Skip to content

CI: required checks can never report — ABI Contract / Cross-Platform startup_failure (setup-zig not allow-listed); K9 + Sonar red on main #103

Closed
#108
Closed
CI: required checks can never report — ABI Contract / Cross-Platform startup_failure (setup-zig not allow-listed); K9 + Sonar red on main#103
#108
Labels
bindingsABI, FFI, WASM, and cross-language interop surfaceschoreRoutine maintenance with no behaviour changecicdCI/CD: workflows, actions, lockfiles, pins, runners, release gates

Description

@hyperpolymath
hyperpolymath
opened on Sep 30, 2026

Problem

main (070529e) cannot produce the checks its own ruleset requires. No PR can therefore satisfy the required-status-checks rule, and auto-merge can never fire.

  1. Required-check producers never start. The ruleset requires Linux, Idris2 model type-checks, Zig ↔ Idris tables in sync and AffineScript ↔ Zig FFI symbols in sync. They come from the Cross-Platform Build & Test and ABI Contract workflows. Both end in startup_failure on main 070529e and on PR fix(launcher): regenerate game-server-admin launcher with the XDG pid/log ladder #102, so they create no check runs at all. Governance, GitHub Pages and Mirror to Git Forges also end in startup_failure on main. The run pages for ABI Contract (run 35609965294) and Cross-Platform (run 35609970129) give the cause: 
    The action mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 is not allowed in hyperpolymath/game-server-admin because all actions must be from a repository owned by hyperpolymath, created by GitHub, or verified in the GitHub Marketplace.
    The cure is to allow-list mlugg/setup-zig (at the pinned SHA) in the repo or org Actions policy, or to replace it with an allowed Zig setup. Weakening the policy estate-wide is not the cure.
  2. Dogfood Gate / Validate K9 contracts fails on main and on PRs: 
    Validating: ./container/deploy.k9.ncl
##[error]Pedigree block missing 'name' field (in pedigree.metadata.name or pedigree.name)
##[error]K9 validation failed with 1 error(s)
  3. SonarCloud Code Analysis and Hypatia Security Scan fail on main 070529e.

Acceptance criteria

  • Cross-Platform Build & Test and ABI Contract start on a PR and on main, with no startup_failure. Each of the four required contexts appears on the PR head as a real check run. The fixing PR names the startup error text from the run page.
  • Governance, GitHub Pages and Mirror to Git Forges no longer end in startup_failure on main.
  • container/deploy.k9.ncl carries a pedigree name (and version/schema_version), and Validate K9 contracts is green on main.
  • SonarCloud Code Analysis is green on main, or is removed with a stated reason.
  • The required-context set in the ruleset is SET-EQUAL to the contexts an actual PR head produces.

Found while landing #102. #102 inherits these reds and does not cause them. Its auto-merge (squash) is armed and will stay parked until item 1 is fixed.

Activity

  1. github-actions
    added
    bindingsABI, FFI, WASM, and cross-language interop surfaces
    choreRoutine maintenance with no behaviour change
    cicdCI/CD: workflows, actions, lockfiles, pins, runners, release gates
    on Sep 30, 2026
  2. hyperpolymath
    added a commit that references this issue on Sep 30, 2026

    fix(ci): install Zig from a pinned, verified tarball — replaces non-a…

    ec5db2f

  3. hyperpolymath commented on Sep 30, 2026

    @hyperpolymath
    hyperpolymath
    on Sep 30, 2026
    OwnerAuthor

    Item 1 (required-check producers): fixed by #104, merged 2026-09-30T15:19Z as ec5db2f. The owner ruled to swap the action, not to change the allow-list.

    • mlugg/setup-zig is replaced by scripts/install-zig.sh. It fetches the official ziglang.org Zig 0.15.2 x86_64-linux tarball and checks it against a pinned sha256. At pin time the tarball's minisign signature was verified against the ZSF key. No third-party action is used. The Actions allow-list is unchanged.
    • In actions.lock, the three mlugg/setup-zig@v2.2.1 entries were removed by hand. gh actions-lock --no-fix reports valid.
    • PR head fbd8151 ran ABI Contract (run 36735322502) and Cross-Platform Build & Test (run 36735322301). Both concluded success, with no startup_failure and every step executed. All four required contexts ran as real check runs, and all four passed: Linux 109955370259, Zig ↔ Idris tables in sync 109955371714, Idris2 model type-checks 109955372159, AffineScript ↔ Zig FFI symbols in sync 109955371947.
    • Rule-suite 4298237478 for the merge push shows every rule pass, with no bypass: required_status_checks, required_signatures, non_fast_forward and deletion.

    Still open here and not touched by #104:

  4. hyperpolymath commented on Sep 30, 2026

    @hyperpolymath
    hyperpolymath
    on Sep 30, 2026
    OwnerAuthor

    Confirmed on main at ec5db2f (push event): ABI Contract run 36735829015 and Cross-Platform Build & Test run 36735829299 both concluded success. Governance (36735833054), Mirror to Git Forges (36735834472) and GitHub Pages (36735836472) still end in startup_failure, and Dogfood Gate (36735828996) is still red on K9. Those items stay open.

  5. hyperpolymath
    added a commit that references this issue on Sep 30, 2026

    fix(launcher): regenerate game-server-admin launcher with the XDG pid…

    6152bda
  6. hyperpolymath
    closed this as completedin #108on Oct 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bindingsABI, FFI, WASM, and cross-language interop surfaceschoreRoutine maintenance with no behaviour changecicdCI/CD: workflows, actions, lockfiles, pins, runners, release gates

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions