Repository navigation
CI: 7 non-required checks red on main (build, 5× governance) #24
Description
These seven checks are red on main at eb8e1d0, and they are equally red on every PR head, for example #23 (a docs-only change). None of them is required; the only required context is scan / gitleaks, which passes. This issue records the deferral of these checks for #23, as §5c of the estate rules requires.
| Context | Failure (from the check-run annotations) |
|---|---|
build (×2) |
Deno: "NodeJS globals are not available in Deno". The build is still Deno/ReScript, which the estate bans in favour of Bun/AffineScript. |
governance / Licence consistency |
exit 1. See the AFFIRMATION in #23: licence texts are missing for MPL-2.0, CC-BY-SA-4.0, MIT and LicenseRef-Palimpsest-0.8, and the LICENSE header disagrees with its body. |
governance / Workflow security linter |
"1 of 6 action pin(s) DO NOT EXIST upstream". |
governance / Actions lockfile verify |
"no .github/workflows/actions.lock AND these refs are not SHA-pinned". |
governance / Check Workflow Staleness |
"scorecard-enforcer.yml is retired. Use scorecard.yml -> standards scorecard-reusable.yml instead"; there are stale pins. |
governance / Well-Known (RFC 9116 + RSR) |
"Mixed content (HTTP in HTML)". |
Acceptance criteria
-
buildsucceeds onmainwith a Bun or AffineScript toolchain (no Deno, npx or ReScript), or the workflow is removed together with the claims that depend on it. -
governance / Licence consistencypasses: every SPDX identifier in use has its text underLICENSES/, and theLICENSEheader matches its body. -
governance / Workflow security linterpasses: the nonexistent action pin is replaced by a real SHA. -
governance / Actions lockfile verifypasses:.github/workflows/actions.lockexists, is transitively closed, and everyuses:is SHA-pinned. -
governance / Check Workflow Stalenesspasses:scorecard-enforcer.ymlis replaced byscorecard.yml(standardsscorecard-reusable.yml), and the stale pins are refreshed. -
governance / Well-Known (RFC 9116 + RSR)passes: nohttp://references remain in the HTML it scans. - A fresh run on
mainshows all seven contexts green.
Activity
docs: draft AFFIRMATION at eb8e1d0 (owner signs on merge) (#23)