chore: R-16 toolchain pin + reconciliation #93
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,34 +1,4 @@ | ||
| # SPDX-License-Identifier: MPL-2.0 | ||
| # Solo-maintained hyperpolymath repo: no owner lines by policy. | ||
| # See hyperpolymath/standards CODEOWNERS-POLICY.adoc (Rule 1). | ||
| # Sole-maintainer review is moot; SPDX headers carry attribution. |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| name: Central Estate CI/CD Audit | ||
|
|
||
| on: | ||
| push: | ||
| branches: [ "main" ] | ||
| pull_request: | ||
| branches: [ "main" ] | ||
|
Comment on lines
+5
to
+7
There was a problem hiding this comment. 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win Correct the YAMLlint flow-sequence errors. Lines 5 and 7 contain spaces inside the flow-sequence brackets. Change both values to 🧰 Tools🪛 YAMLlint (1.37.1)[error] 5-5: too many spaces inside brackets (brackets) [error] 5-5: too many spaces inside brackets (brackets) [error] 7-7: too many spaces inside brackets (brackets) [error] 7-7: too many spaces inside brackets (brackets) 🪛 zizmor (1.29.0)[warning] 1-92: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) [warning] 3-7: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting (concurrency-limits) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
|
|
||
| jobs: | ||
| estate-audit: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🔎 Supported by static analysis🏁 Script executed: sed -n '1,110p' .github/workflows/main-estate-audit.yml
printf '\n--- action references ---\n'
rg -n '^\s*-\s*uses:' .github/workflows/main-estate-audit.yml
printf '\n--- repository pinning guidance ---\n'
rg -n -i 'pin.*sha|full.*sha|action.*pin|persist-credentials' .github .github/workflows README.md CONTRIBUTING.md SECURITY.md 2>/dev/null | head -80Repository: hyperpolymath/git-reticulator Length of output: 4624 🌐 Web query:
💡 Result: The default value for the persist-credentials input in actions/checkout v4 is true [1][2]. This setting configures the authentication token or SSH key with the local git configuration, which allows subsequent steps in your job to execute authenticated git commands [1][3]. This credential is automatically removed during the post-job cleanup process [1]. If you wish to disable this behavior, you can explicitly set persist-credentials to false in your workflow configuration [1][3]. Citations:
Pin every action to a full commit SHA.
🧰 Tools🪛 GitHub Check: CodeQL[warning] 11-91: Workflow does not contain permissions 🪛 zizmor (1.29.0)[warning] 13-13: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 1-92: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) [warning] 10-92: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) [error] 13-13: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
|
|
||
| - name: Required Files Gate | ||
| uses: hyperpolymath/cicd-suite/actions/required-files-check@main | ||
|
Check warning on line 16 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Code Hygiene Gate | ||
| uses: hyperpolymath/cicd-suite/actions/code-hygiene-check@main | ||
|
Check warning on line 19 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Manifest Validation Gate | ||
| uses: hyperpolymath/cicd-suite/actions/manifest-check@main | ||
|
Check warning on line 22 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Idris2 ABI Purity Gate | ||
| uses: hyperpolymath/cicd-suite/actions/idris2-abi-check@main | ||
|
Check warning on line 25 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Zig Hexadeca API Gate | ||
| uses: hyperpolymath/cicd-suite/actions/zig-hexadeca-check@main | ||
|
Check warning on line 28 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Contractile Validation Gate | ||
| uses: hyperpolymath/cicd-suite/actions/contractile-validation-check@main | ||
|
Check warning on line 31 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Recipes Set Validation Gate | ||
| uses: hyperpolymath/cicd-suite/actions/recipes-set-check@main | ||
|
Check warning on line 34 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Affirmation Document Gate | ||
| uses: hyperpolymath/cicd-suite/actions/affirmation-check@main | ||
|
Check warning on line 37 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Academic Referencing Gate | ||
| uses: hyperpolymath/cicd-suite/actions/referencing-check@main | ||
|
Check warning on line 40 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Semantic Audit Gate | ||
| uses: hyperpolymath/cicd-suite/actions/semantic-audit-check@main | ||
|
Check warning on line 43 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: SPDX License Gate | ||
| uses: hyperpolymath/cicd-suite/actions/spdx-license-check@main | ||
|
Check warning on line 46 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Proof Runner Gate | ||
| uses: hyperpolymath/cicd-suite/actions/proof-runner-check@main | ||
|
Check warning on line 49 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: PRAT Testing Gate | ||
| uses: hyperpolymath/cicd-suite/actions/prat-check@main | ||
|
Check warning on line 52 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Panic Attack & Pons Gate | ||
| uses: hyperpolymath/cicd-suite/actions/custom-tools-check@main | ||
|
Check warning on line 55 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: WWW & Well-Known Compliance Gate | ||
| uses: hyperpolymath/cicd-suite/actions/www-compliance-check@main | ||
|
Check warning on line 58 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: BoJ Cartridge Validation Gate | ||
| uses: hyperpolymath/cicd-suite/actions/boj-cartridge-check@main | ||
|
Check warning on line 61 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Formatting Validation Gate | ||
| uses: hyperpolymath/cicd-suite/actions/formatting-check@main | ||
|
Check warning on line 64 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Accreditations & Badges Gate | ||
| uses: hyperpolymath/cicd-suite/actions/badges-check@main | ||
|
Check warning on line 67 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Metrics Extraction Gate | ||
| uses: hyperpolymath/cicd-suite/actions/metrics-check@main | ||
|
Check warning on line 70 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Linguist & Banned Languages Gate | ||
| uses: hyperpolymath/cicd-suite/actions/linguist-check@main | ||
|
Check warning on line 73 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Test & Benchmarks Dashboard Gate | ||
| uses: hyperpolymath/cicd-suite/actions/tests-benches-check@main | ||
|
Check warning on line 76 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Hosting & Site Status Gate | ||
| uses: hyperpolymath/cicd-suite/actions/hosting-check@main | ||
|
Check warning on line 79 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Git-Sea Analytics Gate | ||
| uses: hyperpolymath/cicd-suite/actions/gitsea-check@main | ||
|
Check warning on line 82 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Trust & Humans Validation Gate | ||
| uses: hyperpolymath/cicd-suite/actions/trust-humans-check@main | ||
|
Check warning on line 85 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Are We UnAPI Gate (Secret Scanning) | ||
| uses: hyperpolymath/cicd-suite/actions/secrets-check@main | ||
|
Check warning on line 88 in .github/workflows/main-estate-audit.yml
|
||
|
|
||
| - name: Reasonably Good Token Validation Gate | ||
| uses: hyperpolymath/cicd-suite/actions/vaulted-tokens-check@main | ||
|
Check warning on line 91 in .github/workflows/main-estate-audit.yml
|
||
|
Comment on lines
+11
to
+91
Comment on lines
+13
to
+91
There was a problem hiding this comment. 🔴 HIGH RISK This workflow introduces 26 third-party actions pinned to mutable branches (e.g., @main). To prevent supply-chain attacks and ensure the CI process remains deterministic and stable, update all 'uses:' entries to reference specific commit SHAs. Try running the following prompt in your coding agent:
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| [tools] | ||
| rust = "stable" | ||
|
Comment on lines
+1
to
+2
There was a problem hiding this comment. 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: printf '%s\n' '--- .mise.toml ---'
cat -n .mise.toml
printf '%s\n' '--- Justfile Rust references ---'
rg -n -C 3 'rust|mise|toolchain' Justfile
printf '%s\n' '--- CI and lockfile references ---'
rg -n -C 3 'mise|mise\.lock|rustup|rust-toolchain|cargo|toolchain' .github .mise.toml 2>/dev/null || true
printf '%s\n' '--- relevant tracked files ---'
git ls-files | rg '(^|/)(mise(\.lock)?|rust-toolchain(\.toml)?|Justfile|\.github/.*)$'Repository: hyperpolymath/git-reticulator Length of output: 4212 🏁 Script executed: printf '%s\n' '--- Justfile toolchain checks ---'
sed -n '45,110p' Justfile
printf '%s\n' '--- Rust CI workflow ---'
cat -n .github/workflows/rust-ci.yml
printf '%s\n' '--- Rust version declarations and lockfiles ---'
git ls-files | rg '(^|/)(Cargo\.toml|Cargo\.lock|mise\.lock|rust-toolchain(\.toml)?|rust-toolchain)$'
rg -n '1\.80|rust-version|toolchain|mise' Cargo.toml Cargo.lock 2>/dev/null || trueRepository: hyperpolymath/git-reticulator Length of output: 3746 🌐 Web query:
💡 Result: Mise provides robust support for managing Rust toolchains and enforcing reproducible environments via version aliases, rolling channels, and lockfile enforcement. Tool Version Aliases Mise allows you to define symbolic aliases for tool versions to make your configuration more readable or stable [1]. You can create custom aliases in your global configuration (~/.config/mise/config.toml) under the [tool_alias..versions] section [1][2]. For example, defining an alias like [tool_alias.node.versions] lts-iron = '20' allows you to reference node = "lts-iron" in your mise.toml [1]. Rolling Channels Some tools (like those using vfox backends) support rolling release channels, such as "stable," "nightly," or "beta" [3]. Mise tracks these by storing checksums [4][3]. When a version is marked as rolling (via rolling = true in plugin development), mise can detect if the channel's content has changed even if the version string remains the same [4][3]. You can use commands like mise upgrade to update these rolling versions [4][3]. For the rust backend specifically, mise integrates with rustup, which natively handles these channels [5][6][7]. Lockfile Enforcement (mise.lock) Mise ensures reproducible environments through the mise.lock file, which pins exact versions and checksums [8][9]. - Enabling Enforcement: You can enable lockfile creation by setting lockfile = true in your settings [8]. - Strict Mode: To strictly enforce that only tools present in the lockfile are installed, you can use the locked = true setting [8]. Alternatively, passing the --locked flag to mise install prevents any modifications to the lockfile and ensures the installation adheres strictly to the existing lockfile [8][10]. - Scope: Lockfile settings can be applied globally via settings or specifically to tool configurations using tool_config.locked [8]. For Rust specifically, mise manages versions by setting the RUSTUP_TOOLCHAIN environment variable and utilizing rustup for installation, components, and targets [5][6]. You can configure this in your mise.toml: [tools] rust = { version = "1.83.0", components = ["rust-src"], targets = ["wasm32-unknown-unknown"] } [5][6] Citations:
Use an exact Rust version.
🤖 Prompt for AI Agents |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -102,3 +102,20 @@ git-reticulator/ | |
| "I have read the manifest. State lives in `.machine_readable/6a2/` only. I will | ||
| mark SKELETON/ASPIRATIONAL honestly, will not claim 'lattice' algebra without | ||
| discharging PROOF-NEEDS.md P1/P2, and will not commit template placeholders." | ||
|
|
||
| <!-- BEGIN requires-initialisation --> | ||
|
|
||
| ## PRIORITY ACTION — this repository is not fully initialised | ||
|
|
||
| 1 substitution token(s) still have no value. **Read | ||
| `REQUIRES_INITIALISATION.md` in the repository root before doing anything | ||
| else here** — it lists every outstanding token, what it means, and which | ||
| files it belongs in. | ||
|
|
||
| Do not fabricate values for them, and do not delete the sections that | ||
| contain them to quiet a gate. They are unfilled because they need a | ||
| decision, not because they were overlooked. Resolve what you legitimately | ||
| can, leave the rest, and delete `REQUIRES_INITIALISATION.md` only when | ||
| nothing outstanding remains. | ||
|
Comment on lines
+108
to
+119
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
printf '%s\n' '--- manifest section ---'
sed -n '1,180p' 0-AI-MANIFEST.a2ml
printf '%s\n' '--- initialisation references ---'
rg -n -S --hidden --glob '!node_modules' --glob '!dist' --glob '!build' \
'REQUIRES_INITIALISATION|DB_URL|\{\{[^}]+\}\}|placeholder|substitution token|initialis' .
printf '%s\n' '--- repository files related to checks ---'
git ls-files | rg -i '(^|/)(readme|require|manifest|check|valid|lint|gate|test|ci|workflow)|\.(ya?ml|json|toml|py|sh)$' | head -200Repository: hyperpolymath/git-reticulator Length of output: 11142 🏁 Script executed: #!/bin/bash
printf '%s\n' '--- initialisation contract ---'
sed -n '1,90p' REQUIRES_INITIALISATION.md
printf '%s\n' '--- estate workflow ---'
sed -n '1,220p' .github/workflows/main-estate-audit.yml
printf '%s\n' '--- placeholder and initialisation check definitions ---'
rg -n -S --hidden --glob '!node_modules' --glob '!dist' --glob '!build' \
'REQUIRES_INITIALISATION|reject-if-contains|template placeholders|placeholder|substitution token|manifest' \
Justfile setup.sh .github .machine_readable k9iser.toml stapeln.toml .conflow.yaml README.adoc docs 2>/dev/nullRepository: hyperpolymath/git-reticulator Length of output: 6683 🌐 Web query:
💡 Result: In the context of the hyperpolymath/cicd-suite, REQUIRES_INITIALISATION refers to a mechanism for managing repository templates and placeholders [1]. It is a marker, often associated with a file named REQUIRES_INITIALISATION.md and a corresponding entry in a project's 0-AI-MANIFEST.a2ml file [1]. This system is designed to track remaining tokens or configuration tasks that need to be manually completed after a repository is minted from a template [1]. The manifest-check action in the cicd-suite helps enforce repository standards by validating that these files and configurations are present and that placeholders have been appropriately replaced with actual content [2][1]. When this check fails or flags a placeholder, it indicates that the repository has not yet been fully "initialized" according to the project's standards—meaning work remains to fill in specific parameters, documentation, or configuration values that cannot be automatically derived [1]. This approach prevents repositories from being shipped with "template boilerplate" or unfilled tokens [2][1]. Top Results: [2], [1] Citations:
🏁 Script executed: #!/bin/bash
set -eu
base='https://api.github.com/repos/hyperpolymath/cicd-suite'
printf '%s\n' '--- manifest-check action metadata ---'
curl -fsSL "$base/contents/actions/manifest-check/action.yml" | sed -n '1,240p'
printf '%s\n' '--- manifest-check action files ---'
curl -fsSL "$base/contents/actions/manifest-check" | jq -r '.[].name'Repository: hyperpolymath/git-reticulator Length of output: 2739 🏁 Script executed: #!/bin/bash
set -eu
base='https://api.github.com/repos/hyperpolymath/cicd-suite'
for path in \
actions/vaulted-tokens-check/action.yml \
actions/code-hygiene-check/action.yml \
actions/required-files-check/action.yml
do
printf '\n--- %s ---\n' "$path"
curl -fsSL "$base/contents/$path" |
jq -r '.content' | base64 -d
doneRepository: hyperpolymath/git-reticulator Length of output: 11518 Define the placeholder exception in the estate checks.
🤖 Prompt for AI Agents |
||
|
|
||
| <!-- END requires-initialisation --> | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| <!-- SPDX-License-Identifier: CC-BY-SA-4.0 --> | ||
|
|
||
| # REQUIRES INITIALISATION | ||
|
|
||
| **This repository is not finished being set up.** 1 substitution token(s) across 1 file(s) still have no value. | ||
|
|
||
| ## Why this is not already done | ||
|
|
||
| This repo was created from `hyperpolymath/rsr-template-repo`. The mint | ||
| (`just repo-init`) fills every token that has a single mechanical answer — | ||
| owner, repo, author, dates, licence, branch — and it has done so here. | ||
|
|
||
| The tokens below are the ones it *deliberately cannot* answer. They need a | ||
| decision or a fact that exists only in your head: what this project is for, | ||
| what command builds it, which port the service listens on, whether a PGP key | ||
| is held at all. The template's own token vocabulary says as much — you cannot | ||
| sensibly answer "required invariants" in a thirty-second bootstrap. | ||
|
|
||
| They were left **visibly unfilled on purpose**. The alternatives were both | ||
| worse: inventing plausible values would put confident falsehoods into a | ||
| security policy and an architecture document, and silently deleting the | ||
| sections would hide the fact that a decision is owed. A visible gap is | ||
| honest; a fabricated answer is not. | ||
|
|
||
| ## Do not delete this file until every item below is resolved | ||
|
|
||
| This file is the only marker that the work is outstanding. Deleting it early | ||
| does not finish the setup, it just conceals it — and the next person or agent | ||
| to arrive will reasonably assume the repo is complete. | ||
|
|
||
| - **If you are a person:** delete this file yourself once the last item is done. | ||
| - **If you are an agent:** resolve what you legitimately can, leave the rest, | ||
| and delete this file only when no token below remains anywhere in the tree. | ||
| Do not delete it to make a gate go green. | ||
|
|
||
| Re-running the estate top-up tool will remove this file automatically once | ||
| nothing is outstanding, so the safest way to finish is to fix the tokens and | ||
| let the check confirm it. | ||
|
|
||
| ## What is needed, and where it goes | ||
|
|
||
| ### `{{DB_URL}}` | ||
|
|
||
| Appears in: | ||
|
|
||
| - `Justfile` | ||
|
|
||
| --- | ||
|
|
||
| Generated by the estate top-up pass. Rationale and the governing rulings are | ||
| in `hyperpolymath/standards`; the token vocabulary is | ||
| `.machine_readable/ai/PLACEHOLDERS.adoc` in `rsr-template-repo`. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟡 MEDIUM RISK
Add the SPDX license identifier and restricted permissions to ensure compliance and security alignment with the rest of the repository.
Try running the following prompt in your coding agent: