Repository navigation
ci(estate-audit): call cicd-suite's reusable audit instead of a frozen copy - #44
Merged
Merged
Conversation
…n copy Not a rung (CI). The 26-step copy of cicd-suite's estate audit was frozen by actions.lock at cicd-suite@5a10b72, before cicd-suite #32 fixed the Required Files Gate. All 26 gates ran in one job, so the first failure masked the rest: "estate-audit: failing after 8s". - main-estate-audit.yml is now a ten-line caller of hyperpolymath/cicd-suite's reusable audit, pinned at a full SHA. It reports five checks: governance, hygiene, manifests, languages, advisory. - actions.lock: the caller is de-onboarded by cicd-suite's scripts/deonboard-estate-audit.sh (pure removals). Onboarded, a cross-repo reusable call startup-fails under sha_pinning_required. - track-estate-audit.yml: a weekly PR that moves the pin to cicd-suite HEAD; needs AUTOMATION_TOKEN. - STATE.adoc entry. Pinned at b9d4f24 (head of hyperpolymath/cicd-suite#50) as the end-to-end test; re-pin to its merge commit once it lands. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VTeVWDEJgdYKsUNr4uhnXX
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 13 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
pushed a commit
that referenced
this pull request
Oct 14, 2026
Ports the workflow and lock changes of #44 so that this PR's estate-audit check runs the fixed audit instead of the frozen 26-step copy. #44 is green on all five component checks against cicd-suite b9d4f24 (hyperpolymath/cicd-suite#50). The ported files are byte-identical to #44's, so whichever merges second sees no diff for them. #44 keeps the STATE.adoc entry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VTeVWDEJgdYKsUNr4uhnXX
This was referenced Oct 14, 2026
…ommits Takes hyperpolymath/cicd-suite#50's review fix to the track bot: if ci/track-estate-audit holds a commit not made by the bot, the bot leaves it alone instead of force-pushing over it. The pin moves to #50's new head; its reusable workflow is unchanged from b9d4f24. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VTeVWDEJgdYKsUNr4uhnXX
hyperpolymath
marked this pull request as ready for review
October 14, 2026 09:11
…7579-estate # Conflicts: # STATE.adoc
hyperpolymath
added a commit
to hyperpolymath/cicd-suite
that referenced
this pull request
Oct 14, 2026
…-tracking bot (#50) ## Why Consumers kept reporting `Central Estate CI/CD Audit / estate-audit: failing after 8s`. There were three causes, and none of them was the gate code on main. 1. **Copies freeze.** Each estate repository held a full copy of the 26-step workflow, pinned through its `actions.lock`. hyperpolymath/marches, for example, held `cicd-suite@main` at `5a10b72`, the commit before #32 fixed required-files. With the gates at `5a10b72`, 25 of 26 pass on marches and required-files fails, which matches its CI. At `4f54042` (current main), all 26 pass. Fixes made here never reached a consumer. 2. **One job masks the rest.** All 26 gates ran in one job, so the first failure hid every later gate. 3. **Stubs were run.** `prat` and `semantic-audit` printed success without checking anything (README defect 5). ## What changes - **`.github/workflows/main-estate-audit.yml`** stays a reusable workflow. It has had `workflow_call` since #7, but it now runs five jobs, one check run each: - `governance`: required-files · spdx-license · affirmation · referencing - `hygiene`: code-hygiene · formatting · linguist · secrets · vaulted-tokens - `manifests`: manifest · recipes-set - `languages`: idris2-abi · zig-unified-api-adapter · proof-runner · boj-cartridge - `advisory`: the nine advisory gates; this check cannot fail, by design Every gate step has `if: !cancelled() && steps.checkout.outcome == 'success'`, so a failing gate does not stop the later gates in its job. The workflow has `permissions: contents: read`, and checkout plus all 24 gates are pinned by full SHA (`1aa6bfb`, unchanged). - **The stubs are no longer run.** Their directories under `actions/` are kept rather than moved to `draft/`. Unmigrated copies of the old workflow still reference them by path, and `tests/lock-transitive-closure.sh` requires the pinned SHA to serve HEAD's whole `actions/` tree. So this PR does not touch `actions/**`. - **`templates/estate-audit-caller.yml`** is the ten-line caller each repository holds. It pins a full SHA, because `sha_pinning_required` rejects `@main` and tags. - **`templates/track-estate-audit.yml`** is a weekly bot with no `uses:`. It opens a PR that moves the caller's pin to cicd-suite HEAD, and that PR's own audit run is the check. If its branch holds a commit the bot did not make, it leaves the branch alone instead of force-pushing over it. It needs an `AUTOMATION_TOKEN` secret, because `GITHUB_TOKEN` may not write under `.github/workflows/`. - **`scripts/deonboard-estate-audit.sh`** removes the caller from a repository's `actions.lock` and prunes the dependencies only it reached. An onboarded cross-repo reusable-workflow call startup-fails with zero jobs. The script needs mikefarah `yq` v4 and is idempotent. On marches' lock it removed exactly the audit entry plus `cicd-suite@main`, `deed-ecosystem@f9d999b` and `k9-ecosystem@2155aa2`, all as pure removals with the 4-space layout kept. - **`rollout_estate.sh`** installs the caller, the bot and the de-onboarding in each repository, instead of copying the workflow. It refuses to write anything unless the pinned commit's audit declares `workflow_call`. It writes files and does not commit them. - **README and ARCHITECTURE** describe the new consumption model. Defect 5 is closed by removal from the workflow. ## Verification - `tests/lock-transitive-closure.sh`: PASS=8 FAIL=0. - `tests/composite-shell-contract.sh`: PASS=28 FAIL=0. - actionlint 1.7.7 is clean on `main-estate-audit.yml` and both templates. The errors it reports in `code-hygiene-self-test.yml` are already on main; that file is unchanged here. shellcheck is clean on `rollout_estate.sh` and `scripts/*.sh`. - 24 gate steps: the old 26 minus the two stubs. - Rollout guard: - Negative control: with `origin/main` at `0405f13`, the commit before #7, it exits 1 and writes nothing. - Positive control: with `origin/main` at this branch, it installs both files, and they pass actionlint. - **End to end:** hyperpolymath/marches#44 calls this workflow at this branch's head. All five `estate / *` checks are green there. After this merges, I'll re-pin it to the merge commit. ## Not in this PR - Moving `prat`/`semantic-audit` to `draft/`. That waits until the estate runs the caller. - Defect 6 (bare `git grep` in six gates). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01VTeVWDEJgdYKsUNr4uhnXX --------- Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Oct 14, 2026
Not a rung (CI). Follow-up to #44. hyperpolymath/cicd-suite#50 merged as `376898b`. This moves the caller's pin from `afa28ff`, #50's head, to that merge commit. The trailing comment goes back to `# cicd-suite main`. **Behaviour is unchanged.** `git diff --stat afa28ff 376898b` in cicd-suite is empty, so the reusable audit marches calls is byte-identical. Only the commit the pin names has changed: it now names a commit on cicd-suite's `main`, which is what `track-estate-audit.yml` compares against when it advances the pin each week. ## Changes - `.github/workflows/main-estate-audit.yml`: one line, the SHA plus its comment. - `STATE.adoc`: a dated entry. ## Checks - actionlint 1.7.7 is clean on the caller. - `lake build` → `Build completed successfully (15 jobs).` No Lean file changed. - This PR's own pull_request run of `estate / *` is the end-to-end check at the new pin. `CI` and `CodeQL` still end in `startup_failure`, as they do on `main`, because of the `actions.lock` drift. The relock that fixes it needs the `AUTOMATION_TOKEN` secret: the first Actions lock run on `main` computed the relock but could not push it with `GITHUB_TOKEN`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01VTeVWDEJgdYKsUNr4uhnXX --- _Generated by [Claude Code](https://claude.ai/code/session_01VTeVWDEJgdYKsUNr4uhnXX)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Not a rung (CI). This is the marches half of hyperpolymath/cicd-suite#50.
Why
estate-auditfailed after 8sactions.lockatcicd-suite@5a10b72. That commit predates cicd-suite chore(deps): bump github/codeql-action from 4.38.0 to 4.38.1 in the actions group #32, which fixed the Required Files Gate.pratandsemantic-auditwere stubs that could not fail.What changes
.github/workflows/main-estate-audit.ymlis now a ten-line caller of cicd-suite's reusable audit, pinned at a full SHA. It reports five checks (estate / governance,hygiene,manifests,languages,advisory), and each runs every gate even after one fails. The stubs are gone..github/workflows/actions.lock: the caller is de-onboarded by cicd-suite'sscripts/deonboard-estate-audit.sh. This removes its entry and the three dependencies only it reached (cicd-suite@main,deed-ecosystem@f9d999b,k9-ecosystem@2155aa2), and adds nothing. Onboarded, a cross-repo reusable call startup-fails with zero jobs undersha_pinning_required. The relock workflow in ci(actions): relock actions.lock remotely with gh-actions-lock #41 scopes itself to tracked workflows plus those with nouses:, so it leaves the caller out..github/workflows/track-estate-audit.yml(new, nouses:): each week it opens a PR that moves the pin to cicd-suite HEAD, and that PR's own audit run is the check. If someone has pushed a commit to its branch, it leaves the branch alone rather than force-pushing over it. It needsAUTOMATION_TOKEN, the same secret ci(actions): relock actions.lock remotely with gh-actions-lock #41 and ci: weekly track-latest for the Lean toolchain and sibling pins #42 use, with Pull requests and Workflows set to write.Merge order
The pin is
afa28ff, the head of cicd-suite#50, so this PR's pull_request run exercises the cross-repo call for real. Merge cicd-suite#50 first. I will then re-pin this PR to #50's merge commit before it leaves draft.cicd-suite's current
main(4f54042) is also callable, since it has hadworkflow_callsince cicd-suite #7. However, it is the old single-job, 26-step audit. Until #50 merges, the weekly bot would propose moving back to it.Verification
estate / *checks are green against cicd-suite #50.lake build→Build completed successfully (15 jobs).grep -rnw sorryis empty.#eval orbitprints[(false, false), (true, true), (false, false), (true, true)].1aa6bfbwere run as composite steps (bash -e -o pipefail) against this branch, and all 24 exit 0. Negative control: with the gates at5a10b72, required-files fails, which reproduces the original failure.Expected red, not caused by this PR
CIandCodeQLend instartup_failureon main too. Dependabot (#34) bumpedlean-actionandcodeql-actionwithout relocking, so the lock drifted. The fix is #41's relock workflow, which takes effect after #41 merges.🤖 Generated with Claude Code
https://claude.ai/code/session_01VTeVWDEJgdYKsUNr4uhnXX