Repository navigation
CI: seven checks are red on main (lint-workflows, governance, Hypatia, build, elixir-ci, SonarQube on PRs) #210
Description
Measured 2026-10-02 on main @ 7b7e928 and on Dependabot PR #209 (identical failures; the PR's diff is actions.lock only):
| check | failure |
|---|---|
lint-workflows (×2) |
ERROR: .github/workflows/boj-build.yml missing permissions declaration |
governance / Workflow security linter |
red on main |
governance / Validate Hypatia Baseline |
red on main |
Hypatia Neurosymbolic Analysis |
red on main |
build |
red on main |
elixir-ci / Compile + test |
red on main |
SonarQube |
every PR (#203, #204, #205, #209): Something went wrong while trying to get the pullrequest with key 'N', exit 3. The SonarCloud project cannot see the PR (binding / PR-decoration config), not a code finding |
None is a required context (required checks on main: scan / gitleaks only), so none blocks a merge, but every PR inherits all seven.
Acceptance criteria
-
boj-build.ymldeclares top-levelpermissions:;lint-workflowsgreen onmain. -
governance / *,Hypatia Neurosymbolic Analysis,build,elixir-ci / Compile + testeach green onmain, or removed with a stated reason. -
SonarQubeeither analyses PRs (project bound to the repo for PR decoration) or is skipped on PRs where it cannot work.
🤖 Generated with Claude Code
Activity
chore(deps): bump the actions group with 4 updates (#209)
hyperpolymath commentedon Oct 9, 2026
SonarQube now fails for a different reason: the token is rejected (measured 2026-10-09).
008665f8, 2026-10-07T11:34Z).Create analysisfailed withERROR Not authorized. Please check the 'sonar.token' property or the 'SONAR_TOKEN' environment variable. Exit code 3.GET https://api.sonarcloud.io/analysis/jres … HTTP 403 Forbidden.SONAR_TOKENwas last set on 2026-09-23. The same 403 shows on boj-server (#338) and on metadatastician/marid (chore(deps): bump plug_cowboy from 2.8.0 to 2.8.1 #49). That points to the SonarCloud token, not to this repo's code. That is inferred: the token itself was not inspected.The third acceptance criterion above still covers this, with one change: a fresh token comes first, then the PR binding. The other four contexts named here (
build,governance / Validate Hypatia Baseline,governance / Workflow security linter,Hypatia Neurosymbolic Analysis) fail on PR #217's head99f49d70and at its base008665f8alike. #217 defers all five to this issue.docs: affirm state at 008665f (#217)