ci: vendor validation scripts and remove remote action pins - #84
Merged
Conversation
Code Review ✅ ApprovedVendors validation scripts into
OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
hyperpolymath
added a commit
to hyperpolymath/standards
that referenced
this pull request
Jul 28, 2026
) ## The gap The governance linter's `Check SHA-pinned actions` step verifies a pin's **shape** (`@` + 40 hex). It cannot verify the SHA **exists** — a fabricated 40-hex string passes it. That is not theoretical. Measured across the estate on 2026-07-28: | | | |---|---| | Unique `(action, SHA)` pins | **613** | | **Unresolvable** | **112 (18%)** | | — real repo, invented SHA | 80 | | — action repo itself is gone | 32 (7 actions) | | Committed workflow files affected | **876** | | Repo roots affected | **~310** | **Why it stayed invisible:** Actions resolves a `uses:` ref only at *run* time, and an unresolvable ref produces **no check run at all** — not a red one. `gh pr checks` shows nothing, the board reads green, and the job never ran. A repo can be "fully green" with its security scanning entirely absent. Full report: `dev-notes/estate-unresolvable-action-pins-2026-07-28.md`. ## The change - New `scripts/check-action-pins-resolve.sh` — dedupes `(repo, sha)` pairs from the caller's workflows and asks the GitHub API whether each resolves. - Wired into the `workflow-lint` job, using the established idiom from the allowlist preflight above it (sparse-checkout standards → copy script to `$RUNNER_TEMP` → `rm -rf` the checkout *before* scanning, so the standards tree is never part of the caller's workspace). ### Failure semantics (deliberate) **HARD FAIL** only on a *determinate negative* — GitHub answered and the answer was "does not exist". The script distinguishes `SHA-NOT-FOUND` (repin it) from `REPO-NOT-FOUND` (the action is gone — vendor it, per hyperpolymath/tangle#84). **Does NOT fail** on indeterminate answers (rate limit, 5xx, network). Those say nothing about a pin, and failing on them would turn any GitHub incident into an estate-wide red treadmill — the exact trap `check-workflow-staleness.sh` documents. They are instead counted and reported **loudly** as `UNVERIFIED`. A fail-open that announces itself is not a fake gate; a fail-open that hides is. Rate limiting is not expected to bite: `GITHUB_TOKEN` allows 1,000 req/hr/repo and only *unique* pairs are queried (largest estate repo is well under 100). ## Verification Tested against three real repos: | Repo | Result | |---|---| | `tangle` | 9/9 resolve → **exit 0** ✅ | | `0patch-lsa-sentinel` | catches phantom `github/codeql-action@29b1f65c` → **exit 1** ✅ | | `aerie` | catches both dead `a2ml-validate-action` + `k9-validate-action` → **exit 1** ✅ | `standards`' own 21 pins all resolve, so this repo passes its own new gate. YAML re-parsed (11 jobs preserved, step order correct); script passes `bash -n` and `shellcheck -S warning` clean. ## Propagation caveat Consumers pin `governance-reusable.yml` by SHA, so this step only starts running for a consumer once it re-pins to a standards SHA at or after this merge (`scripts/propagate-workflow-pins.sh` / the staleness gate drive that). The *script* is always fetched from `main`, so its logic stays current without a re-pin — but the step itself needs the newer workflow. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated PR to fix CI after deleted actions.
Summary by Gitar
validate-a2ml.shandvalidate-k9.shunder.githooks/dogfood-gate.ymlworkflow to execute local validation scripts instead of using remote GitHub actionsThis will update automatically on new commits.