Repository navigation
CI: pre-existing reds on main (Cargo Audit, governance linters, 3 startup_failures from lock drift) #401
Description
Activity
- added a commit that references this issue
on Oct 6, 2026 Close-out evidence for the acceptance criteria. Read 2026-10-06 from the runs on
mainc28d09a (#410 squash). All 19 runs on that head are listed; none isstartup_failure.- Lock clean.
gh actions-lock --no-fix --verifyon c28d09a reportsvalid: truewith 0 errors. One warning remains:hyperpolymath/cicd-suite@4c772eb sha-as-ref, which can't be avoided because cicd-suite has no tags. Plain--no-fixmode cannot see a corrupted pin;--verifycan, and a planted one-digit corruption reportsunreachable-pin. - Workflows start. Rust CI https://github.com/hyperpolymath/echidna/actions/runs/37471899251, CodeQL https://github.com/hyperpolymath/echidna/actions/runs/37471899489, MVP Smoke https://github.com/hyperpolymath/echidna/actions/runs/37471899344 and Zig FFI CI https://github.com/hyperpolymath/echidna/actions/runs/37471899210 are all
success. - Previously red gates. Cargo Audit https://github.com/hyperpolymath/echidna/actions/runs/37471899309, Governance https://github.com/hyperpolymath/echidna/actions/runs/37471901129 and Workflow Security Linter https://github.com/hyperpolymath/echidna/actions/runs/37471899351 are all
success. - Hypatia baseline burn-down. Tracked in Re-arm the hypatia baseline gate: generate .hypatia-baseline.json (152 findings to grandfather + burn down) #314, not here.
Two reds remain on main, and neither is lock drift:
- Mirror to Git Forges https://github.com/hyperpolymath/echidna/actions/runs/37471900931 (forge credentials).
- Security Scan https://github.com/hyperpolymath/echidna/actions/runs/37471901353 (HTTP 401 at the verisimdb send, Security Scan red: VERISIMDB_PAT is a dead token (401 Bad credentials) — rotate or delete #310, an owner-held secret).
#410 also pinned the floating refs:
dtolnay/rust-toolchain@masterto@v1through the lock, cicd-suite@mainto a SHA, and the unpinned hypatia clone to 51ab6496. The standards reusable bump (571cc734 → 5751b97e) was held back. On 5751b97e, the governance R5 step exits silently underbash -e, and a new UUID-v7 job flagsProject.toml. That bump will return in its own PR.From Claude's side this issue is closeable. Jonathan decides.
🤖 Generated with Claude Code
- Lock clean.
These reds on
main(ba373a8) were present before #399 and are identical on its head (cf51b64). #399 fixes only CodeQL, which moves fromstartup_failuretosuccess.Dependency auditgovernance / Workflow security lintergovernance / Validate Hypatia Baselinelint-workflowsstartup_failureThe startup failures match the 3
errorfindings thatgh actions-lock --no-fixstill reports on #399's head. They are in theagda-meta-checker,mvp-smokeands4-looplock entries, where the lock and the workflow refs disagree.Acceptance criteria
gh actions-lock --no-fix --jsonreports 0errorfindings. Fix the lock by hand; never use write mode, which corrupts local action refs.main.Dependency audit,governance / Workflow security linterandlint-workflowsare each green, or each remaining finding has its own issue.governance / Validate Hypatia Baselineresolved via Re-arm the hypatia baseline gate: generate .hypatia-baseline.json (152 findings to grandfather + burn down) #314.🤖 Generated with Claude Code