Repository navigation
ci(hypatia): retire the cured invalid_actions_lock ack (#963) - #1239
Merged
Merged
Conversation
The .hypatia-baseline.json entry for invalid_actions_lock (rule_module [workflow_audit, workflow_hardening], file_pattern `**actions.lock`, tracking #963, expires 2026-12-22) acknowledged asana/push-signed-commits@d615... declaring the floating transitive actions/setup-python@v2 in .github/workflows/actions.lock. Its exit criterion "we replace the action" is met: - #1233 replaced the Asana action in .github/actions/signed-push/ with push-verified.sh. - #1238 removed both the asana/push-signed-commits and actions/setup-python@v2 records from actions.lock. Every lock key and every nested `uses:` ref is now a 40-hex SHA. Evidence the rule no longer fires: the Hypatia scan on main at 7d2041a (run 38484072239, scanner 51ab6496) reports 59 findings, none of type invalid_actions_lock and none naming actions.lock. findings_kept is empty, and the ack matched nothing in findings_suppressed. While it stood, `**actions.lock` would have muted ANY new invalid_actions_lock in the repo until 2026-12-22. Removing it shrinks the ledger, which check-exemption-ratchet.sh permits. No other entry changes. scripts/tests/apply-baseline-test.sh pinned the shipped ledger to hold exactly one such ack, so that section is inverted. It now asserts the ledger holds none and that both emission paths (workflow_audit `actions.lock`, workflow_hardening `.github/workflows/actions.lock`) reach the gate. The fixture-based list-valued rule_module tests are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TbbnKqskQA5mj5gfMniPzi
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Summary
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Docstring Coverage |  |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
| Description check | |
The description clearly explains the removal of the obsolete invalid_actions_lock acknowledgement, the related test updates, and the validation results. |
| Title check | |
The title clearly and concisely identifies the retirement of the cured invalid_actions_lock acknowledgement, which is the main change. |
✨ Finishing Touches
-
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit checks the ledger at dawn,
The old acknowledgement is gone.
Two findings stay in sight,
No baseline hides their light.
I nibble greens and hop away.
Comment @coderabbitai help to get the list of available commands.
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/38493064951 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #963.
Summary
Removes the
.hypatia-baseline.jsonacknowledgement forinvalid_actions_lock. The entry had:rule_module: ["workflow_audit", "workflow_hardening"]file_pattern: "**actions.lock"expires_at: 2026-12-22It acknowledged
asana/push-signed-commits@d615…, which declared the floating transitiveactions/setup-python@v2. One of its listed exit criteria was "we replace the action", and that is now met:.github/actions/signed-push/withpush-verified.sh.asana/push-signed-commitsand theactions/setup-python@v2records fromactions.lock.While the entry stood,
**actions.lockwould have muted any newinvalid_actions_lockfinding in the repo until 2026-12-22.Evidence the rule no longer fires on
mainThese are from the Hypatia scan on
mainat7d2041a(run 38484072239, scanner pinned at51ab6496):findings_keptis[].invalid_actions_lock. The two highs are WH013 andncl_k9_missing_pedigree.actions.lock, asana or setup-python anywhere in the log.The ack was matching nothing. Both lock checks from the task print nothing on this branch:
uses:grep.Changes
.hypatia-baseline.jsonscripts/tests/apply-baseline-test.shinvalid_actions_lockack and that both emission paths reach the gate (workflow_audit/actions.lockandworkflow_hardening/.github/workflows/actions.lock). The fixture-based tests for list-valuedrule_moduleare unchanged.docs/HYPATIA-BASELINE-FORMAT.adoc, the schema description and the comment inapply-baseline.shstill useinvalid_actions_lockas their example of one defect emitted by two modules. That describes how the scanner behaves, not a live ack, so they are left as they are.Testing
bash scripts/tests/exemption-ratchet-test.shbash scripts/tests/apply-baseline-test.shbash scripts/tests/hypatia-blocking-gate-test.shscripts/check-exemption-ratchet.sh origin/mainSHRANK .hypatia-baseline.json: 189 -> 188. OK, and noRatchet-exception:was needed.apply-baseline.shon[]in blocking modeapply-baseline.shwith bothinvalid_actions_lockemissions in blocking mode.githooks/pre-commitandcommit-msgThe Hypatia scanner itself was not run locally, because the container has no Elixir. This PR's own
scan / Hypatia Neurosymbolic Analysisrun is the live confirmation.Licence headers are untouched.
🤖 Generated with Claude Code
https://claude.ai/code/session_01TbbnKqskQA5mj5gfMniPzi