fix(ci): call the estate reusables by their real ref — these never parsed - #10
Conversation
…rsed The six workflows used `uses: ../…/x-reusable.yml`, which GitHub Actions rejects at parse time: the runs are dead (0 jobs) and named by path rather than by their declared name. The ref becomes the pinned cross-repo form, and each caller now grants the permissions its callee declares — without that the repair only moves the failure from parse time to run time. Refs hyperpolymath/standards#808.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (6)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (11)
🧰 Additional context used🪛 zizmor (1.30.0).github/workflows/mirror.yml[warning] 15-15: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment (undocumented-permissions) [warning] 17-17: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow (secrets-inherit) .github/workflows/secret-scanner.yml[warning] 20-20: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow (secrets-inherit) .github/workflows/hypatia-scan.yml[warning] 21-21: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment (undocumented-permissions) [warning] 24-24: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow (secrets-inherit) .github/workflows/scorecard.yml[warning] 25-25: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment (undocumented-permissions) [warning] 26-26: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow (secrets-inherit) .github/workflows/codeql.yml[warning] 22-22: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment (undocumented-permissions) .github/workflows/governance.yml[warning] 28-28: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment (undocumented-permissions) 🔇 Additional comments (6)
📝 SummarySummary by CodeRabbit
WalkthroughThe workflows now use pinned reusable workflows from ChangesShared workflow migration
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~10 minutes Change: Bug fix 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks each workflow pin Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
…#11) The root `.github/workflows/` repair merged as #10. This is the rest of the same defect: the same refs sitting in **nested copies** of the same six workflows, which are inert where they sit but are what new repos are minted from. `uses: ../….github/workflows/<x>-reusable.yml` is not a ref form GitHub Actions supports, so each of these files fails at parse time wherever it is used. Each ref becomes the pinned cross-repo form `hyperpolymath/standards/.github/workflows/<x>-reusable.yml@4e6ffe55…`, and each calling job is granted the permissions its callee declares (keyed off the callee named in the ref, not the caller's filename). Refs hyperpolymath/standards#808.
2 participants
These workflows carried
uses: ../….github/workflows/<x>-reusable.yml, which is not a ref formGitHub Actions supports — a reusable-workflow
uses:may be./…(same repo) or<owner>/<repo>/….yml@<ref>(cross repo). A../path is rejected at parse time, so each of theseworkflows is permanently dead:
conclusion=failure, 0 jobs, and a run name equal to its pathrather than its declared
name:. That triple is also the signature of callee-lockfile poisoning,which is why these read as lockfile faults rather than as what they are.
Two changes per file:
hyperpolymath/standards/.github/workflows/<x>-reusable.yml@4e6ffe55…;more than its caller grants it, so repairing only the ref would move the failure from parse time
to run time — the same defect, one layer down. Permissions are keyed off the callee named in
the ref, not the caller's filename:
scorecard-enforcer.ymlalso callsscorecard-reusable.yml.Refs hyperpolymath/standards#808. The reusables themselves are untouched — they were always fine;
this is the callers' ref form.