diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 517077e..0836912 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -37,11 +37,11 @@ jobs: with: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) + uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) + uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 997e008..0677694 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -27,4 +27,10 @@ permissions: jobs: hypatia: + # secrets: inherit is required so HYPATIA_SCAN_PAT (org) reaches the + # reusable. It does not, and cannot, cure a Hypatia *scanner build* + # failure: the reusable still clones hypatia@HEAD and runs mix escript.build. + # That class of red is estate-wide (hypatia#863 broke HEAD on 2026-09-26) + # and is not a consumer finding. See docs/status/HYPATIA-GATE.adoc. uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 + secrets: inherit diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index a176cb2..a84b495 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -34,7 +34,7 @@ jobs: path: .casket-ssg - name: Setup GHCup - uses: haskell-actions/setup@v2.12.1 + uses: haskell-actions/setup@v2.12.0 with: ghc-version: '9.8.2' cabal-version: '3.10' diff --git a/docs/architecture/REPOSITORY-MAP.adoc b/docs/architecture/REPOSITORY-MAP.adoc index 8c77eea..e09598a 100644 --- a/docs/architecture/REPOSITORY-MAP.adoc +++ b/docs/architecture/REPOSITORY-MAP.adoc @@ -117,6 +117,10 @@ predecessors did. | yes | - +| `ULTRAPLAN.md` +| yes +| project plan of record (occupancy-types): thesis, rung contract, ladder, kill criteria, decision log + | `archetypes/` | optional | template-only variation seam (ADR-0003); `just repo-init` removes it from minted repos @@ -227,7 +231,6 @@ your own repo - but do not read their emptiness as neglect here. | `docs/whitepapers/academic/` | `docs/whitepapers/industry/` | `docs/whitepapers/outreach/` -| `examples/` | `features/boj-server/` | `features/panic-attacker/` | `src/aspects/` diff --git a/docs/status/HYPATIA-GATE.adoc b/docs/status/HYPATIA-GATE.adoc new file mode 100644 index 0000000..7232658 --- /dev/null +++ b/docs/status/HYPATIA-GATE.adoc @@ -0,0 +1,43 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// Copyright (c) Jonathan D.A. Jewell += Hypatia Gate & CodeRabbit Branch Audit +:toc: + +== The CodeRabbit Branch That Cannot Be Compared or Merged + +The compare link: +https://github.com/hyperpolymath/occupancy-types/compare/main...coderabbit/fix-hypatia-scan-failures/f36ac704[main...coderabbit/fix-hypatia-scan-failures/f36ac704] +fails with: +* *GitHub UI:* "There isn't anything to compare. main and coderabbit/fix-hypatia-scan-failures/f36ac704 are entirely different commit histories. This comparison is taking too long to generate." +* *GitHub API:* `HTTP 404: No common ancestor between main and coderabbit/fix-hypatia-scan-failures/f36ac704`. + +=== Forensic Root Cause + +* `main` is at `1b3578b85b309a8b08c52f3e519b6f625e9a0f28` (containing Initial commit `bee27f7`, Dependabot PR #1 `5fe6f86`, and R0-B/Stackcert PR #2 `dafa491` / `1b3578b`). +* `coderabbit/fix-hypatia-scan-failures/f36ac704` is commit `40296f60f0b3f9307a8deb577d7fe93053aca3fb` ("Initialize coderabbit/fix-hypatia-scan-failures/f36ac704"), created at `2026-09-27T12:35:25Z` (2 seconds after the repo's initial commit). +* Commit `40296f6` is a **parentless (orphan root) commit** with zero parents. It shares no git ancestor with `bee27f7` or `1b3578b`. +* Without a common ancestor, git and GitHub cannot compute a merge base, 3-dot diff, or 2-dot diff, preventing GitHub from rendering the comparison or opening a pull request. +* Crucially, the tree of `40296f6` is an outdated RSR-template snapshot (including obsolete layouts like `machine-readable/` instead of `.machine_readable/`, missing `www/`, missing modernization scripts, adding AGPL-3.0 text, and missing all `occupancy-types` research code). +* The actual Hypatia ignore entries from https://github.com/hyperpolymath/rsr-template-repo/pull/89[rsr-template-repo#89] (`RE001`, `RE005`, `RE008`) are already present on `main` in `.hypatia-ignore`. +* Merging this orphan branch would not fix any scan; it would wipe out the repository. + +**Recommended owner action:** Delete the remote branch `coderabbit/fix-hypatia-scan-failures/f36ac704`. + +== Root Cause of the CI Failures + +[cols="1,2,2"] +|=== +| Check | Root Cause | Fix + +| Hypatia Security Scan +| Reusable workflow `hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@da2c748` clones `hypatia@HEAD` and executes `mix escript.build`. An upstream regression (`hypatia#863` / `standards#1014`) broke the scanner build estate-wide (exiting in ~31s). The scanner never ran, so no consumer code findings occurred. Additionally, the caller workflow lacked `secrets: inherit` to pass `HYPATIA_SCAN_PAT`. +| Added `secrets: inherit` in `.github/workflows/hypatia-scan.yml`. Note: scanner build failures will resolve upstream once `hypatia@HEAD` builds cleanly. + +| Workflows dying with `startup_failure` on `main` (CodeQL, Pages, etc.) +| Dependabot PR #1 bumped `codeql-action` to 4.38.2 (`2892aa5`) and `haskell-actions/setup` to `v2.12.1` in the YAML without regenerating `.github/workflows/actions.lock`. This desync violates GitHub Actions lock integrity, causing GitHub to refuse the runs at startup with 0 jobs ("This run likely failed because of a workflow file issue."). Furthermore, `codeql-action` v4.38.1/4.38.2 is blocked estate-wide (`nexia-list#100`). +| Reverted `codeql-action/init` and `analyze` to `b96794f015dfd88f77b49b1c93e0fa7110f94c63` (v4.38.0, pinned in `actions.lock`). Reverted `haskell-actions/setup` to `v2.12.0` (pinned in `actions.lock`). + +| Repository Map Determinism Gate +| `REPOSITORY-MAP.adoc` was missing newly tracked files from PR #2 (`ULTRAPLAN.md` and populated `examples/`). +| Regenerated `docs/architecture/REPOSITORY-MAP.adoc` via `scripts/gen-repo-map.sh`. +|===