Skip to content

fix(ci): canonical standards owner in fleet callers and propagation sender #638

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 2 commits into from
Nov 1, 2026
Merged

fix(ci): canonical standards owner in fleet callers and propagation sender #638

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
29ecda7
fix(ci): canonical standards callers and fail-closed estate propagation
hyperpolymath Nov 1, 2026
b6a0722
test(ci): expect canonical standards owner in lock-map assertions
hyperpolymath Nov 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions .github/workflows/actions.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,11 +30,11 @@ workflows:
- 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
- 'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333'
'.github/workflows/governance.yml':
- 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66'
- 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66'
'.github/workflows/hypatia-dispatch-intake.yml':
- 'actions/checkout@v7.0.1'
'.github/workflows/hypatia-scan.yml':
- 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66'
- 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66'
'.github/workflows/inbox-steward.yml':
- 'actions/checkout@v7.0.1'
'.github/workflows/instant-sync.yml':
Expand All @@ -46,7 +46,7 @@ workflows:
- 'actions/upload-artifact@v7.0.2'
'.github/workflows/lock-sync-gate.yml': []
'.github/workflows/mirror.yml':
- 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66'
- 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66'
'.github/workflows/pages.yml':
- 'actions/checkout@v7.0.1'
- 'actions/deploy-pages@v5.0.1'
Expand All @@ -63,7 +63,7 @@ workflows:
'.github/workflows/rust.yml':
- 'actions/checkout@v7.0.1'
'.github/workflows/scorecard.yml':
- 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66'
- 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66'
'.github/workflows/secret-scanner.yml':
- 'hyperpolymath/cicd-suite@4404c3c0474e17753fe7689f3485c02890aac113'
'.github/workflows/supervised-fleet-scan.yml':
Expand Down Expand Up @@ -195,10 +195,10 @@ dependencies:
commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef'
owner_id: 6759885
repo_id: 1352485172
'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66':
'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66':

@chatgpt-codex-connector chatgpt-codex-connector Bot Nov 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update the closure receipt for the canonical owner

Renaming this lock record without changing scripts/lib/lock-closure-receipts.tsv leaves all receipt rows keyed to hyperpolymath/standards. Consequently, ./scripts/audit-lock-closure.sh reports the old receipt as RECEIPT-UNUSED, reports this new record as CLOSURE-NO-RECEIPT, and exits 3 in the E2E workflow's "Audit this repository's lock closure" step. Move the existing SHA-bound receipt rows to metadatastician/standards as part of this owner migration so the recorded nested dependency closure remains verifiable.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Nov 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update the lock-map regression test for the new owner

This coordinate change leaves ScannerCallerTests.test_scanner_pin_and_lock_closure hard-coded to hyperpolymath/standards@75bd599… in tests/workflow-lock-map-test.py: it asserts that the old dependency key still exists and that a workflow edge still names it. With this lockfile, both assertions are false, so the first E2E step (python3 tests/workflow-lock-map-test.py) fails on every run. Update that expected coordinate to metadatastician/standards alongside the lock migration.

Useful? React with 👍 / 👎.

ref: '75bd5994470661a099df562d6d5ad2fe744dbd66'
commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66'
owner_id: 6759885
owner_id: 297579217
repo_id: 1116521501
uses:
- 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/governance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ permissions:

jobs:
governance:
uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
uses: metadatastician/standards/.github/workflows/governance-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
permissions:
actions: read
contents: read
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/hypatia-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ permissions:

jobs:
hypatia:
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
# hypatia-scan-reusable declares one secret; pass that one, not everything.
secrets:
HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/mirror.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ permissions:

jobs:
mirror:
uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
# mirror-reusable declares exactly these seven forge keys and forbids
# `secrets: inherit`; pass them by name.
secrets:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/scorecard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,4 +18,4 @@ jobs:
contents: read
security-events: write
id-token: write
uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
12 changes: 10 additions & 2 deletions scripts/propagate-sha-bump.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,9 +80,14 @@ if [[ "$old_sha" == "$new_sha" ]]; then
exit 1
fi

# The old standards alias resolves in API reads but cannot execute as reusable.
# Refuse a misleading SHA-only bump; the owner migration is a separate event.
case "$source_repo" in
hyperpolymath/*) ;;
*) echo "ERROR: source_repo not in hyperpolymath/* : '$source_repo'" >&2; exit 1 ;;
hyperpolymath/standards)
echo "ERROR: hyperpolymath/standards is a transferred alias; migrate to metadatastician/standards first" >&2
exit 1 ;;
hyperpolymath/*|metadatastician/standards|catachresis-colloquium/*|stuff-of-awe/*) ;;
*) echo "ERROR: source_repo outside approved estate: '$source_repo'" >&2; exit 1 ;;
esac

case "$source_workflow" in
Expand Down Expand Up @@ -216,8 +221,11 @@ else
done
}

# Include every named estate, rather than silently ignoring two organisations.
search_scope "user:hyperpolymath"
search_scope "org:metadatastician"
search_scope "org:catachresis-colloquium"
search_scope "org:stuff-of-awe"
sort -u -o "$CONSUMERS_TSV" "$CONSUMERS_TSV"
fi

Expand Down
36 changes: 30 additions & 6 deletions tests/propagate-sha-bump-smoke.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ set -euo pipefail
case "$*" in
*'/compare/'*) printf '%s\n' "${MOCK_COMPARE_STATUS:-ahead}" ;;
*'/contents/'*) printf '%s\n' file ;;
*'repos/hyperpolymath/standards --jq .default_branch'*) printf '%s\n' main ;;
*'repos/metadatastician/standards --jq .default_branch'*) printf '%s\n' main ;;
*'--jq [.fork, .archived] | @tsv'*) printf 'false\tfalse\n' ;;
*) printf '%s\n' '{}' ;;
esac
Expand All @@ -51,7 +51,7 @@ assert_exit() {
cat > "$tmp/wrong-rule.json" <<'EOF'
{
"rule": "some_other_rule",
"source_repo": "hyperpolymath/standards",
"source_repo": "metadatastician/standards",
"source_workflow": ".github/workflows/governance-reusable.yml",
"old_sha": "0011223344556677889900112233445566778899",
"new_sha": "abcdef0123456789abcdef0123456789abcdef01",
Expand All @@ -68,7 +68,7 @@ set -e
cat > "$tmp/bad-sha.json" <<'EOF'
{
"rule": "reusable_workflow_sha_bump_needs_propagation",
"source_repo": "hyperpolymath/standards",
"source_repo": "metadatastician/standards",
"source_workflow": ".github/workflows/governance-reusable.yml",
"old_sha": "not-a-sha",
"new_sha": "abcdef0123456789abcdef0123456789abcdef01",
Expand All @@ -85,7 +85,7 @@ set -e
cat > "$tmp/same-sha.json" <<'EOF'
{
"rule": "reusable_workflow_sha_bump_needs_propagation",
"source_repo": "hyperpolymath/standards",
"source_repo": "metadatastician/standards",
"source_workflow": ".github/workflows/governance-reusable.yml",
"old_sha": "abcdef0123456789abcdef0123456789abcdef01",
"new_sha": "abcdef0123456789abcdef0123456789abcdef01",
Expand Down Expand Up @@ -119,7 +119,7 @@ set -e
cat > "$tmp/license-title.json" <<'EOF'
{
"rule": "reusable_workflow_sha_bump_needs_propagation",
"source_repo": "hyperpolymath/standards",
"source_repo": "metadatastician/standards",
"source_workflow": ".github/workflows/governance-reusable.yml",
"old_sha": "0011223344556677889900112233445566778899",
"new_sha": "abcdef0123456789abcdef0123456789abcdef01",
Expand All @@ -140,11 +140,35 @@ else
((fail++))
fi

# 5b. A transferred standards source must fail closed before dispatch.
cat > "$tmp/transferred-source.json" <<'EOF'
{
"rule": "reusable_workflow_sha_bump_needs_propagation",
"source_repo": "hyperpolymath/standards",
"source_workflow": ".github/workflows/governance-reusable.yml",
"old_sha": "0011223344556677889900112233445566778899",
"new_sha": "abcdef0123456789abcdef0123456789abcdef01",
"pr_title": "ci: tested governance update",
"pr_number": 1000
}
EOF
set +e
out=$("$SCRIPT" /ignored "$tmp/transferred-source.json" 2>&1)
rc=$?
set -e
assert_exit "transferred source alias → hard refusal" 1 "$rc"
if printf '%s' "$out" | grep -q 'transferred alias'; then
echo "ok transferred alias explains canonical migration"
((pass++))
else
echo "FAIL transferred alias explanation missing"
((fail++))
fi
# 6. DRY_RUN with valid finding + override TSV → exit 0, payload printed.
cat > "$tmp/good.json" <<'EOF'
{
"rule": "reusable_workflow_sha_bump_needs_propagation",
"source_repo": "hyperpolymath/standards",
"source_repo": "metadatastician/standards",
"source_workflow": ".github/workflows/governance-reusable.yml",
"old_sha": "0011223344556677889900112233445566778899",
"new_sha": "abcdef0123456789abcdef0123456789abcdef01",
Expand Down
2 changes: 1 addition & 1 deletion tests/workflow-lock-map-test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,7 +210,7 @@ def test_scanner_pin_and_lock_closure(self):
self.assertEqual((record['ref'], record['commit']), (sha, 'sha1-' + sha))
self.assertEqual(record['uses'], [checkout])
self.assertIn(checkout, self.lock['dependencies'])
standards = 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66'
standards = 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66'
self.assertIn(standards, self.lock['dependencies'])
self.assertTrue(any(standards in edges for edges in self.lock['workflows'].values()))

Expand Down
Loading