Repository navigation
fix(rules): know the standards repository under its new name - #961
Merged
Merged
Conversation
hyperpolymath/standards moved to metadatastician/standards on 2026-10-25. Rules keyed on the old name went quiet for anything under the new one (Codex on #958): - ShaBumpPropagation: merge events from the moved repo carry the new name, and matched_reusables/1 compares names exactly, so no propagation finding fired. Both names are now registered. - MergeOrchestration.Sensor: standards contractiles/ and rulesets/ were meta (never self-approved) only for "hyperpolymath/standards"; events under the new name classified them as object. Either name, any case. - SecurityErrors pin exemption for own-org standards reusables, and WorkflowAudit WF016 (orphan pin) / WF027 (measured-dead revision): matched only the old path. Either name now. - ci-health action-superset: the metadatastician/standards reusable paths, which the hyperpolymath/* owner pattern does not cover. Hypatia.Rules.StandardsRepo holds the names (current first) so the next rule asks one place. Also fixes remediate.sh's allow-list body: jq parsed `["hyperpolymath/*"] + . as $pats | {...}` as array + object, so the B-ALLOWLIST remediation could never build its request and test/ci-health-test.sh exited 5 on main. Parenthesised. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM
Contributor
|
Warning Review limit reachedCodeRabbit couldn't verify your organization's usage billing state, so no usage-priced review was started. Retry after the billing service recovers. Next included review available in 22 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
marked this pull request as ready for review
October 26, 2026 22:38
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
hyperpolymath
enabled auto-merge
October 26, 2026 22:38
hyperpolymath
disabled auto-merge
October 27, 2026 00:07
Contributor
|
Add Carrot credits or activate Agent usage billing to use Autofix |
hyperpolymath
added a commit
that referenced
this pull request
Oct 27, 2026
…965) ## Why `hyperpolymath/standards` moved to `metadatastician/standards` on 2026-10-25. GitHub keeps a redirect for git and the REST API, but it does **not** follow that redirect when it resolves a reusable workflow's `uses:`. Every caller still naming the old owner therefore ends in `startup_failure` ("workflow was not found") before any job runs. This was measured on hypatia's governance runs 40424594888 and 40424740139. #961 proposed a rule for this so that a regression is caught by a rule, not found by people. This PR is that rule. ## What - **WF028** (`check_reusable_call_to_moved_repository/1`, wired into `audit/3`) flags a reusable-workflow call by a moved repository's former name. It finds the call where WF027 does: a job's `uses:` key in block or flow style, a value continued below its key, or a call through a job alias. A path in a `run:` script, an `env:` value, a comment or a step's `uses:` does not fire. The finding names the re-pointed reference at the **same revision**, since a move keeps history. - The moved-repo table is derived from the new `StandardsRepo.former/0`. Each further transfer into the org (standards ruling D97) is then one row, not a new rule. - Like WF026 and WF027, WF028 is advisory, severity `low` and `auto_fixable: false`. AGENTIC's `must-not-promote-to-blocking` rule applies, and no fleet fixer rewrites the owner yet. - `cli.ex` now carries the finding's `replacement` key through to SARIF and the fleet; until now it was dropped by the `Map.take` whitelist. - AGENTIC `[workflow-pin-detection]` and `Operations.md` list WF028. ## Validation - `test/rules/workflow_audit_pins_test.exs`: 104 tests, 0 failures. That includes 9 new WF028 tests and a self-check that hypatia's own `.github/workflows` produce no WF028 findings. `workflow_audit_chapel`, `workflow_audit_cron_drift` and `standards_repo` tests pass too. - Mutation check: with the job-key guard replaced by `true`, the "step / run-script" test goes red. - `mix format --check-formatted` passes on the touched files. - **Caveat:** these runs used a standalone compile of the rule modules on Elixir 1.14. The session's network policy blocks `repo.hex.pm`, so the project's deps (and the full `mix test`, including `cli_test.exs`) could not be fetched. CI is the first full-suite run. ## Follow-ups outside this repo - gitbot-fleet: an owner re-point fixer (WF028 → `auto_fixable: true`), and `fix-stale-reusable-pin.sh` / `stale-reusable-pins.tsv` still key on the old path. - `rsr-oracle.yml` still treats `hyperpolymath/standards` as the canon (separate change). --- _Generated by [Claude Code](https://claude.ai/code/session_01J4QvDfvetbJ5z7uREtbJWw)_
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #958.
hyperpolymath/standardsmoved tometadatastician/standardson 2026-10-25. Rules keyed on the old name went quiet for anything under the new one, which Codex raised on #958:ShaBumpPropagationmatched_reusables/1compares names exactly, so no propagation finding firedMergeOrchestration.Sensorcontractiles/andrulesets/were:meta(never self-approved) only for"hyperpolymath/standards", so under the new name they classified as:objectSecurityErrorspin exemption for own-org standards reusables at@mainWorkflowAuditWF016 (orphan pin) and WF027 (measured-dead revision)scripts/ci-health/action-superset.txthyperpolymath/*owner pattern doesn't cover the new ownermetadatastician/standards/...reusable pathsHypatia.Rules.StandardsReponow holds the names (current first, then former), so the next rule asks one place.Also fixed:
remediate.sh's allow-list body. jq parsed["hyperpolymath/*"] + . as $pats | {...}asarray + object, so the B-ALLOWLIST remediation could never build its request, andtest/ci-health-test.shexited 5 on main. I added the missing parentheses:(["hyperpolymath/*"] + .) as $pats.Type of change
How has this been verified?
hex.pm is unreachable here, so I compiled the touched modules standalone (Elixir 1.14) with their dependencies:
standards_repo_test(new),sha_bump_propagation_test,security_errors_test,workflow_audit_pins_testandsensor_test: 146/146 pass.main, one per gap in the table.StandardsRepo's own 4 tests are new.test/ci-health-test.sh: exit 0 (PASS: CI-health classification and remediation fixtures). Onmainit exits 5 with the jq error above.mix formatis clean on all touched files, andshellcheckis clean onremediate.sh.WorkflowAudit.audit/2gives identical findings with the old and new code on the hypatia, standards and echidna trees (200 / 176 / 120).Notes for reviewers
Beyond this repo:
fix-stale-reusable-pin.shandstale-reusable-pins.tsvmirror the WF027 table and likely key on the old path too.uses: hyperpolymath/standards/...as a certainstartup_failureand routes the re-point to the fleet. That is the detection half of the estate-wide fix(ci): re-point standards callers to metadatastician/standards #958 fix, and I'd propose it as the next PR.rsr-oracle.yml's standards-source guard still nameshyperpolymath/standards. That one is an interface change, so it's left for its own PR.Checklist
StandardsRepomoduledoc; comments at each site).Generated by Claude Code