diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 4246ec3b..c5cbddb0 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -30,11 +30,11 @@ workflows: - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333' '.github/workflows/governance.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/hypatia-dispatch-intake.yml': - 'actions/checkout@v7.0.1' '.github/workflows/hypatia-scan.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/inbox-steward.yml': - 'actions/checkout@v7.0.1' '.github/workflows/instant-sync.yml': @@ -46,7 +46,7 @@ workflows: - 'actions/upload-artifact@v7.0.2' '.github/workflows/lock-sync-gate.yml': [] '.github/workflows/mirror.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/pages.yml': - 'actions/checkout@v7.0.1' - 'actions/deploy-pages@v5.0.1' @@ -63,7 +63,7 @@ workflows: '.github/workflows/rust.yml': - 'actions/checkout@v7.0.1' '.github/workflows/scorecard.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/secret-scanner.yml': - 'hyperpolymath/cicd-suite@4404c3c0474e17753fe7689f3485c02890aac113' '.github/workflows/supervised-fleet-scan.yml': @@ -195,10 +195,10 @@ dependencies: commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef' owner_id: 6759885 repo_id: 1352485172 - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': + 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': ref: '75bd5994470661a099df562d6d5ad2fe744dbd66' commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66' - owner_id: 6759885 + owner_id: 297579217 repo_id: 1116521501 uses: - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 039dbdca..3d1fc85a 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -35,7 +35,7 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + uses: metadatastician/standards/.github/workflows/governance-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 permissions: actions: read contents: read diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index ac8947d5..09592ae8 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -31,7 +31,7 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # hypatia-scan-reusable declares one secret; pass that one, not everything. secrets: HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }} diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 93ef2652..55546a15 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -15,7 +15,7 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # mirror-reusable declares exactly these seven forge keys and forbids # `secrets: inherit`; pass them by name. secrets: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 34aded1e..a1bebdd0 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -18,4 +18,4 @@ jobs: contents: read security-events: write id-token: write - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 diff --git a/scripts/propagate-sha-bump.sh b/scripts/propagate-sha-bump.sh index 33e1f816..37755a4e 100755 --- a/scripts/propagate-sha-bump.sh +++ b/scripts/propagate-sha-bump.sh @@ -80,9 +80,14 @@ if [[ "$old_sha" == "$new_sha" ]]; then exit 1 fi +# The old standards alias resolves in API reads but cannot execute as reusable. +# Refuse a misleading SHA-only bump; the owner migration is a separate event. case "$source_repo" in - hyperpolymath/*) ;; - *) echo "ERROR: source_repo not in hyperpolymath/* : '$source_repo'" >&2; exit 1 ;; + hyperpolymath/standards) + echo "ERROR: hyperpolymath/standards is a transferred alias; migrate to metadatastician/standards first" >&2 + exit 1 ;; + hyperpolymath/*|metadatastician/standards|catachresis-colloquium/*|stuff-of-awe/*) ;; + *) echo "ERROR: source_repo outside approved estate: '$source_repo'" >&2; exit 1 ;; esac case "$source_workflow" in @@ -216,8 +221,11 @@ else done } + # Include every named estate, rather than silently ignoring two organisations. search_scope "user:hyperpolymath" search_scope "org:metadatastician" + search_scope "org:catachresis-colloquium" + search_scope "org:stuff-of-awe" sort -u -o "$CONSUMERS_TSV" "$CONSUMERS_TSV" fi diff --git a/tests/propagate-sha-bump-smoke.sh b/tests/propagate-sha-bump-smoke.sh index 027522a8..172219da 100755 --- a/tests/propagate-sha-bump-smoke.sh +++ b/tests/propagate-sha-bump-smoke.sh @@ -24,7 +24,7 @@ set -euo pipefail case "$*" in *'/compare/'*) printf '%s\n' "${MOCK_COMPARE_STATUS:-ahead}" ;; *'/contents/'*) printf '%s\n' file ;; - *'repos/hyperpolymath/standards --jq .default_branch'*) printf '%s\n' main ;; + *'repos/metadatastician/standards --jq .default_branch'*) printf '%s\n' main ;; *'--jq [.fork, .archived] | @tsv'*) printf 'false\tfalse\n' ;; *) printf '%s\n' '{}' ;; esac @@ -51,7 +51,7 @@ assert_exit() { cat > "$tmp/wrong-rule.json" <<'EOF' { "rule": "some_other_rule", - "source_repo": "hyperpolymath/standards", + "source_repo": "metadatastician/standards", "source_workflow": ".github/workflows/governance-reusable.yml", "old_sha": "0011223344556677889900112233445566778899", "new_sha": "abcdef0123456789abcdef0123456789abcdef01", @@ -68,7 +68,7 @@ set -e cat > "$tmp/bad-sha.json" <<'EOF' { "rule": "reusable_workflow_sha_bump_needs_propagation", - "source_repo": "hyperpolymath/standards", + "source_repo": "metadatastician/standards", "source_workflow": ".github/workflows/governance-reusable.yml", "old_sha": "not-a-sha", "new_sha": "abcdef0123456789abcdef0123456789abcdef01", @@ -85,7 +85,7 @@ set -e cat > "$tmp/same-sha.json" <<'EOF' { "rule": "reusable_workflow_sha_bump_needs_propagation", - "source_repo": "hyperpolymath/standards", + "source_repo": "metadatastician/standards", "source_workflow": ".github/workflows/governance-reusable.yml", "old_sha": "abcdef0123456789abcdef0123456789abcdef01", "new_sha": "abcdef0123456789abcdef0123456789abcdef01", @@ -119,7 +119,7 @@ set -e cat > "$tmp/license-title.json" <<'EOF' { "rule": "reusable_workflow_sha_bump_needs_propagation", - "source_repo": "hyperpolymath/standards", + "source_repo": "metadatastician/standards", "source_workflow": ".github/workflows/governance-reusable.yml", "old_sha": "0011223344556677889900112233445566778899", "new_sha": "abcdef0123456789abcdef0123456789abcdef01", @@ -140,11 +140,35 @@ else ((fail++)) fi +# 5b. A transferred standards source must fail closed before dispatch. +cat > "$tmp/transferred-source.json" <<'EOF' +{ + "rule": "reusable_workflow_sha_bump_needs_propagation", + "source_repo": "hyperpolymath/standards", + "source_workflow": ".github/workflows/governance-reusable.yml", + "old_sha": "0011223344556677889900112233445566778899", + "new_sha": "abcdef0123456789abcdef0123456789abcdef01", + "pr_title": "ci: tested governance update", + "pr_number": 1000 +} +EOF +set +e +out=$("$SCRIPT" /ignored "$tmp/transferred-source.json" 2>&1) +rc=$? +set -e +assert_exit "transferred source alias → hard refusal" 1 "$rc" +if printf '%s' "$out" | grep -q 'transferred alias'; then + echo "ok transferred alias explains canonical migration" + ((pass++)) +else + echo "FAIL transferred alias explanation missing" + ((fail++)) +fi # 6. DRY_RUN with valid finding + override TSV → exit 0, payload printed. cat > "$tmp/good.json" <<'EOF' { "rule": "reusable_workflow_sha_bump_needs_propagation", - "source_repo": "hyperpolymath/standards", + "source_repo": "metadatastician/standards", "source_workflow": ".github/workflows/governance-reusable.yml", "old_sha": "0011223344556677889900112233445566778899", "new_sha": "abcdef0123456789abcdef0123456789abcdef01", diff --git a/tests/workflow-lock-map-test.py b/tests/workflow-lock-map-test.py index a6e10fbb..51d2d1e6 100644 --- a/tests/workflow-lock-map-test.py +++ b/tests/workflow-lock-map-test.py @@ -210,7 +210,7 @@ def test_scanner_pin_and_lock_closure(self): self.assertEqual((record['ref'], record['commit']), (sha, 'sha1-' + sha)) self.assertEqual(record['uses'], [checkout]) self.assertIn(checkout, self.lock['dependencies']) - standards = 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + standards = 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' self.assertIn(standards, self.lock['dependencies']) self.assertTrue(any(standards in edges for edges in self.lock['workflows'].values()))