ci: consolidate Haec gates, repair K9 envelopes and FFI validation - #27
Merged
Conversation
hyperpolymath
marked this pull request as ready for review
July 27, 2026 13:05
Resolves ten conflicts. This branch predates #19-#25, so several of its deletions had gone stale and would have silently removed working CI. Restored from origin/main (branch's deletion was stale — each backs a currently-green check, three of them hard gates): npm-bun-blocker.yml 🔴 Gate: No-npm/bun policy quality.yml 🔴 Gate: Code quality (fmt/lint/test) security-policy.yml 🔴 Gate: Security policy present hypatia-scan.yml 🟡 Check: Hypatia baseline security scan rust-ci.yml 🟡 Check: Rust CI (build/test) pages.yml GitHub Pages (Ddraig SSG) — added by #19, newer mirror.yml ⚙ Auto: Mirror to forges dependabot-automerge.yml Deletion kept: push-email-notify.yml — matches the estate ruling that push-email is removed except for three named dual-use repos. Content conflicts — kept this branch's structure (the point of the PR), then adopted origin/main's newer action pins so #24/#25 are not regressed: governance.yml, trope-check.yml pin-only conflicts -> took origin/main release.yml, dogfood-gate.yml structural -> kept branch, re-pinned Verified: every workflow parses as YAML and declares at least one live job, so no new startup_failure is introduced. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
hyperpolymath
added a commit
that referenced
this pull request
Jul 27, 2026
…I job (#28) Follow-up to #27, which merged before these two fixes were pushed. Without them `main` is red on `🔴 Gate: Static analysis` and `CI / required`. ## 1. `.envrc` — Hypatia critical `secret_detected` #27 turned the Hypatia step in `static-analysis-gate.yml` from a **fake gate** into a real one. Before #27 it passed without ever scanning, via three separate routes: - `continue-on-error: true` on the scanner build, - `if: steps.build.outputs.ready == 'true'` skipping the scan when that build failed, - `echo "[]" > hypatia-findings.json` overwriting unparseable output with an empty array. #27 pins the scanner to a commit, verifies the SHA, builds it properly, and fails on critical findings. It went red because it **started working** — this is not a regression. The first thing it caught: ``` .envrc:24 # export API_KEY="..." ``` A commented-out placeholder, so a false positive — but the fix is to stop writing assignment-shaped comments rather than to suppress the finding. The guidance is kept in prose, pointing at the gitignored `.env`. The scan also reports **7 `high`** findings (`instant-sync.yml`, `build/setup.sh`, `src/interface/ffi/src/main.zig` ×2, and duplicates). Those do not gate and are left for separate triage rather than being swept in here. ## 2. `ci.yml` — Zig setup failed inside the Idris2 container The pinned `idris2-pack` image ships no `xz` binary, so `setup-zig`'s `.tar.xz` download died: ``` tar (child): xz: Cannot exec: No such file or directory Error: The process '/usr/bin/tar' failed with exit code 2 ``` Installs `xz-utils` first, guarded by a `command -v` check so it is a no-op on images that already have it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
Previously-unpushed work that existed only in a local worktree whose
.gitpointer was broken (it referenced a stale duplicate clone at
hyper-repos/haecthat has since been deleted). Repaired withgit worktree repairand pushed here so it is no longer a single local copy.36 files, ~610 insertions / ~1265 deletions, in two commits:
5c25f99— consolidatesdogfood-gate.yml(453 lines → net −310) andrepairs the K9 contract envelopes (
coordination.k9,session/custom-checks.k9,methodology-guard.k9.ncl, sixtemplate-*/example.k9.nclfiles).e5c86e8— consolidates gate workflows intoci.yml; removesdependabot-automerge.yml,quality.yml,pages.yml,security-policy.yml,npm-bun-blocker.yml,hypatia-scan.yml,push-email-notify.yml; trimsdependabot.yml; and reworks the Zig/Idris FFI validation(
src/interface/Abi/Foreign.idr,ffi/build.zig,ffi/src/main.zig,ffi/test/integration_test.zig), plusJustfileand test-script updates.Conflicts with #22–#24 on six files, because those PRs added SPDX headers to
workflows this branch deletes:
The modify/delete cases resolve trivially (keep the delete); the three content
conflicts need review.
Relationship to #26
The three
startup_failuredeletions have been split out into #26, whichmerges cleanly and fixes the red CI on its own. Rebase this branch on top of #26
once that lands; the deletions will then already be in the base.
Left as draft pending conflict resolution and review of the FFI rewrite.
🤖 Generated with Claude Code