fix(ci): unblock the now-honest static-analysis gate and the Idris2 CI job - #28
Merged
Conversation
…I job
Two failures surfaced once this branch's changes ran for real.
1. .envrc — Hypatia critical "secret_detected"
This branch converts the Hypatia step in static-analysis-gate.yml from a
fake gate into a real one: on main the scanner build carries
`continue-on-error: true`, the scan is skipped unless `ready == 'true'`,
and unparseable output is overwritten with `[]` — so the gate passes
without ever scanning. Pinning the scanner and failing on critical
findings makes it genuine, and the first thing it caught was:
.envrc:24 # export API_KEY="..."
A commented-out placeholder, so a false positive — but the fix is to stop
writing assignment-shaped comments rather than to suppress the finding.
The guidance is preserved in prose, pointing at the gitignored .env.
The seven `high` findings do not gate and are left for separate triage.
2. ci.yml — Zig setup failed in the Idris2 container
The pinned idris2-pack image ships no xz binary, so setup-zig's .tar.xz
download died with "tar (child): xz: Cannot exec: No such file or
directory". Installs xz-utils first, guarded by a command -v check.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
hyperpolymath
added a commit
that referenced
this pull request
Jul 27, 2026
`CI / required` failed on #28 at **`Typecheck the Idris2 ABI`** with *no output at all*: ```bash idris2 --version | grep -Fx 'Idris 2, version 0.7.0' ``` The pipeline swallowed the version, `grep -Fx` matched nothing, and `set -o pipefail` ended the step before anything reached the log — so the failure was undiagnosable from CI alone. ## Fix Capture the version, echo it, *then* assert: - **Idris2** now matches on the release (`*"0.7.0"*`) rather than the entire string. The digest-pinned `idris2-pack` image reports a build suffix, so exact-string equality could never have matched. The version pin is still enforced. - **Zig** keeps exact equality (`0.15.2`) but now reports what it actually found. Both print their version on success too, so the log records which toolchain ran. Follow-on from #28, which fixed the earlier failure in the same job (the image ships no `xz`, so `setup-zig` could not unpack its `.tar.xz`). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Jul 27, 2026
…ns (#32) `CI / required` is the last red check on `main`. After #31 fixed the version assert, the job got two steps further and now fails at **Validate repository contracts** with exit code 2 and one line of output: ``` jq is required ``` ## Root cause `tests/check-examples.sh:15`: ```bash command -v jq >/dev/null || { echo "jq is required"; exit 2; } ``` The pinned `idris2-pack` image does not ship `jq`. So the **Trope IR conformance test — the one asserting every example lowers to valid Trope IR — has never actually executed in CI.** It bailed before testing anything. That makes this more than a build fix: it turns a step that always died early into one that genuinely exercises the language's core guarantee. ## Fix Same class of problem as the missing `xz` in #28, so the step now handles both: collect what is absent, install in a single `apt-get` pass, print both versions so the log records what ran. A no-op on images that already have them. ## Verified locally against `origin/main` (d29f89e) ``` bash -n over tests/ scripts/ ............... all parse tests/check-examples.sh .................... exit 0 → "examples: all lower to valid Trope IR" tests/aspect_tests.sh ...................... exit 0 → PASS=3 FAIL=0 WARN=0 scripts/check-root-shape.sh ................ exit 0 → 45 entries, 46 permitted tests/workflows/validate_workflows_test.sh . exit 0 → Workflow validation PASSED ``` Note `check-examples.sh` skips the verdict round-trip when no sibling `tropecheck` binary is built — that part still needs `trope-checker`, and is reported as a `note`, not a pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #27, which merged before these two fixes were pushed. Without them
mainis red on🔴 Gate: Static analysisandCI / required.1.
.envrc— Hypatia criticalsecret_detected#27 turned the Hypatia step in
static-analysis-gate.ymlfrom a fake gateinto a real one. Before #27 it passed without ever scanning, via three separate
routes:
continue-on-error: trueon the scanner build,if: steps.build.outputs.ready == 'true'skipping the scan when that build failed,echo "[]" > hypatia-findings.jsonoverwriting unparseable output with an empty array.#27 pins the scanner to a commit, verifies the SHA, builds it properly, and fails
on critical findings. It went red because it started working — this is not a
regression.
The first thing it caught:
A commented-out placeholder, so a false positive — but the fix is to stop writing
assignment-shaped comments rather than to suppress the finding. The guidance is
kept in prose, pointing at the gitignored
.env.The scan also reports 7
highfindings (instant-sync.yml,build/setup.sh,src/interface/ffi/src/main.zig×2, and duplicates). Those do not gate and areleft for separate triage rather than being swept in here.
2.
ci.yml— Zig setup failed inside the Idris2 containerThe pinned
idris2-packimage ships noxzbinary, sosetup-zig's.tar.xzdownload died:
Installs
xz-utilsfirst, guarded by acommand -vcheck so it is a no-op onimages that already have it.
🤖 Generated with Claude Code