Skip to content

chore: bump standards workflow pins to current main (0ef5917) - #64

Merged
hyperpolymath merged 4 commits into
mainfrom
chore/bump-standards-pins
Sep 1, 2026
Merged

chore: bump standards workflow pins to current main (0ef5917)#64
hyperpolymath merged 4 commits into
mainfrom
chore/bump-standards-pins

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Unifies the four standards reusable-workflow pins (governance.yml, hypatia-scan.yml, mirror.yml, secret-scanner.yml) from three divergent stale SHAs onto current standards main 0ef5917 (2026-08-31, post ReScript BANNED-row sync hyperpolymath/standards#710).

Verified all four reusable workflows exist at that SHA before pinning. Rebased onto main so the branch carries only this commit; an earlier stale pin target (571cc73, Aug 30) was superseded before this PR opened, so the pins were re-aimed at the current SHA rather than opening a knowingly-stale bump.

🤖 Generated with Claude Code

Unifies the four standards reusable-workflow pins (governance,
hypatia-scan, mirror, secret-scanner) from three divergent stale SHAs
onto the current standards main, 0ef5917 (2026-08-31, post ReScript
BANNED-row sync #710). All four reusable workflows verified present at
that SHA.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Sep 1, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 01cb89d3-71b4-4987-9e1d-5e7f717d7ca9

📥 Commits

Reviewing files that changed from the base of the PR and between 9cc04cf and 73f575f.

📒 Files selected for processing (5)
  • .github/workflows/governance.yml
  • .github/workflows/hypatia-scan.yml
  • .github/workflows/mirror.yml
  • .github/workflows/secret-scanner.yml
  • .github/workflows/workflow-linter.yml
💤 Files with no reviewable changes (1)
  • .github/workflows/workflow-linter.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (1)
  • GitHub Check: test-all
🧰 Additional context used
🪛 zizmor (1.29.0)
.github/workflows/mirror.yml

[warning] 12-12: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow

(secrets-inherit)

.github/workflows/secret-scanner.yml

[warning] 22-22: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow

(secrets-inherit)

🔇 Additional comments (4)
.github/workflows/governance.yml (1)

17-17: LGTM!

.github/workflows/hypatia-scan.yml (1)

20-20: LGTM!

.github/workflows/mirror.yml (1)

12-12: LGTM!

.github/workflows/secret-scanner.yml (1)

22-22: LGTM!


📝 Walkthrough

Summary by CodeRabbit

  • Chores
    • Updated automated governance, security scanning, mirroring and secret-scanning workflows.
    • Simplified workflow permission settings while retaining read-only access.
    • Improved maintenance and consistency of automated repository checks.

Walkthrough

The pull request updates four reusable workflow references to commit 0ef5917b3a6742dc69b6758b3e40a7beb8b97d04. It also removes the explicit actions: read permission from the workflow linter.

Changes

Workflow maintenance

Layer / File(s) Summary
Update reusable workflow pins
.github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/mirror.yml, .github/workflows/secret-scanner.yml
Four reusable workflow references now use the shared pinned commit.
Simplify linter permissions
.github/workflows/workflow-linter.yml
The workflow linter now relies on the top-level permissions: read-all setting.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 73f57

This PR updates four reusable workflow pins to the current standards revision and removes one workflow entry; no actionable merge-blocking risk remains beyond normal checks and review.

Poem

A rabbit checks each workflow line
Four pins now point to one design
The linter reads with less to state
Clean YAML hops through every gate
Ears up, the checks all run on time

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description check ✅ Passed The description directly explains the workflow pin updates and the related verification. It is relevant to the changeset.
Title check ✅ Passed The title clearly summarises the main change: updating standards workflow pins to commit 0ef5917.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

hyperpolymath and others added 2 commits September 1, 2026 15:27
…ow-linter

permissions: read-all is a scalar; nesting actions: read under it is a
YAML parse error, so this workflow has never loaded (an unloaded
workflow produces no check run). read-all already grants actions: read.
Caught by the parse gate in the standards suite this PR pins to.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
hyperpolymath added a commit that referenced this pull request Sep 1, 2026
…igned (#67)

## What

`Aggregate_Profile` computed means only. `Std_Dev_ISA`, `Median_ISA`,
`Category_Std_Devs`, `Category_Medians` and `Evaluated_At` were returned
**uninitialized**, and `vexometer-reports.adb` prints those fields into
CSV/HTML/LaTeX/text reports — so every generated report carried
undefined memory as real statistics.

## Why now

The E2E assertion `Std_Dev_ISA >= 0.0` failed nondeterministically on PR
#63 — the first CI test runs in this repo's history, enabled by the #66
gate repair. Identical sources passed on #64/#65/#66 and failed on #63:
classic uninitialized-read behaviour (GNAT warned `"Profile" may be
referenced before it has a value` at `vexometer-core.adb:100` all along;
that warning is now gone).

## How

- Standard deviations use the **two-pass form** — summed squared
deviations cannot go negative, unlike `E[x²] − E[x]²`.
- Medians sort a copy (`Ada.Containers.Generic_Array_Sort`), correct for
odd and even N.
- Numeric components of `Model_Profile` now default to zero, so the `N =
0` path returns defined values.
- `Evaluated_At` is stamped with `Ada.Calendar.Clock`.

## Verification

`just test` in `vexometer/`: **1282/1282 assertions pass**, three
consecutive runs, exit 0 each (previously flaky). No manifest-tracked
files touched.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
@hyperpolymath
hyperpolymath merged commit b3da4d0 into main Sep 1, 2026
26 checks passed
@hyperpolymath
hyperpolymath deleted the chore/bump-standards-pins branch September 1, 2026 14:55
hyperpolymath added a commit that referenced this pull request Sep 1, 2026
## Summary

Closes out the 2026-09-01 decode-and-repair pass with the situation
report and the last mechanical documentation fixes. Everything narrative
lives in the sitrep itself: **docs/sitrep-2026-09-01.adoc**.

- **Sitrep** — repo/branch state and the lossless rebase resolution, the
quality-gate outage (#66) and the two defects the repaired gates caught
immediately (#67 uninitialized profile statistics, #64 unparseable
workflow-linter), the verified Anthropic-paper provenance and the
ISA/safety-alignment boundary, a documentation honesty audit, and a debt
register (D1–D7) with done-conditions.
- **STATE.a2ml** — `last-updated` refreshed; the 25%-vs-70% divergence
and the assertion-execution counting convention annotated (true refresh
= D3).
- **SATELLITES.adoc** — dead `.scm` links repointed to
`.machine_readable/6a2/*.a2ml`; retired-format NOTE on the ECOSYSTEM.scm
template section.
- **vexometer-satellites/README.adoc** — false claim to hold the
protocol specs removed; dead `docs/*-format.adoc` links repointed to the
real specs; trust manifest regenerated in the same commit per the
manifest contract.
- **TEST-NEEDS.adoc** — the 1282 figure annotated as assertion
executions (420 loop-amplified), ~55 static sites.

## Verification

- `bash scripts/run-must-gates.sh` → exit 0, "all must gates passed"
(with the regenerated vexometer-satellites manifest).
- All links added here resolve on this branch; no `link:*.scm` remains
in SATELLITES.adoc.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant