Repository navigation
fix(ci): canonical standards owner in fleet callers and propagation sender - #638
Conversation
|
Caution Review failedThe pull request is closed. Walkthrough
Merge Risk:
 |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 29ecda705b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| owner_id: 6759885 | ||
| repo_id: 1352485172 | ||
| 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': | ||
| 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': |
There was a problem hiding this comment.
Renaming this lock record without changing scripts/lib/lock-closure-receipts.tsv leaves all receipt rows keyed to hyperpolymath/standards. Consequently, ./scripts/audit-lock-closure.sh reports the old receipt as RECEIPT-UNUSED, reports this new record as CLOSURE-NO-RECEIPT, and exits 3 in the E2E workflow's "Audit this repository's lock closure" step. Move the existing SHA-bound receipt rows to metadatastician/standards as part of this owner migration so the recorded nested dependency closure remains verifiable.
Useful? React with 👍 / 👎.
| owner_id: 6759885 | ||
| repo_id: 1352485172 | ||
| 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': | ||
| 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': |
There was a problem hiding this comment.
This coordinate change leaves ScannerCallerTests.test_scanner_pin_and_lock_closure hard-coded to hyperpolymath/standards@75bd599… in tests/workflow-lock-map-test.py: it asserts that the old dependency key still exists and that a workflow edge still names it. With this lockfile, both assertions are false, so the first E2E step (python3 tests/workflow-lock-map-test.py) fails on every run. Update that expected coordinate to metadatastician/standards alongside the lock migration.
Useful? React with 👍 / 👎.
…er migration (#639) ## Immediate cause PR #638 changed the canonical standards workflow owner and `actions.lock` to `metadatastician/standards`, but was merged while its latest-head E2E lock-closure gate was red. The pre-existing review receipts in `scripts/lib/lock-closure-receipts.tsv` still said `hyperpolymath/standards`. The E2E failure also reported a distinct `NOT-RUN CLOSURE-NO-RECEIPT` for `hyperpolymath/cicd-suite@4404c3c...`. ## Fix - Repoint the eleven existing reviewed standards closure receipts to the canonical owner while preserving the exact SHA and each audited transitive `uses:` edge. - Emit and add a separate receipt for `hyperpolymath/cicd-suite@4404c3c0474e17753fe7689f3485c02890aac113` from the **actual pinned** `.github/workflows/secret-scanner-reusable.yml` source, which names only `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1` (twice; receipt deduplicates it). This is not fabricated evidence. - Leave the reviewed baseline exceptions intact, clearly marked as accepted debt; do not disable the closure check or relax SHA pinning. ## Local evidence After applying this single receipt file to the canary tree, `bash scripts/tests/lock-closure-test.sh` in a trusted scratch directory: **47 passed, 0 failed**. The prior state was **45 passed, 2 failed**. This fixes the exact observed Gate failure on #638. Signed GitHub-verified commit `72111863642438f3eb3d94e2e47f967d0cbe8bb7`. **Draft until final hosted CI succeeds.** No estate-wide rollout, notification archive operations, or merges are done by this PR.
Root incident
On 2026-11-01 a GitHub notification audit found 200 unread Scorecard zero-job failures concentrated at 04:00 UTC, across the user's estates. Representative consumer workflows still call
hyperpolymath/standards/.github/workflows/...@SHAafter the standards repository was transferred tometadatastician/standards. GitHub REST follows the old repository redirect; Actions reusable-workflow startup does not. This is the precursor to a controlled estate-wide migration, not a batch rollout.Changes
metadatastician/standardsowner while preserving the already audited commit75bd5994470661a099df562d6d5ad2fe744dbd66and the same job permission grants.scripts/propagate-sha-bump.shto accept canonicalmetadatastician/standardsas a source, explicitly refuse a misleading legacyhyperpolymath/standardsSHA bump, and includecatachresis-colloquiumplusstuff-of-awewhen discovering estate consumers.Verification
Event-chain gate
DRAFT — DO NOT MERGE OR FAN OUT YET. Check actual GitHub Actions jobs and allowed-actions setting on this branch; add small negative controls and verify lock closure. The source-policy correction alone does not migrate any other consumer, update their Actions permissions, or resolve unrelated CodeQL/Scorecard issues.
Recovery audit
The separate notification audit checked 642 PR/issue notifications and found 19 open PRs (3 drafts) plus 21 open issues; full report was written to The-Titanic Downloads. No notification states were mutated.
Summary by CodeRabbit