-
-
Notifications
You must be signed in to change notification settings - Fork 0
Finish re-pin for 14 strict-ruleset consumers (need signed-commit propagation) #324
Copy link
Copy link
Open
Labels
choreRoutine maintenance with no behaviour changeRoutine maintenance with no behaviour changecicdCI/CD: workflows, actions, lockfiles, pins, runners, release gatesCI/CD: workflows, actions, lockfiles, pins, runners, release gatesgovernancePolicy, rulesets, standards, compliance, and their enforcementPolicy, rulesets, standards, compliance, and their enforcementpriority:p1High - schedule nextHigh - schedule nextscope:estateAffects many or all repos across the estateAffects many or all repos across the estatestatus:blockedCannot proceed until a dependency clearsCannot proceed until a dependency clears
Description
Activity
Metadata
Metadata
Assignees
Labels
choreRoutine maintenance with no behaviour changeRoutine maintenance with no behaviour changecicdCI/CD: workflows, actions, lockfiles, pins, runners, release gatesCI/CD: workflows, actions, lockfiles, pins, runners, release gatesgovernancePolicy, rulesets, standards, compliance, and their enforcementPolicy, rulesets, standards, compliance, and their enforcementpriority:p1High - schedule nextHigh - schedule nextscope:estateAffects many or all repos across the estateAffects many or all repos across the estatestatus:blockedCannot proceed until a dependency clearsCannot proceed until a dependency clears
Follow-up to the 2026-06-27 estate reusable re-pin sweep (hyperpolymath/hypatia#464). 327 consumers were re-pinned to
standardsHEADd7c22711and merged. These 14 could not be done from the cloud session — their repository rulesets require verified-signature commits (plus PR-only + code-scanning), and the agent proxy permitsgit(the only signed-commit path) for in-scope repos only, so the unsigned Contents-API write is rejected (Repository rule violations: commits must have verified signatures):aggregate-library,epistemic-types,intsoc-transactor,JuliaKids.jl,k9-validate-action,laniakea,live-files,manifesto,network-ambulance,odds-and-sods-package-manager,rsr-template-repo,trope-particularity-workbench,typefix-zero,veridical-simulation-coreCompletion
The
.git-private-farmsha-bump-propagate.ymlfarm sweep GPG-signs its commits → satisfies these rulesets in one pass; it needs Actions billing restored first (hyperpolymath/.git-private-farm#98). Otherwise: a manual signed re-pin per repo (hypatia-scan/governance/scorecardreusables →@d7c22711, and drop any retiredscorecard-enforcer.yml).Refs: hyperpolymath/hypatia#464, hyperpolymath/.git-private-farm#98.