This is a class of problem breaking our CI pipelines (specifically \governance / Validate Hypatia Baseline, \scan / gitleaks, and \scan / rust-secrets).
Symptom:
These checks execute \git submodule foreach\ which strictly fails with \ atal: No url found for submodule path .claude/worktrees/actions-policy in .gitmodules\ and exit code 128.
Root Cause:
Agentic tools (like Claude) use a local .claude/worktrees/\ directory. If a bot or developer blindly runs \git add ., these nested git repositories are added as orphan gitlinks (mode 160000) without a corresponding .gitmodules\ entry. This corrupts the git tree for any tool trying to traverse submodules.
Systematic Address Required:
- Clean up existing .claude/ gitlinks from main.
- Ensure .claude/\ is in the global estate .gitignore.
- Add a Hypatia or \cicd squabbler\ rule to explicitly reject PRs that introduce \160000\ mode files inside .claude/\ or without a .gitmodules\ entry to prevent regressions.
The solution is partially underway (gitlink removal), but the systemic Hypatia rule needs to be implemented to permanently prevent this class of problem.
This is a class of problem breaking our CI pipelines (specifically \governance / Validate Hypatia Baseline, \scan / gitleaks, and \scan / rust-secrets).
Symptom:
These checks execute \git submodule foreach\ which strictly fails with \ atal: No url found for submodule path .claude/worktrees/actions-policy in .gitmodules\ and exit code 128.
Root Cause:
Agentic tools (like Claude) use a local .claude/worktrees/\ directory. If a bot or developer blindly runs \git add ., these nested git repositories are added as orphan gitlinks (mode 160000) without a corresponding .gitmodules\ entry. This corrupts the git tree for any tool trying to traverse submodules.
Systematic Address Required:
The solution is partially underway (gitlink removal), but the systemic Hypatia rule needs to be implemented to permanently prevent this class of problem.