Skip to content

fix(ci): restore canonical standards closure evidence after fleet owner migration #639

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 2 commits into from
Nov 1, 2026
Merged

fix(ci): restore canonical standards closure evidence after fleet owner migration #639

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7211186
fix(ci): reconcile canonical-owner closure receipts with reviewed pin…
hyperpolymath Nov 1, 2026
25f6d24
fix(ci): fail closed for incomplete scanner migration, accept reviewe…
hyperpolymath Nov 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 27 additions & 5 deletions docs/migrations/secret-scanner-cicd-suite/preflight.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,15 +77,37 @@
cp "$ROOT/scripts/lib/lock-closure-receipts.tsv" "$TMP/tree/scripts/lib/" 2>/dev/null || true
cp "$ROOT/scripts/lib/lock-audit-baseline.tsv" "$TMP/tree/scripts/lib/" 2>/dev/null || true

# A prepared migration can subsequently be applied by an approved PR.
# In that case old patch hunks no longer apply; check the final artifacts.
apply_ok=1
for p in secret-scanner.yml.patch actions.lock.patch lock-closure-receipts.tsv.patch; do
if ! ( cd "$TMP/tree" && patch -p1 -s -f --no-backup-if-mismatch < "$MIG/patches/$p" ); then
finding PATCH-APPLY "patch does not apply to the current checkout: $p"
already_applied=0
if [ -f "$TMP/tree/.github/workflows/secret-scanner.yml" ] &&

Check failure on line 84 in docs/migrations/secret-scanner-cicd-suite/preflight.sh

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use '[[' instead of '[' for conditional tests. The '[[' construct is safer and more feature-rich. 


See more on https://sonarcloud.io/project/issues?id=hyperpolymath_gitbot-fleet&issues=AaGWgQS4np9-ELYloY0Q&open=AaGWgQS4np9-ELYloY0Q&pullRequest=639
grep -Fq "uses: $CALLEE" "$TMP/tree/.github/workflows/secret-scanner.yml"; then
already_applied=1
Comment on lines +84 to +86

@chatgpt-codex-connector chatgpt-codex-connector Bot Nov 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep the migration contract test runnable after application

When the checkout already contains the migrated caller, this branch skips all patch application, but scripts/tests/secret-scanner-migration-test.sh still mutates those patches to test unsafe configurations and later applies them to its copied tree. Running that dedicated test now produces three false passes (fast-pr, secret inheritance, and permissions are not rejected) before aborting when the already-applied patches fail, so the migration contract suite can no longer complete. Update the test fixture to start from the prepared pre-migration state, or otherwise let it explicitly exercise the patch path.

Useful? React with 👍 / 👎.

source_key="'hyperpolymath/cicd-suite@$SUITE_SHA'"
# Both caller's workflow map and dependency record must exist.
count=$(grep -Fc "$source_key" "$TMP/tree/.github/workflows/actions.lock" 2>/dev/null || true)
if [ "$count" -lt 2 ]; then

Check failure on line 90 in docs/migrations/secret-scanner-cicd-suite/preflight.sh

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use '[[' instead of '[' for conditional tests. The '[[' construct is safer and more feature-rich. 


See more on https://sonarcloud.io/project/issues?id=hyperpolymath_gitbot-fleet&issues=AaGWgQS4np9-ELYloY0R&open=AaGWgQS4np9-ELYloY0R&pullRequest=639
finding LOCK-MISSING "applied scanner lacks both pinned suite caller and dependency records"
apply_ok=0
fi
done
receipt=$(printf 'hyperpolymath/cicd-suite\t%s\tactions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' "$SUITE_SHA")
if ! grep -Fxq "$receipt" "$TMP/tree/scripts/lib/lock-closure-receipts.tsv" 2>/dev/null; then
finding CLOSURE-NO-RECEIPT "applied scanner lacks the reviewed pinned-suite closure receipt"
apply_ok=0
fi
else
for p in secret-scanner.yml.patch actions.lock.patch lock-closure-receipts.tsv.patch; do
if ! ( cd "$TMP/tree" && patch -p1 -s -f --no-backup-if-mismatch < "$MIG/patches/$p" ); then
finding PATCH-APPLY "patch does not apply to the current checkout: $p"
apply_ok=0
fi
done
fi

if [ "$CHECK_APPLY" -eq 1 ]; then
# The intended migration must be applicable OR already applied with its
# reviewed pinned artifacts. Partial transitions never count as success.
if [ "$CHECK_APPLY" -eq 1 ] && [ "$already_applied" -eq 0 ]; then

Check failure on line 110 in docs/migrations/secret-scanner-cicd-suite/preflight.sh

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use '[[' instead of '[' for conditional tests. The '[[' construct is safer and more feature-rich. 


See more on https://sonarcloud.io/project/issues?id=hyperpolymath_gitbot-fleet&issues=AaGWgQS4np9-ELYloY0T&open=AaGWgQS4np9-ELYloY0T&pullRequest=639

Check failure on line 110 in docs/migrations/secret-scanner-cicd-suite/preflight.sh

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use '[[' instead of '[' for conditional tests. The '[[' construct is safer and more feature-rich. 


See more on https://sonarcloud.io/project/issues?id=hyperpolymath_gitbot-fleet&issues=AaGWgQS4np9-ELYloY0S&open=AaGWgQS4np9-ELYloY0S&pullRequest=639
for p in "$MIG"/patches/*.patch; do
if ! ( cd "$ROOT" && patch -p1 --dry-run -s -f < "$p" >/dev/null 2>&1 ); then
finding PATCH-APPLY "patch --dry-run failed against $ROOT: $(basename "$p")"
Expand Down
28 changes: 15 additions & 13 deletions scripts/lib/lock-closure-receipts.tsv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,10 +21,10 @@
#
# PROVENANCE (re-emit, do not hand-edit)
# standards@75bd5994470661a099df562d6d5ad2fe744dbd66
# source: hyperpolymath/standards .github/workflows/{governance,hypatia-scan,
# source: metadatastician/standards .github/workflows/{governance,hypatia-scan,
# mirror,scorecard,secret-scanner}-reusable.yml at that commit
# command: ./scripts/audit-lock-closure.sh \
# --emit-receipt hyperpolymath/standards@75bd599... \
# --emit-receipt metadatastician/standards@75bd599... \
# --source <each of the five files>
# actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9
# source: action.yml at the commit the tag v5.0.0 resolved to when the lock
Expand All @@ -39,15 +39,17 @@
# new receipt for the new commit and remove the old rows in the same change.
#
# fields: source <TAB> commit <TAB> nested-ref
hyperpolymath/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
hyperpolymath/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
hyperpolymath/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
hyperpolymath/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed
hyperpolymath/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f
hyperpolymath/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393
hyperpolymath/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124
hyperpolymath/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63
hyperpolymath/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc
hyperpolymath/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
hyperpolymath/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555
metadatastician/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
metadatastician/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
metadatastician/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
metadatastician/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed
metadatastician/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f
metadatastician/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393
metadatastician/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124
metadatastician/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63
metadatastician/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc
metadatastician/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
metadatastician/standards 75bd5994470661a099df562d6d5ad2fe744dbd66 webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555
actions/upload-pages-artifact fc324d3547104276b827a68afc52ff2a11cc49c9 actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
# Reviewed source: hyperpolymath/cicd-suite/.github/workflows/secret-scanner-reusable.yml@4404c3c0474e17753fe7689f3485c02890aac113
hyperpolymath/cicd-suite 4404c3c0474e17753fe7689f3485c02890aac113 actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
Loading