From fca5284c13dbed48fef6547ca409e5d05effd277 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 30 Sep 2026 10:34:28 +0100 Subject: [PATCH 1/2] ci(estate-audit): probe cicd-suite#36 head 8035446 (SHA-pinned reusable) Positive control for hyperpolymath/cicd-suite#36. Under this repo's sha_pinning_required, the current pin 6cb08dd startup-fails with zero jobs. If the job spawns and runs at 8035446, #36 is the cure. After #36 squash-merges, this will be repointed at the landed commit. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f --- .github/workflows/main-estate-audit.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml index 793d4f0..a0242c1 100644 --- a/.github/workflows/main-estate-audit.yml +++ b/.github/workflows/main-estate-audit.yml @@ -49,4 +49,4 @@ jobs: # tests/lock-transitive-closure.sh so that drift goes red there rather than # silently here. call-estate-audit: - uses: hyperpolymath/cicd-suite/.github/workflows/main-estate-audit.yml@6cb08dde98b70d20ad2d506e77dd6a517503eb08 + uses: hyperpolymath/cicd-suite/.github/workflows/main-estate-audit.yml@803544620a75f9604aea2e5a3e3169ad47909afe From 3e5ced17f43dbbc2e31a999ed1424f63fd77b5a5 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 30 Sep 2026 10:42:23 +0100 Subject: [PATCH 2/2] ci(estate-audit): pin the landed cicd-suite#36 merge (3bbdf75) Replaces the pre-merge probe SHA 8035446 with the squash commit that landed it. The reusable and actions/ tree are byte-identical between the two, so the probe run 36696994940 (estate-audit 30/30) covers this ref. Rewrites the caller comment: the gates are now fixed by literal SHAs inside the reusable, not by cicd-suite's actions.lock, which this repo's sha_pinning_required never honoured. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f --- .github/workflows/main-estate-audit.yml | 45 ++++++++++--------------- 1 file changed, 18 insertions(+), 27 deletions(-) diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml index a0242c1..acf7dd1 100644 --- a/.github/workflows/main-estate-audit.yml +++ b/.github/workflows/main-estate-audit.yml @@ -22,31 +22,22 @@ jobs: # a snapshot that is already stale (cicd-suite has since replaced # zig-hexadeca-check with zig-unified-api-adapter-check). # - # The SHA below is cicd-suite main as of 2026-09-22. Choosing it is necessary - # and NOT sufficient, and the reason is the whole point of this comment. - # - # That reusable invokes its 26 gates by BRANCH ref: - # - # uses: hyperpolymath/cicd-suite/actions/@main - # - # Under gh-actions-lock a branch ref is trusted from the lockfile, and the - # runner executes THE COMMIT THE LOCKFILE NAMES, not the branch tip. So the - # gates this repo actually runs are chosen by cicd-suite's actions.lock AT - # THE SHA BELOW -- not by the SHA below. - # - # Measured, not assumed. Pinning 0c1bc9f (the head of a run whose `Gate - # controls` job executed 14 steps) left this audit dying EXACTLY as before: - # run 35787980954, Required Files Gate, 82ms, silent exit 1, 25 gates - # skipped. The lock at 0c1bc9f still pinned cicd-suite@main at 9adb3908 -- - # four commits stale, carrying ZERO of the harness `-e` guards. The cure had - # merged and reached nobody. - # - # 6cb08dd is cicd-suite#35, which re-pinned that entry at 0c1bc9f (3 guards - # in required-files-check, 1 in spdx-license-check; 9adb3908 had 0 and 0). - # - # When re-pinning: check the LOCK at the candidate SHA, not the SHA's own - # tree, and check the STEP COUNT, not the square. cicd-suite#35 added - # tests/lock-transitive-closure.sh so that drift goes red there rather than - # silently here. + # The SHA below is cicd-suite#36 (3bbdf75). Before it, the reusable invoked + # its 26 gates by BRANCH ref (`cicd-suite/actions/@main`) and relied on + # cicd-suite's actions.lock to pin them. That lock is honoured only inside + # cicd-suite. This repo's Actions policy sets sha_pinning_required, which + # applies to every step a called reusable runs, so from 2026-09-23 each + # `@main` ref killed this caller at startup with jobs=0. The earlier pin, + # 6cb08dd, still dies that way. + # + # At 3bbdf75 every gate and the checkout are literal full-SHA refs, and the + # reusable is no longer in cicd-suite's lock. The ref we call and the + # composites it runs are therefore fixed by this one SHA, with no lockfile + # between them. Run 36696994940, on #36's head (same reusable and actions/ + # tree), ran estate-audit 30/30 steps. + # + # When re-pinning, check the STEP COUNT, not the square. The gates are only + # as fresh as the SHA they are pinned to inside the reusable. That drift goes + # red in cicd-suite's tests/lock-transitive-closure.sh, not silently here. call-estate-audit: - uses: hyperpolymath/cicd-suite/.github/workflows/main-estate-audit.yml@803544620a75f9604aea2e5a3e3169ad47909afe + uses: hyperpolymath/cicd-suite/.github/workflows/main-estate-audit.yml@3bbdf75987d120e552f4bc384283c47ee72833eb