From 98b3d55b4564bc25d45cc24d3bc3cfe62bbd24b0 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 26 Oct 2026 22:00:06 +0000 Subject: [PATCH 1/3] fix(ci): re-point standards callers to metadatastician/standards hyperpolymath/standards now redirects (301) to metadatastician/standards. Git follows that redirect, but GitHub Actions does not resolve a reusable workflow through it: every caller pinned at hyperpolymath/standards@333b06a ends in startup_failure with "workflow was not found" (governance on main since 2026-10-25 21:18 UTC, scorecard since 2026-10-26). Re-points the five reusable callers (governance, hypatia-scan, mirror, scorecard, secret-scanner) and the gitleaks-baseline checkout in security-policy to metadatastician/standards at the SAME SHAs, so no behaviour changes. actions.lock is tool-owned. A one-off workflow on this branch regenerates it with gh actions-lock v0.2.0 and the estate repair chain, checks it with the governance gate's verifier, and commits only the lock. The one-off is deleted in a later commit on this branch, before merge. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- .github/workflows/security-policy.yml | 2 +- .../zz-one-off-lock-regen-standards-move.yml | 75 +++++++++++++++++++ 7 files changed, 81 insertions(+), 6 deletions(-) create mode 100644 .github/workflows/zz-one-off-lock-regen-standards-move.yml diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 416ab42c..065c8f7b 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -16,7 +16,7 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 + uses: metadatastician/standards/.github/workflows/governance-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 # Scanner pin, overriding the reusable's default (51ab649, which rejects the # v0.0.3 actions.lock that gh actions-lock now writes). This is hypatia main # with #938 (v0.0.3 lock), #942 (WH013 per-job credentials) and #947 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 68477449..13a442aa 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -21,7 +21,7 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 + uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 # Scanner pin: see governance.yml. Drop once `uses:` is re-pinned. with: hypatia-ref: 23dc74de05fb34fe0e6f8d204fb65bf0625673a0 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 20bc741d..f1e0d60b 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -41,7 +41,7 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 + uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 # Only the seven forge keys the callee declares (standards#1108 ยง6b). secrets: GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index ed5b71a9..e5c4b41e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -16,7 +16,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 + uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 permissions: actions: read contents: read diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 328f70b0..7ad62ab4 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -22,4 +22,4 @@ jobs: contents: read pull-requests: write actions: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 + uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml index f0394d52..bfab5075 100644 --- a/.github/workflows/security-policy.yml +++ b/.github/workflows/security-policy.yml @@ -281,7 +281,7 @@ jobs: - name: Fetch estate gitleaks baseline uses: actions/checkout@v7.0.1 with: - repository: hyperpolymath/standards + repository: metadatastician/standards ref: 571cc734cd69fb846032ec77a662aa8ee4fc32cd path: .standards-gitleaks sparse-checkout: | diff --git a/.github/workflows/zz-one-off-lock-regen-standards-move.yml b/.github/workflows/zz-one-off-lock-regen-standards-move.yml new file mode 100644 index 00000000..fe6c5f72 --- /dev/null +++ b/.github/workflows/zz-one-off-lock-regen-standards-move.yml @@ -0,0 +1,75 @@ +# SPDX-License-Identifier: MPL-2.0 +# ONE-OFF, this PR's branch only; deleted before the PR merges. +# +# hyperpolymath/standards now redirects to metadatastician/standards, and +# GitHub Actions does not follow a repository redirect for a reusable +# workflow (`workflow was not found`), so every caller pinned at +# hyperpolymath/standards@333b06a fails at startup. This PR re-points the +# callers to metadatastician/standards at the same SHA. actions.lock is +# tool-owned, so this job regenerates it with gh actions-lock v0.2.0 and the +# estate repair chain (regen_lock in standards scripts/regen-dependabot-locks.sh, +# lock-only, workflow YAML restored), checks it with the governance gate's +# own verifier, and commits ONLY the lock back to this branch. +# +# It has no `uses:` steps, so it needs no lock entry to start, and it is +# removed from the tree before the tool runs so the lock never records it. +name: one-off actions.lock regeneration (standards move) +on: + push: + branches: [claude/eager-wright-zwwbe2-standards-move] +permissions: + contents: read +concurrency: + group: lock-regen-standards-move + cancel-in-progress: false +jobs: + regen: + runs-on: ubuntu-latest + timeout-minutes: 20 + permissions: + contents: write # commits the regenerated lock back to this branch + env: + GH_TOKEN: ${{ github.token }} + REPO: ${{ github.repository }} + BRANCH: ${{ github.ref_name }} + STANDARDS_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7 + LOCK_PATH: .github/workflows/actions.lock + steps: + - name: Regenerate actions.lock, verify it, and push it to this branch + run: | + set -euo pipefail + auth="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$GH_TOKEN" | base64 -w0)" + git -c "http.https://github.com/.extraheader=$auth" clone --quiet --branch "$BRANCH" "https://github.com/$REPO.git" r + git clone --quiet https://github.com/metadatastician/standards.git std + git -C std checkout --quiet --detach "$STANDARDS_SHA" + sudo apt-get install -y -qq gawk >/dev/null + gh extension install github/gh-actions-lock --pin v0.2.0 + gh actions-lock --version + tools="$PWD/std/scripts" + cd r + git rm --quiet --cached .github/workflows/zz-one-off-lock-regen-standards-move.yml + rm .github/workflows/zz-one-off-lock-regen-standards-move.yml + # The tool may exit non-zero yet rewrite the lock; the verifier decides. + gh actions-lock || echo "gh actions-lock exited $?; the verifier decides" + git checkout --quiet -- . ":(exclude)$LOCK_PATH" + git clean -fdq + for s in relock-sha-keys complete-job-refs close-lock prune-stale; do + GH_BIN=gh bash "$tools/$s.sh" + done + if grep -Fq '$/' "$LOCK_PATH"; then echo "::error::lock carries an invalid \$/ path"; exit 1; fi + GH_BIN=gh bash "$tools/update-actions-lock.sh" --verify-local + bash "$tools/check-lock-sync.sh" + ACTIONS_LOCK_VERIFIER="$tools/update-actions-lock.sh" bash "$tools/check-actions-lock-gate.sh" .github/workflows + git diff --stat -- "$LOCK_PATH" + if git diff --quiet -- "$LOCK_PATH"; then + echo "::error::the lock did not change; nothing to commit" + exit 1 + fi + # Commit the lock alone; the staged removal of this file stays out of + # the commit (the PR deletes it in its own reviewed commit). + git -c user.name="github-actions[bot]" -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \ + commit --quiet -m "chore(lock): regenerate actions.lock for the metadatastician/standards move" \ + -m "Written by gh actions-lock v0.2.0 and the estate repair chain at standards $STANDARDS_SHA (run $GITHUB_RUN_ID)." \ + -- "$LOCK_PATH" + git -c "http.https://github.com/.extraheader=$auth" push --quiet origin "HEAD:$BRANCH" + echo "LOCK-SHA256 $(sha256sum < "$LOCK_PATH" | cut -d' ' -f1)" From 8089d115402a72142652243a32fddf44cbe4e7b6 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 26 Oct 2026 22:01:26 +0000 Subject: [PATCH 2/3] ci(one-off): print the regenerated lock; GITHUB_TOKEN cannot push workflow files The first run regenerated and verified the lock (8+/7- lines, every verifier green) but the push was refused: GITHUB_TOKEN has no workflows permission. Print the lock base64 with its sha256 instead; the next commit on this PR carries those exact bytes. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM --- .../zz-one-off-lock-regen-standards-move.yml | 24 ++++++++----------- 1 file changed, 10 insertions(+), 14 deletions(-) diff --git a/.github/workflows/zz-one-off-lock-regen-standards-move.yml b/.github/workflows/zz-one-off-lock-regen-standards-move.yml index fe6c5f72..0db981a2 100644 --- a/.github/workflows/zz-one-off-lock-regen-standards-move.yml +++ b/.github/workflows/zz-one-off-lock-regen-standards-move.yml @@ -9,7 +9,9 @@ # tool-owned, so this job regenerates it with gh actions-lock v0.2.0 and the # estate repair chain (regen_lock in standards scripts/regen-dependabot-locks.sh, # lock-only, workflow YAML restored), checks it with the governance gate's -# own verifier, and commits ONLY the lock back to this branch. +# own verifier, and prints ONLY the lock (base64 + sha256). GITHUB_TOKEN +# cannot push under .github/workflows/ (no `workflows` permission exists for +# it), so the PR commits these exact bytes and checks the sha256 matches. # # It has no `uses:` steps, so it needs no lock entry to start, and it is # removed from the tree before the tool runs so the lock never records it. @@ -26,8 +28,6 @@ jobs: regen: runs-on: ubuntu-latest timeout-minutes: 20 - permissions: - contents: write # commits the regenerated lock back to this branch env: GH_TOKEN: ${{ github.token }} REPO: ${{ github.repository }} @@ -35,11 +35,10 @@ jobs: STANDARDS_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7 LOCK_PATH: .github/workflows/actions.lock steps: - - name: Regenerate actions.lock, verify it, and push it to this branch + - name: Regenerate actions.lock, verify it, and print it run: | set -euo pipefail - auth="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$GH_TOKEN" | base64 -w0)" - git -c "http.https://github.com/.extraheader=$auth" clone --quiet --branch "$BRANCH" "https://github.com/$REPO.git" r + git clone --quiet --branch "$BRANCH" "https://github.com/$REPO.git" r git clone --quiet https://github.com/metadatastician/standards.git std git -C std checkout --quiet --detach "$STANDARDS_SHA" sudo apt-get install -y -qq gawk >/dev/null @@ -62,14 +61,11 @@ jobs: ACTIONS_LOCK_VERIFIER="$tools/update-actions-lock.sh" bash "$tools/check-actions-lock-gate.sh" .github/workflows git diff --stat -- "$LOCK_PATH" if git diff --quiet -- "$LOCK_PATH"; then - echo "::error::the lock did not change; nothing to commit" + echo "::error::the lock did not change" exit 1 fi - # Commit the lock alone; the staged removal of this file stays out of - # the commit (the PR deletes it in its own reviewed commit). - git -c user.name="github-actions[bot]" -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \ - commit --quiet -m "chore(lock): regenerate actions.lock for the metadatastician/standards move" \ - -m "Written by gh actions-lock v0.2.0 and the estate repair chain at standards $STANDARDS_SHA (run $GITHUB_RUN_ID)." \ - -- "$LOCK_PATH" - git -c "http.https://github.com/.extraheader=$auth" push --quiet origin "HEAD:$BRANCH" + git diff -- "$LOCK_PATH" echo "LOCK-SHA256 $(sha256sum < "$LOCK_PATH" | cut -d' ' -f1)" + echo "LOCK-BASE64-BEGIN" + base64 -w0 < "$LOCK_PATH"; echo + echo "LOCK-BASE64-END" From 6c24f80bd6daa48b001ec0100e4af21d2547cc13 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 26 Oct 2026 22:05:11 +0000 Subject: [PATCH 3/3] ci: remove the one-off lock-regeneration workflow Its two runs (40408992659, 40409175431) regenerated and verified the lock (sha256 02a8950aa1deab26d78045e317c9cbdaef14c8b1346f875fef3dcef4e45c2e8b); the owner lands those bytes with gh actions-lock locally. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM --- .../zz-one-off-lock-regen-standards-move.yml | 71 ------------------- 1 file changed, 71 deletions(-) delete mode 100644 .github/workflows/zz-one-off-lock-regen-standards-move.yml diff --git a/.github/workflows/zz-one-off-lock-regen-standards-move.yml b/.github/workflows/zz-one-off-lock-regen-standards-move.yml deleted file mode 100644 index 0db981a2..00000000 --- a/.github/workflows/zz-one-off-lock-regen-standards-move.yml +++ /dev/null @@ -1,71 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# ONE-OFF, this PR's branch only; deleted before the PR merges. -# -# hyperpolymath/standards now redirects to metadatastician/standards, and -# GitHub Actions does not follow a repository redirect for a reusable -# workflow (`workflow was not found`), so every caller pinned at -# hyperpolymath/standards@333b06a fails at startup. This PR re-points the -# callers to metadatastician/standards at the same SHA. actions.lock is -# tool-owned, so this job regenerates it with gh actions-lock v0.2.0 and the -# estate repair chain (regen_lock in standards scripts/regen-dependabot-locks.sh, -# lock-only, workflow YAML restored), checks it with the governance gate's -# own verifier, and prints ONLY the lock (base64 + sha256). GITHUB_TOKEN -# cannot push under .github/workflows/ (no `workflows` permission exists for -# it), so the PR commits these exact bytes and checks the sha256 matches. -# -# It has no `uses:` steps, so it needs no lock entry to start, and it is -# removed from the tree before the tool runs so the lock never records it. -name: one-off actions.lock regeneration (standards move) -on: - push: - branches: [claude/eager-wright-zwwbe2-standards-move] -permissions: - contents: read -concurrency: - group: lock-regen-standards-move - cancel-in-progress: false -jobs: - regen: - runs-on: ubuntu-latest - timeout-minutes: 20 - env: - GH_TOKEN: ${{ github.token }} - REPO: ${{ github.repository }} - BRANCH: ${{ github.ref_name }} - STANDARDS_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7 - LOCK_PATH: .github/workflows/actions.lock - steps: - - name: Regenerate actions.lock, verify it, and print it - run: | - set -euo pipefail - git clone --quiet --branch "$BRANCH" "https://github.com/$REPO.git" r - git clone --quiet https://github.com/metadatastician/standards.git std - git -C std checkout --quiet --detach "$STANDARDS_SHA" - sudo apt-get install -y -qq gawk >/dev/null - gh extension install github/gh-actions-lock --pin v0.2.0 - gh actions-lock --version - tools="$PWD/std/scripts" - cd r - git rm --quiet --cached .github/workflows/zz-one-off-lock-regen-standards-move.yml - rm .github/workflows/zz-one-off-lock-regen-standards-move.yml - # The tool may exit non-zero yet rewrite the lock; the verifier decides. - gh actions-lock || echo "gh actions-lock exited $?; the verifier decides" - git checkout --quiet -- . ":(exclude)$LOCK_PATH" - git clean -fdq - for s in relock-sha-keys complete-job-refs close-lock prune-stale; do - GH_BIN=gh bash "$tools/$s.sh" - done - if grep -Fq '$/' "$LOCK_PATH"; then echo "::error::lock carries an invalid \$/ path"; exit 1; fi - GH_BIN=gh bash "$tools/update-actions-lock.sh" --verify-local - bash "$tools/check-lock-sync.sh" - ACTIONS_LOCK_VERIFIER="$tools/update-actions-lock.sh" bash "$tools/check-actions-lock-gate.sh" .github/workflows - git diff --stat -- "$LOCK_PATH" - if git diff --quiet -- "$LOCK_PATH"; then - echo "::error::the lock did not change" - exit 1 - fi - git diff -- "$LOCK_PATH" - echo "LOCK-SHA256 $(sha256sum < "$LOCK_PATH" | cut -d' ' -f1)" - echo "LOCK-BASE64-BEGIN" - base64 -w0 < "$LOCK_PATH"; echo - echo "LOCK-BASE64-END"