockfile, simply running "mise install" will not automatically switch to a newer nightly [3]. To update to the latest available nightly, use: mise upgrade rust Alternatively, you can advance the locked version by running [1][2]: mise lock --bump Pinning a Specific Date If you need to pin a specific nightly version to ensure consistency, you can specify the date explicitly [1][2]: [tools] rust = "nightly-2026-08-13" Scope Nightly to a Specific Tool If you only need nightly for a specific cargo-installed tool (such as a linter) rather than your entire project's Rust environment, you can use the install_env option in.mise.toml [4]: [tools] "cargo:some-tool" = { version = "latest", install_env = { RUSTUP_TOOLCHAIN = "nightly" } } This approach keeps your primary Rust toolchain separate (e.g., stable) while specifically using nightly for that one tool's installation [4]. Top results: [1][2][3] Citations:
🏁 Script executed: printf '%s\n' '--- mise-related tracked files ---'
git ls-files | grep -E '(^|/)(\.mise(\.toml|\.lock)?|mise\.lock)$' || true
printf '%s\n' '--- mise lockfile and ignore references ---'
rg -n --hidden --glob '!node_modules' --glob '!dist' --glob '!build' 'mise\.lock|\.mise\.toml|mise lock|mise install|mise upgrade' .gitignore .gitlab-ci.yml README.adoc README.md .envrc .machine_readable 2>/dev/null || trueRepository: hyperpolymath/patch-bridge Length of output: 254 Integrate mise and pin the Rust toolchain.
If R-16 requires reproducibility, commit a mise lockfile or use a dated nightly, then align CI with that toolchain. 🤖 Prompt for AI Agents |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,4 @@ | ||
| K9! | ||
|
There was a problem hiding this comment. 🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy lift 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
file="container/deploy.k9.ncl"
printf '%s\n' '--- target file ---'
wc -l "$file"
printf '%s\n' '--- rollback context ---'
sed -n '1,180p' "$file"
printf '%s\n' '--- related rollback/deploy references ---'
rg -n -C 3 'rollback|deploy|down|latest|ENV|health' container "$file" 2>/dev/null || trueRepository: hyperpolymath/patch-bridge Length of output: 39551 Make rollback restore a previous release. The rollback script calls 🧰 Tools🪛 GitHub Check: Validate K9 contracts[warning] 1-1: [warning] 1-1: [failure] 1-1: 🤖 Prompt for AI Agents🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- changed file ---'
git diff -- container/deploy.k9.ncl
printf '%s\n' '--- file ---'
cat -n container/deploy.k9.ncl
printf '%s\n' '--- references to production.image_tag and image rendering ---'
rg -n -C 3 'production\.image_tag|image_tag|latest|compose' container --glob '*.ncl' --glob '*.yaml' --glob '*.yml' --glob '*.sh' --glob '*.py' --glob '*.js' --glob '*.ts' || trueRepository: hyperpolymath/patch-bridge Length of output: 9741 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- container files ---'
git ls-files 'container/*'
printf '%s\n' '--- compose definitions ---'
for f in $(fd -t f -i 'compose' container); do
echo "### $f"
cat -n "$f"
done
printf '%s\n' '--- build script image flow ---'
sed -n '35,55p' container/ct-build.sh
sed -n '120,160p' container/ct-build.sh
printf '%s\n' '--- repository status ---'
git status --short -- container/deploy.k9.nclRepository: hyperpolymath/patch-bridge Length of output: 11571 Pin the production image to an immutable reference. The production image is hard-coded as 🧰 Tools🪛 GitHub Check: Validate K9 contracts[warning] 1-1: [warning] 1-1: [failure] 1-1: 🤖 Prompt for AI Agents🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- deployment file ---'
cat -n container/deploy.k9.ncl | sed -n '1,180p'
printf '%s\n' '--- candidate files ---'
fd -i 'k9|deploy|environment|env' . -t f | sed -n '1,160p'
printf '%s\n' '--- exact bindings and references ---'
rg -n --glob '!node_modules' --glob '!dist' --glob '!build' \
'k9-svc|deployment\.environments|deploy\.k9|ENV=|ENV\b|docker compose|docker-compose|component_pedigree' . \
| sed -n '1,240p'Repository: hyperpolymath/patch-bridge Length of output: 8211 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- tracked container files ---'
git ls-files container | sed -n '1,180p'
printf '%s\n' '--- build script ---'
if [ -f container/ct-build.sh ]; then
cat -n container/ct-build.sh
else
printf '%s\n' 'container/ct-build.sh not present'
fi
printf '%s\n' '--- compose files ---'
for f in container/compose.toml container/compose.example.toml; do
if [ -f "$f" ]; then
printf '%s\n' "--- $f ---"
cat -n "$f" | sed -n '1,180p'
fi
done
printf '%s\n' '--- deployment documentation ---'
cat -n container/README.adoc | sed -n '140,170p'Repository: hyperpolymath/patch-bridge Length of output: 17075 Pass the selected environment to the deployment commands. Even when 🧰 Tools🪛 GitHub Check: Validate K9 contracts[warning] 1-1: [warning] 1-1: [failure] 1-1: 🤖 Prompt for AI Agents🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- container/deploy.k9.ncl: numbered lines around validation ---'
sed -n '1,170p' container/deploy.k9.ncl
printf '%s\n' '--- related validation identifiers ---'
rg -n -C 3 'selur-compose|podman compose|Validation passed|command -v|verify' container/deploy.k9.nclRepository: hyperpolymath/patch-bridge Length of output: 5786 🏁 Script executed: sed -n '100,135p' container/deploy.k9.nclRepository: hyperpolymath/patch-bridge Length of output: 942 Fail closed when When 🧰 Tools🪛 GitHub Check: Validate K9 contracts[warning] 1-1: [warning] 1-1: [failure] 1-1: 🤖 Prompt for AI Agents🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🔎 Supported by static analysis🏁 Script executed: #!/bin/sh
set -eu
nickel typecheck container/deploy.k9.ncl
k9-svc validate container/deploy.k9.nclRepository: hyperpolymath/patch-bridge Length of output: 208 🏁 Script executed: #!/bin/sh
set -eu
printf '%s\n' '--- container/deploy.k9.ncl ---'
cat -n container/deploy.k9.ncl
printf '%s\n' '--- related K9 files and references ---'
git ls-files | rg '(^|/)(K9|k9|.*\.k9\.ncl$)|k9-svc|hunt_authorized|required_level|signature|checksum'
rg -n --glob '!container/deploy.k9.ncl' 'hunt_authorized|required_level|component_pedigree|pedigree|k9-svc|signature|checksum' .Repository: hyperpolymath/patch-bridge Length of output: 27531 🏁 Script executed: #!/bin/sh
set -eu
printf '%s\n' '--- K9 README ---'
sed -n '1,220p' .machine_readable/svc/k9/README.adoc
printf '%s\n' '--- Hunt template ---'
cat -n .machine_readable/svc/k9/template-hunt.k9.ncl
printf '%s\n' '--- project K9 configuration ---'
cat -n k9iser.toml
printf '%s\n' '--- deployment documentation ---'
sed -n '145,170p' container/README.adocRepository: hyperpolymath/patch-bridge Length of output: 12129 🌐 Web query:
💡 Result: In the K9-svc ecosystem, K9 contractiles are self-validating configuration components that use a tiered security model known as The Leash [1][2]. The Hunt level is the highest security tier, which permits full execution of tasks, including subprocesses and shell commands (e.g., via Just recipes) [3][4][1]. For a K9 contractile to execute at the Hunt level, it requires a valid cryptographic signature and explicit authorization: 1. Signature Required: Hunt-level components must include a valid Ed25519 signature to prevent tampering [3][5][1]. Without this signature, conforming K9 tools will refuse to execute the recipes defined in the component [5]. 2. hunt_authorized Flag: Within the validation block of the K9 contractile, the hunt_authorized parameter must be set to true [3][5]. While this flag exists in the configuration, setting it to true alone is generally part of an authorization handshake; tools typically require the accompanying cryptographic signature to verify the component's integrity before execution [3][5][6]. Essentially, the Hunt level enables powerful automation capabilities but necessitates strict security enforcement—specifically, the combination of a valid digital signature and explicit authorization—to ensure that only trusted, unmodified components can run commands on the host [5][1]. Citations:
Sign and authorise the Hunt component before deployment.
🧰 Tools🪛 GitHub Check: Validate K9 contracts[warning] 1-1: [warning] 1-1: [failure] 1-1: 🤖 Prompt for AI Agents |
||
| # SPDX-License-Identifier: MPL-2.0 | ||
| # deploy.k9.ncl — Patch Bridge deployment component (Hunt level) | ||
| # | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔴 HIGH RISK
The removal of
pull-requests: writeandactions: readpermissions directly contradicts the documentation in lines 13-16 of this file, which states that the caller must grant the union of permissions or the run will 'startup-fail at plan time'.Restore these permissions to ensure the called reusable workflow has sufficient access.