Fix/token permissions id 20260911 #78
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| { | ||
| "name": "Immutable-Tags", | ||
| "target": "tag", | ||
| "enforcement": "active", | ||
| "conditions": { | ||
| "ref_name": { | ||
| "include": ["~ALL"], | ||
| "exclude": [] | ||
| } | ||
| }, | ||
| "bypass_actors": [], | ||
| "rules": [ | ||
| {"type": "creation"}, | ||
| {"type": "deletion"}, | ||
| {"type": "non_fast_forward"}, | ||
| {"type": "update"}, | ||
| {"type": "required_signatures"} | ||
| ] | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| { | ||
| "name": "Optimus-Branch", | ||
| "target": "branch", | ||
| "enforcement": "active", | ||
| "conditions": { | ||
| "ref_name": { | ||
| "include": ["~DEFAULT_BRANCH"], | ||
| "exclude": [] | ||
| } | ||
| }, | ||
| "bypass_actors": [], | ||
| "rules": [ | ||
| { | ||
| "type": "deletion" | ||
| }, | ||
| { | ||
| "type": "non_fast_forward" | ||
| }, | ||
| { | ||
| "type": "required_signatures" | ||
| }, | ||
| { | ||
| "type": "pull_request", | ||
| "parameters": { | ||
| "required_approving_review_count": 2, | ||
| "dismiss_stale_reviews_on_push": true, | ||
| "require_code_owner_review": true, | ||
| "require_last_push_approval": true, | ||
| "required_review_thread_resolution": true, | ||
| "require_extra_approval_for_unattributed_changes": true, | ||
| "required_reviewers": [], | ||
| "allowed_merge_methods": [] | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🛡️ Analyzed with Security Review | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
jq -e '
[
.rules[]
| select(.type == "pull_request")
| .parameters.allowed_merge_methods[]?
] as $methods
| ($methods | length > 0)
and all($methods[]; . == "merge" or . == "squash" or . == "rebase")
' .github/rulesets/Optimus-Branch.jsonRepository: hyperpolymath/krl Length of output: 161 🌐 Web query:
💡 Result: <search_synthesis> <source_evidence> Citations:
Security Misconfiguration Reachability: External Set at least one allowed merge method.
🤖 Prompt for AI AgentsSource: MCP tools |
||
| } | ||
| }, | ||
| { | ||
| "type": "required_status_checks", | ||
| "parameters": { | ||
| "strict_required_status_checks_policy": true, | ||
| "do_not_enforce_on_create": false, | ||
| "required_status_checks": [] | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🛡️ Analyzed with Security Review | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
jq -e '
[
.rules[]
| select(.type == "required_status_checks")
| .parameters.required_status_checks[]?.context
] as $contexts
| ($contexts | length > 0)
and all($contexts[]; type == "string" and length > 0)
' .github/rulesets/Optimus-Branch.jsonRepository: hyperpolymath/krl Length of output: 161 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
sed -n '1,120p' .github/rulesets/Optimus-Branch.json
printf '\n--- workflow jobs ---\n'
sed -n '1,100p' .github/workflows/static-analysis-gate.ymlRepository: hyperpolymath/krl Length of output: 5653 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
sed -n '100,240p' .github/workflows/static-analysis-gate.ymlRepository: hyperpolymath/krl Length of output: 6377 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
rg -n '^[[:space:]]{2}[A-Za-z0-9_-]+:|^[[:space:]]+name:' .github/workflows/static-analysis-gate.ymlRepository: hyperpolymath/krl Length of output: 723 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
sed -n '280,340p' .github/workflows/static-analysis-gate.ymlRepository: hyperpolymath/krl Length of output: 3053 Security Misconfiguration Reachability: External Populate The ruleset currently requires no status checks. Add the contexts 🤖 Prompt for AI AgentsSource: MCP tools |
||
| } | ||
| } | ||
| ] | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -105,21 +105,3 @@ labels: | |
|
|
||
| # ─── Branch Protection ───────────────────────────────────────────────────────── | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,178 @@ | ||||||||||||||||||||||
| # SPDX-License-Identifier: MPL-2.0 | ||||||||||||||||||||||
| # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk> | ||||||||||||||||||||||
| # | ||||||||||||||||||||||
| # KRL CI: Benchmarks and Tests | ||||||||||||||||||||||
| # | ||||||||||||||||||||||
| # Runs: | ||||||||||||||||||||||
| # 1. Language-specific tests (lexer, parser, queries) | ||||||||||||||||||||||
| # 2. Central benchmarks from proven-tests-and-benchmarks repo | ||||||||||||||||||||||
| # 3. GitGuardian secret scanning | ||||||||||||||||||||||
| # 4. SonarQubeCloud quality analysis | ||||||||||||||||||||||
| # 5. Existing E2E tests | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| name: CI - Tests & Benchmarks | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| on: | ||||||||||||||||||||||
| push: | ||||||||||||||||||||||
| branches: [main, develop] | ||||||||||||||||||||||
| paths: | ||||||||||||||||||||||
| - 'src/**' | ||||||||||||||||||||||
| - 'server/**' | ||||||||||||||||||||||
| - 'benches/**' | ||||||||||||||||||||||
| - 'tests/**' | ||||||||||||||||||||||
| - '.github/workflows/ci-benchmarks.yml' | ||||||||||||||||||||||
| pull_request: | ||||||||||||||||||||||
| branches: [main] | ||||||||||||||||||||||
| paths: | ||||||||||||||||||||||
| - 'src/**' | ||||||||||||||||||||||
| - 'server/**' | ||||||||||||||||||||||
| - 'benches/**' | ||||||||||||||||||||||
| - 'tests/**' | ||||||||||||||||||||||
| - '.github/workflows/ci-benchmarks.yml' | ||||||||||||||||||||||
| workflow_dispatch: | ||||||||||||||||||||||
| schedule: | ||||||||||||||||||||||
| # Nightly benchmarks | ||||||||||||||||||||||
| - cron: '0 2 * * *' | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| permissions: | ||||||||||||||||||||||
| contents: read | ||||||||||||||||||||||
| pull-requests: write | ||||||||||||||||||||||
|
Check warning on line 39 in .github/workflows/ci-benchmarks.yml
|
||||||||||||||||||||||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🛡️ Analyzed with Security Review | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -e
printf '%s\n' '--- workflow structure ---'
sed -n '1,230p' .github/workflows/ci-benchmarks.yml
printf '%s\n' '--- permission and reusable-workflow references ---'
rg -n -C 3 '^(permissions:| [A-Za-z0-9_-]+: (read|write)|uses:|secrets:|pull_request|dependabot)' .github/workflows/ci-benchmarks.ymlRepository: hyperpolymath/krl Length of output: 4751 🤖 get_repo_knowledge executed:
Length of output: 13597 🏁 Script executed: sed -n '1,230p' .github/workflows/ci-benchmarks.ymlRepository: hyperpolymath/krl Length of output: 4487 Security Misconfiguration Reachability: External Restrict The workflow-level permission applies to Proposed permission scope permissions:
contents: read
- pull-requests: write
jobs:
dependabot:
+ permissions:
+ contents: read
+ pull-requests: write
name: Dependabot📝 Committable suggestion
Suggested change
🧰 Tools🪛 GitHub Check: SonarCloud Code Analysis[warning] 39-39: Move this write permission from workflow level to job level. 🪛 zizmor (1.29.0)[error] 39-39: overly broad permissions (excessive-permissions): pull-requests: write is overly broad at the workflow level (excessive-permissions) [warning] 39-39: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment (undocumented-permissions) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||||||||||||||||||||||
|
|
||||||||||||||||||||||
| concurrency: | ||||||||||||||||||||||
| group: ci-benchmarks-${{ github.ref }} | ||||||||||||||||||||||
| cancel-in-progress: true | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| env: | ||||||||||||||||||||||
| BENCHMARKS_REPO: hyperpolymath/proven | ||||||||||||||||||||||
| BENCHMARKS_PATH: benchmarks/krl | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| jobs: | ||||||||||||||||||||||
| # Job 1: Run KRL-specific tests | ||||||||||||||||||||||
| krl-tests: | ||||||||||||||||||||||
| name: KRL Tests | ||||||||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||||||||
| timeout-minutes: 30 | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| steps: | ||||||||||||||||||||||
| - name: Checkout KRL repo | ||||||||||||||||||||||
| uses: actions/checkout@v4 | ||||||||||||||||||||||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🛡️ Analyzed with Security Review | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
sed -n '45,165p' .github/workflows/ci-benchmarks.ymlRepository: hyperpolymath/krl Length of output: 3194 🤖 get_repo_knowledge executed:
Length of output: 3908 Security Misconfiguration Reachability: External Pin every third-party action to an immutable commit SHA. The listed mutable tags execute code on the runner. The GitGuardian and SonarQube steps also receive credentials. Replace each listed reference with an audited full SHA and retain a version comment. 🧰 Tools🪛 zizmor (1.29.0)[warning] 57-60: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [error] 58-58: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 📍 Affects 1 file
🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||||||||||||||||||||||
| with: | ||||||||||||||||||||||
| fetch-depth: 0 | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| - name: Set up Zig | ||||||||||||||||||||||
| uses: goto-bus-stop/setup-zig@v2 | ||||||||||||||||||||||
|
Check failure on line 63 in .github/workflows/ci-benchmarks.yml
|
||||||||||||||||||||||
| with: | ||||||||||||||||||||||
| version: 0.16.0 | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| - name: Set up Julia | ||||||||||||||||||||||
| uses: julia-actions/setup-julia@v2 | ||||||||||||||||||||||
|
Check failure on line 68 in .github/workflows/ci-benchmarks.yml
|
||||||||||||||||||||||
| with: | ||||||||||||||||||||||
| version: '1.12' | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| - name: Run existing E2E tests | ||||||||||||||||||||||
| uses: ./.github/workflows/e2e.yml | ||||||||||||||||||||||
|
There was a problem hiding this comment. 🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win Run the E2E script instead of using a workflow as an action.
Proposed fix - name: Run existing E2E tests
- uses: ./.github/workflows/e2e.yml
+ run: bash tests/e2e.sh📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||
|
|
||||||||||||||||||||||
| - name: Run lexer/parser tests | ||||||||||||||||||||||
| run: | | ||||||||||||||||||||||
| # TODO: Replace with actual KRL lexer/parser tests | ||||||||||||||||||||||
|
Check warning on line 77 in .github/workflows/ci-benchmarks.yml
|
||||||||||||||||||||||
| julia --color=yes server/krl/test/lexer_test.jl | ||||||||||||||||||||||
| julia --color=yes server/krl/test/parser_test.jl | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| - name: Run query tests | ||||||||||||||||||||||
| run: | | ||||||||||||||||||||||
| # TODO: Replace with actual KRL query tests | ||||||||||||||||||||||
|
Check warning on line 83 in .github/workflows/ci-benchmarks.yml
|
||||||||||||||||||||||
| julia --color=yes server/krl/test/sql_test.jl | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| # Job 2: Run central benchmarks | ||||||||||||||||||||||
| benchmarks: | ||||||||||||||||||||||
| name: KRL Benchmarks | ||||||||||||||||||||||
| needs: krl-tests | ||||||||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||||||||
| timeout-minutes: 30 | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| steps: | ||||||||||||||||||||||
| - name: Checkout KRL repo | ||||||||||||||||||||||
| uses: actions/checkout@v4 | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| - name: Checkout proven benchmarks repo | ||||||||||||||||||||||
| uses: actions/checkout@v4 | ||||||||||||||||||||||
| with: | ||||||||||||||||||||||
| repository: ${{ env.BENCHMARKS_REPO }} | ||||||||||||||||||||||
| path: proven | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| - name: Install benchmark dependencies | ||||||||||||||||||||||
| run: | | ||||||||||||||||||||||
| sudo apt-get update | ||||||||||||||||||||||
| sudo apt-get install -y jq bc | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| - name: Run KRL benchmarks | ||||||||||||||||||||||
| run: | | ||||||||||||||||||||||
| cd proven/benchmarks/krl | ||||||||||||||||||||||
| # Run all benchmarks and compare with baselines | ||||||||||||||||||||||
| ./run.sh --all | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| - name: Upload benchmark results | ||||||||||||||||||||||
| uses: actions/upload-artifact@v4 | ||||||||||||||||||||||
| if: always() | ||||||||||||||||||||||
| with: | ||||||||||||||||||||||
| name: krl-benchmark-results | ||||||||||||||||||||||
| path: proven/benchmarks/krl/results.json | ||||||||||||||||||||||
| retention-days: 30 | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| # Job 3: GitGuardian secret scanning | ||||||||||||||||||||||
| gitguardian: | ||||||||||||||||||||||
| name: GitGuardian Secret Scan | ||||||||||||||||||||||
| needs: krl-tests | ||||||||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||||||||
| timeout-minutes: 10 | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| steps: | ||||||||||||||||||||||
| - name: Checkout code | ||||||||||||||||||||||
| uses: actions/checkout@v4 | ||||||||||||||||||||||
| with: | ||||||||||||||||||||||
| fetch-depth: 0 | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| - name: GitGuardian scan | ||||||||||||||||||||||
| uses: GitGuardian/ggshield-action@v1 | ||||||||||||||||||||||
|
Check failure on line 136 in .github/workflows/ci-benchmarks.yml
|
||||||||||||||||||||||
| with: | ||||||||||||||||||||||
| args: scan repo . | ||||||||||||||||||||||
| env: | ||||||||||||||||||||||
| GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }} | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| # Job 4: SonarQubeCloud quality analysis | ||||||||||||||||||||||
| sonarqube: | ||||||||||||||||||||||
| name: SonarQubeCloud Analysis | ||||||||||||||||||||||
| needs: krl-tests | ||||||||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||||||||
| timeout-minutes: 15 | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| steps: | ||||||||||||||||||||||
| - name: Checkout code | ||||||||||||||||||||||
| uses: actions/checkout@v4 | ||||||||||||||||||||||
| with: | ||||||||||||||||||||||
| fetch-depth: 0 | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| - name: SonarQube scan | ||||||||||||||||||||||
| uses: SonarSource/sonarqube-scan-action@v2 | ||||||||||||||||||||||
|
Check failure on line 156 in .github/workflows/ci-benchmarks.yml
|
||||||||||||||||||||||
| with: | ||||||||||||||||||||||
| args: >- | ||||||||||||||||||||||
| -Dsonar.projectKey=krl | ||||||||||||||||||||||
| -Dsonar.organization=hyperpolymath | ||||||||||||||||||||||
| -Dsonar.sources=src,server | ||||||||||||||||||||||
| -Dsonar.language=julia | ||||||||||||||||||||||
| env: | ||||||||||||||||||||||
| SONAR_TOKEN: ${{ secrets.SONARQUBE_TOKEN }} | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| # Job 5: CodeQL analysis (existing) | ||||||||||||||||||||||
| codeql: | ||||||||||||||||||||||
| name: CodeQL Analysis | ||||||||||||||||||||||
| needs: krl-tests | ||||||||||||||||||||||
| uses: ./.github/workflows/codeql.yml | ||||||||||||||||||||||
|
There was a problem hiding this comment. 🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: set -eu
printf '%s\n' '--- ci-benchmarks.yml (relevant sections) ---'
sed -n '145,185p' .github/workflows/ci-benchmarks.yml
printf '%s\n' '--- codeql.yml (trigger and top-level context) ---'
sed -n '1,45p' .github/workflows/codeql.yml
printf '%s\n' '--- dependabot-automerge.yml (trigger and top-level context) ---'
sed -n '1,45p' .github/workflows/dependabot-automerge.yml
printf '%s\n' '--- local reusable-workflow trigger declarations ---'
rg -n -U '^[[:space:]]*on:[[:space:]]*\n(?:[[:space:]]+.*\n)*[[:space:]]+workflow_call:' .github/workflows || trueRepository: hyperpolymath/krl Length of output: 4533 🤖 get_repo_knowledge executed:
Length of output: 14829 Declare
Add 🧰 Tools🪛 actionlint (1.7.12)[error] 170-170: error while parsing reusable workflow "./.github/workflows/codeql.yml": "workflow_call" event trigger is not found in "on:" at line:4, column:3 (workflow-call) 🪛 zizmor (1.29.0)[warning] 170-170: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow (secrets-inherit) 📍 Affects 1 file
🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||||||||||||||||||||||
| secrets: inherit | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| # Job 6: Dependabot (existing) | ||||||||||||||||||||||
| dependabot: | ||||||||||||||||||||||
| name: Dependabot | ||||||||||||||||||||||
| needs: krl-tests | ||||||||||||||||||||||
| uses: ./.github/workflows/dependabot-automerge.yml | ||||||||||||||||||||||
| secrets: inherit | ||||||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,37 @@ | ||||||
| # SPDX-License-Identifier: MPL-2.0 | ||||||
| name: KRL fragment conformance | ||||||
| on: | ||||||
| pull_request: | ||||||
| push: | ||||||
| branches: [main, master] | ||||||
| workflow_dispatch: | ||||||
| permissions: | ||||||
| contents: read | ||||||
| concurrency: | ||||||
| group: ${{ github.workflow }}-${{ github.ref }} | ||||||
| cancel-in-progress: true | ||||||
| jobs: | ||||||
| fragment: | ||||||
| runs-on: ubuntu-latest | ||||||
| timeout-minutes: 15 | ||||||
| steps: | ||||||
| - name: Checkout specification | ||||||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | ||||||
| with: | ||||||
| persist-credentials: false | ||||||
| - name: Checkout current QuandleDB implementation | ||||||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | ||||||
| with: | ||||||
| repository: hyperpolymath/quandledb | ||||||
| path: deps/quandledb | ||||||
| persist-credentials: false | ||||||
| - name: Record implementation revision | ||||||
| run: git -C deps/quandledb rev-parse HEAD | ||||||
| - name: Install Julia 1.12 | ||||||
| run: | | ||||||
| set -euo pipefail | ||||||
| curl -fsSL https://install.julialang.org -o "$RUNNER_TEMP/juliaup-init.sh" | ||||||
|
Check warning on line 33 in .github/workflows/fragment-conformance.yml
|
||||||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🛡️ Analyzed with Security Review | 🟡 Minor | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: sed -n '24,38p' .github/workflows/fragment-conformance.yml
curl --help all 2>/dev/null | grep -E -- '--proto(-redir)?' | head -5Repository: hyperpolymath/krl Length of output: 1021 Security Misconfiguration Reachability: External Require HTTPS for every installer redirect.
Proposed fix- curl -fsSL https://install.julialang.org -o "$RUNNER_TEMP/juliaup-init.sh"
+ curl --proto '=https' --proto-redir '=https' -fsSL https://install.julialang.org -o "$RUNNER_TEMP/juliaup-init.sh"📝 Committable suggestion
Suggested change
🧰 Tools🪛 GitHub Check: SonarCloud Code Analysis[warning] 33-33: Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it is safe here. 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||||||
| sh "$RUNNER_TEMP/juliaup-init.sh" --yes --default-channel 1.12 | ||||||
| echo "$HOME/.juliaup/bin" >> "$GITHUB_PATH" | ||||||
| - name: Check fragment acceptance and rejection | ||||||
| run: julia --startup-file=no tests/conformance/retrieval_fragment.jl deps/quandledb | ||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -19,7 +19,7 @@ on: | |
| workflows: ["Hypatia Neurosymbolic Analysis"] | ||
| types: [completed] | ||
| permissions: | ||
| contents: read | ||
|
There was a problem hiding this comment. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -e
printf '%s\n' '--- rhodibot.yml ---'
sed -n '1,220p' .github/workflows/rhodibot.yml
printf '%s\n' '--- dependabot-automerge.yml ---'
sed -n '1,140p' .github/workflows/dependabot-automerge.ymlRepository: hyperpolymath/krl Length of output: 14025 🤖 get_repo_knowledge executed:
Length of output: 25205 🏁 Script executed: #!/bin/bash
set -e
printf '%s\n' '--- changed permission context ---'
nl -ba .github/workflows/rhodibot.yml | sed -n '14,28p'
nl -ba .github/workflows/rhodibot.yml | sed -n '160,185p'
nl -ba .github/workflows/dependabot-automerge.yml | sed -n '34,50p'
printf '%s\n' '--- action and API bindings ---'
rg -n -C 3 'actions/|gh pr merge|enable-auto-merge|git push|contents:|permissions:' .github/workflows/rhodibot.yml .github/workflows/dependabot-automerge.ymlRepository: hyperpolymath/krl Length of output: 7042 🌐 Web query:
💡 Result: <search_synthesis> <source_evidence> Citations:
Restore
📍 Affects 2 files
🤖 Prompt for AI Agents |
||
| pull-requests: write | ||
| jobs: | ||
| rhodibot: | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
Repository: hyperpolymath/krl
Length of output: 161
🏁 Script executed:
Repository: hyperpolymath/krl
Length of output: 4184
🌐 Web query:
GitHub rulesets creation rule bypass actors tag creation official documentation💡 Result:
<search_synthesis>
In GitHub rulesets, bypass actors are specific entities granted permission to circumvent active rules, such as those restricting the creation of tags [1][2]. When configuring a tag ruleset, you can define a creation rule that allows only users with bypass permissions to create tags matching a specified pattern [2][3][4]. To manage these permissions, you add bypass actors to the ruleset&
#39;s "Bypass list" [1][5][6]. Eligible bypass actors include: - Repository administrators, organization owners, and enterprise owners [1][5]. - Users with the Maintain or Write repository role [1][6]. - Specific teams (excluding secret teams) [1]. - GitHub Apps [1][7]. - Deploy keys [5][8]. Through the GitHub REST API, these bypass actors are managed via thebypass_actorsarray, which specifies theactor_type(e.g.,Integration,RepositoryRole,Team,User) and theactor_id[3][4]. When using the API to configure bypasses, ensure you have the necessary write access to the ruleset, as thebypass_actorsproperty is protected to prevent sensitive information disclosure [3][4]. Note that while thebypass_modeoptionpull_requestexists for branch rulesets, it is not applicable for tag creation rulesets, as tag creation does not involve pull requests [3][4]. For tag creation, actors are generally configured withbypass_mode: alwaysorexempt[3][4].</search_synthesis>
<source_evidence>
Citations:
Allow a release actor to create tags, or remove the
creationrule.The active ruleset targets all tags. GitHub permits tag creation only for actors with bypass permission, but
bypass_actorsis empty. The release workflow runs after av*tag exists; it does not create the tag. An external release process may therefore be unable to create release tags. Add the release actor tobypass_actors, or remove thecreationrule if tag creation must remain available.🤖 Prompt for AI Agents
Source: MCP tools