fix(ci): repair unparseable scorecard.yml and restore the missing contents: read by hyperpolymath · Pull Request #120 · hyperpolymath/panll

hyperpolymath · 2026-09-14T16:32:59Z

Two defects. Fixing only the first would look like a cure while changing nothing.

An orphan actions: read sits indented beneath the scalar permissions: read-all.
A mapping entry under a scalar is invalid YAML, so GitHub has never parsed this workflow.
The analysis job declares its own permissions: block naming only security-events
and id-token. A job-level block replaces the workflow-level one rather than merging
with it — so the reusable workflow was being called with no contents: read and could not
check out. Deleting the orphan key alone yields a file that parses and still emits no check.

This adds contents: read to the job block, matching aerie#76 (merged 2026-09-13), which
carries exactly these three job permissions.

Why this was never noticed

A workflow that fails to parse does not go red. GitHub emits zero jobs, so the
Scorecard check run is never created and the context is absent from the rollup.
required ∩ failing is satisfied vacuously, and the board reads clean.

An unrepaired repo therefore looks greener than a repaired one. When this merges
you will see checks appear where there were none before. That is the gate arming, not
this PR introducing failures.

Verification

yq e '.' — parses (it did not before)
actionlint — clean
Pin unchanged; secrets: inherit unchanged; no other file touched.

Merging nothing — this is for your review.

🤖 Generated with Claude Code

https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

…tents: read Two defects, and fixing only the first would look like a cure while changing nothing. 1. `permissions: read-all` is a SCALAR, so the indented `actions: read` beneath it is a mapping entry under a scalar: invalid YAML. GitHub never parsed the file, the run emitted zero jobs, and the Scorecard check never appeared. The gate was ABSENT, not red. 2. The `analysis` job declares its own `permissions:` block naming only `security-events` and `id-token`. A job-level block REPLACES the workflow-level one rather than merging with it, so the reusable workflow was being called without `contents: read` and could not check out. Deleting the orphan key alone would yield a file that parses and still emits no check. Adds `contents: read` to the job block, matching aerie#76 (merged 2026-09-13), which carries exactly these three job permissions. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

coderabbitai · 2026-09-14T16:33:13Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 2421f327-5833-4b77-995c-32246c66e067

📥 Commits

Reviewing files that changed from the base of the PR and between bbece3f and 11e4fb5.

📒 Files selected for processing (1)

.github/workflows/scorecard.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⚠️ CI failures not shown inline (33)

GitHub Actions: Central Estate CI/CD Audit / 0_estate-audit.txt: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 Packages: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]The actions actions/checkout@v4 and hyperpolymath/cicd-suite/actions/required-files-check@main are not allowed in hyperpolymath/panll because all actions must be pinned to a full-length commit SHA.

GitHub Actions: Build Validation / 0_validate.txt: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run deno task res:build
 �[36;1mdeno task res:build�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 �[0m�[1m�[31merror�[0m: deno task couldn't find deno.json(c) or package.json. See https://docs.deno.com/go/config
 ##[error]Process completed with exit code 1.

GitHub Actions: Central Estate CI/CD Audit / estate-audit: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 Packages: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]The actions actions/checkout@v4 and hyperpolymath/cicd-suite/actions/required-files-check@main are not allowed in hyperpolymath/panll because all actions must be pinned to a full-length commit SHA.

GitHub Actions: Build Validation / validate: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run deno task res:build
 �[36;1mdeno task res:build�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 �[0m�[1m�[31merror�[0m: deno task couldn't find deno.json(c) or package.json. See https://docs.deno.com/go/config
 ##[error]Process completed with exit code 1.

GitHub Actions: Rust CI / 3_rust-ci _ Cargo check + clippy + fmt.txt: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run cargo check --locked --all-targets
 �[36;1mcargo check --locked --all-targets�[0m
 shell: /usr/bin/bash -e {0}
 env:
   CARGO_HOME: /home/runner/.cargo
   CARGO_INCREMENTAL: 0
   CARGO_TERM_COLOR: always
   CACHE_ON_FAILURE: false
 ##[endgroup]
 �[1m�[92m    Updating�[0m crates.io index
 �[1m�[91merror�[0m: failed to get `gossamer-rs` as a dependency of package `panll v0.2.0 (/home/runner/work/panll/panll)`
 Caused by:
   failed to load source for dependency `gossamer-rs`
 Caused by:
   unable to update /home/runner/work/panll/gossamer/bindings/rust
 Caused by:
   failed to read `/home/runner/work/panll/gossamer/bindings/rust/Cargo.toml`
 Caused by:
   No such file or directory (os error 2)
 ##[error]Process completed with exit code 101.

GitHub Actions: Rust CI / rust-ci _ Cargo check + clippy + fmt: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run cargo check --locked --all-targets
 �[36;1mcargo check --locked --all-targets�[0m
 shell: /usr/bin/bash -e {0}
 env:
   CARGO_HOME: /home/runner/.cargo
   CARGO_INCREMENTAL: 0
   CARGO_TERM_COLOR: always
   CACHE_ON_FAILURE: false
 ##[endgroup]
 �[1m�[92m    Updating�[0m crates.io index
 �[1m�[91merror�[0m: failed to get `gossamer-rs` as a dependency of package `panll v0.2.0 (/home/runner/work/panll/panll)`
 Caused by:
   failed to load source for dependency `gossamer-rs`
 Caused by:
   unable to update /home/runner/work/panll/gossamer/bindings/rust
 Caused by:
   failed to read `/home/runner/work/panll/gossamer/bindings/rust/Cargo.toml`
 Caused by:
   No such file or directory (os error 2)
 ##[error]Process completed with exit code 101.

GitHub Actions: Secret Scanner / 0_scan _ rust-secrets.txt: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

GitHub Actions: Secret Scanner / scan _ rust-secrets: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

GitHub Actions: Secret Scanner / 1_scan _ shell-secrets.txt: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

GitHub Actions: Dogfood Gate / 2_Validate K9 contracts.txt: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]K9 Configuration Validation
 Scanning . for K9 files (.k9, .k9.ncl)...
 Found 117 K9 file(s)
   Validating: ./.machine_readable/svc/k9/burble-metadata.k9.ncl
   Validating: ./.machine_readable/svc/k9/examples/ci-config.k9.ncl
   Validating: ./.machine_readable/svc/k9/examples/project-metadata.k9.ncl
   Validating: ./.machine_readable/svc/k9/examples/setup-repo.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-hunt.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-kennel.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-yard.k9.ncl
   Validating: ./coordination.k9
 ##[error]Missing pedigree block. K9 files must contain a 'pedigree = { ... }' section

GitHub Actions: Secret Scanner / scan _ shell-secrets: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

GitHub Actions: Dogfood Gate / Validate K9 contracts: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]K9 Configuration Validation
 Scanning . for K9 files (.k9, .k9.ncl)...
 Found 117 K9 file(s)
   Validating: ./.machine_readable/svc/k9/burble-metadata.k9.ncl
   Validating: ./.machine_readable/svc/k9/examples/ci-config.k9.ncl
   Validating: ./.machine_readable/svc/k9/examples/project-metadata.k9.ncl
   Validating: ./.machine_readable/svc/k9/examples/setup-repo.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-hunt.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-kennel.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-yard.k9.ncl
   Validating: ./coordination.k9
 ##[error]Missing pedigree block. K9 files must contain a 'pedigree = { ... }' section

GitHub Actions: Secret Scanner / 2_scan _ gitleaks.txt: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# A repo-local baseline wins outright — it is expected to `[extend]`�[0m
 �[36;1m# the estate one, so "wins" still means "inherits". This mirrors what�[0m
 �[36;1m# the AsciiDoc pass below already did, which was inconsistent with�[0m
 �[36;1m# this step until now.�[0m
 �[36;1mCONFIG=".gitleaks-estate.toml"�[0m
 �[36;1mif [ -f .gitleaks.toml ]; then�[0m
 �[36;1m  CONFIG=".gitleaks.toml"�[0m
 �[36;1m  echo "Using repository .gitleaks.toml (extending the estate baseline)."�[0m
 �[36;1melse�[0m
 �[36;1m  echo "Using estate baseline allowlist."�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m"$RUNNER_TEMP/gitleaks" detect \�[0m
 �[36;1m  --source . \�[0m
 �[36;1m  --no-git \�[0m
 �[36;1m  --redact \�[0m
 �[36;1m  --no-banner \�[0m
 �[36;1m  --verbose \�[0m
 �[36;1m  --config "$CONFIG" \�[0m
 �[36;1m  --exit-code 1�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 Using estate baseline allowlist.
 Finding:     ...onst text = "OpenAI key: �[1;3;mREDACTED�[0m
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      generic-api-key
 Entropy:     5.357552
 File:        tests/aspect/security_test.mjs
 Line:        263
 Fingerprint: tests/aspect/security_test.mjs:generic-api-key:263
 Finding:     ...onst text = "GitHub ***REDACTED_SECRET_ASSIGNMENT***
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      generic-api-key
 Entropy:     5.129283
 File:        tests/aspect/security_test.mjs
 Line:        269
 Fingerprint: tests/aspect/security_test.mjs:generic-api-key:269
 �[90m8:46PM�[0m �[32mINF�[0m scan completed in 257ms
 �[90m8:46PM�[0m �[31mWRN�[0m leaks found: 2
 ##[error]Process completed with exit code 1.

GitHub Actions: Dogfood Gate / 3_Groove manifest check.txt: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Secret Scanner / scan _ gitleaks: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# A repo-local baseline wins outright — it is expected to `[extend]`�[0m
 �[36;1m# the estate one, so "wins" still means "inherits". This mirrors what�[0m
 �[36;1m# the AsciiDoc pass below already did, which was inconsistent with�[0m
 �[36;1m# this step until now.�[0m
 �[36;1mCONFIG=".gitleaks-estate.toml"�[0m
 �[36;1mif [ -f .gitleaks.toml ]; then�[0m
 �[36;1m  CONFIG=".gitleaks.toml"�[0m
 �[36;1m  echo "Using repository .gitleaks.toml (extending the estate baseline)."�[0m
 �[36;1melse�[0m
 �[36;1m  echo "Using estate baseline allowlist."�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m"$RUNNER_TEMP/gitleaks" detect \�[0m
 �[36;1m  --source . \�[0m
 �[36;1m  --no-git \�[0m
 �[36;1m  --redact \�[0m
 �[36;1m  --no-banner \�[0m
 �[36;1m  --verbose \�[0m
 �[36;1m  --config "$CONFIG" \�[0m
 �[36;1m  --exit-code 1�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 Using estate baseline allowlist.
 Finding:     ...onst text = "OpenAI key: �[1;3;mREDACTED�[0m
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      generic-api-key
 Entropy:     5.357552
 File:        tests/aspect/security_test.mjs
 Line:        263
 Fingerprint: tests/aspect/security_test.mjs:generic-api-key:263
 Finding:     ...onst text = "GitHub ***REDACTED_SECRET_ASSIGNMENT***
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      generic-api-key
 Entropy:     5.129283
 File:        tests/aspect/security_test.mjs
 Line:        269
 Fingerprint: tests/aspect/security_test.mjs:generic-api-key:269
 �[90m8:46PM�[0m �[32mINF�[0m scan completed in 257ms
 �[90m8:46PM�[0m �[31mWRN�[0m leaks found: 2
 ##[error]Process completed with exit code 1.

GitHub Actions: Dogfood Gate / Groove manifest check: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Governance / 2_governance _ Actions lockfile verify.txt: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at job.workflow_sha failed?)"�[0m

GitHub Actions: Governance / governance _ Actions lockfile verify: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at job.workflow_sha failed?)"�[0m

GitHub Actions: Governance / 3_governance _ Well-Known (RFC 9116 + RSR).txt: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m

GitHub Actions: Governance / 4_governance _ Security policy checks.txt: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run FAILED=false
 �[36;1mFAILED=false�[0m
 �[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
 �[36;1m  echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
 �[36;1m  echo "$WEAK_CRYPTO"�[0m
 �[36;1mfi�[0m
 �[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
 �[36;1m  echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
 �[36;1m  echo "$HTTP_URLS"�[0m
 �[36;1mfi�[0m
 �[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
 �[36;1mif [ -n "$SECRETS" ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

GitHub Actions: Governance / governance _ Security policy checks: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run FAILED=false
 �[36;1mFAILED=false�[0m
 �[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
 �[36;1m  echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
 �[36;1m  echo "$WEAK_CRYPTO"�[0m
 �[36;1mfi�[0m
 �[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
 �[36;1m  echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
 �[36;1m  echo "$HTTP_URLS"�[0m
 �[36;1mfi�[0m
 �[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
 �[36;1mif [ -n "$SECRETS" ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

GitHub Actions: Governance / governance _ Security policy checks: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

GitHub Actions: Governance / 5_governance _ Code quality + docs.txt: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
 with:
   github-***REDACTED_SECRET_ASSIGNMENT***
   version: latest
 ##[endgroup]
 Find 'latest' release
 ##[error]Error: The binary 'ec-linux-amd64*' not found

GitHub Actions: Governance / governance _ Code quality + docs: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
 with:
   github-***REDACTED_SECRET_ASSIGNMENT***
   version: latest
 ##[endgroup]
 Find 'latest' release
 ##[error]Error: The binary 'ec-linux-amd64*' not found

GitHub Actions: Governance / 6_governance _ Trusted-base reduction policy.txt: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run bash standards/scripts/check-trusted-base.sh caller
 �[36;1mbash standards/scripts/check-trusted-base.sh caller�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 [INFO] Found 2 soundness-relevant escape hatch(es).
 [ERROR] No docs/proof-debt.md (or equivalent) found, but 2 escape hatches exist.
 [ERROR] Seed one per the schema at hyperpolymath/standards/docs/TRUSTED-BASE-REDUCTION-POLICY.adoc.
 ##[error]Process completed with exit code 1.

GitHub Actions: Governance / governance _ Trusted-base reduction policy: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run bash standards/scripts/check-trusted-base.sh caller
 �[36;1mbash standards/scripts/check-trusted-base.sh caller�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 [INFO] Found 2 soundness-relevant escape hatch(es).
 [ERROR] No docs/proof-debt.md (or equivalent) found, but 2 escape hatches exist.
 [ERROR] Seed one per the schema at hyperpolymath/standards/docs/TRUSTED-BASE-REDUCTION-POLICY.adoc.
 ##[error]Process completed with exit code 1.

GitHub Actions: Governance / 8_governance _ Workflow security linter.txt: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

GitHub Actions: Governance / governance _ Workflow security linter: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

GitHub Actions: Governance / 14_governance _ Language _ package anti-pattern policy.txt: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
 �[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
 �[36;1m   && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-ts-allowlist.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
 �[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
 �[36;1m   && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-ts-allowlist.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: fix(ci): repair unparseable scorecard.yml and restore the missing contents: read

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"
 �[36;1mSCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f tools/policy/check-language-policy.sh ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-language-policy.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::language-policy gate not found in standards@main or locally"�[0m

🔇 Additional comments (1)

.github/workflows/scorecard.yml (1)

14-15: LGTM!

📝 Summary

Summary by CodeRabbit

Chores
- Updated automated security scanning permissions to support repository checks and security reporting.
- No changes to product functionality or the user experience.

Walkthrough

The scorecard workflow moves actions: read into the analysis job's permissions and adds contents: read. Existing permissions and the reusable workflow call remain unchanged.

Changes

Scorecard workflow permissions

Layer / File(s)	Summary
Analysis job permissions and workflow call `.github/workflows/scorecard.yml`	The `analysis` job declares `actions: read` and `contents: read` at job level. `security-events: write`, `id-token: write`, and the reusable workflow call remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Suggested reviewers: metadatastician

Merge Risk: ⚪ Minimal · up to 11e4f

The Scorecard workflow permission update is narrowly scoped and presents no identified merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI workflow repair and the restoration of the missing `contents: read` permission.
Description check	✅ Passed	The description directly explains the YAML parsing defect, the job-level permission issue, the changes made, and the verification performed.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

❌ Error running CI fixer.

Create stacked PR
Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks the workflow gate
Permissions now sit in the proper state
Actions can read, contents too
Scorecards run as they should do
The reuse call stays in view
Hop, hop, the patch is through!}

_{Comment @coderabbitai help to get the list of available commands.}

The job-level `permissions:` block REPLACES the workflow-level block, so the reusable workflow's own `actions: read` cannot elevate the caller's token. Without it the caller's effective `actions` permission is `none`, and Scorecard's Packaging check (Actions.ListWorkflowRunsByFileName) can error. Caught by CodeRabbit on palimpsest-license#151; verified against the whole family: 11 of 13 scorecard.yml callers omit it, including aerie which is already on main. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

sonarqubecloud · 2026-09-14T20:47:08Z

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

coderabbitai · 2026-09-14T22:27:15Z

✅ Coding Agent task started: View task and status

The task will inspect the CI failures, validate its fix, and open a stacked fix pull request automatically.

Note: Fixing CI failures is a beta feature and may encounter errors. Expect some limitations and changes as we gather feedback and continue to improve it.

⏭️ 5 check(s) skipped — already failing on `main` (not caused by this PR)

GitHub Actions: Central Estate CI/CD Audit / 0_estate-audit.txt
GitHub Actions: Build Validation / 0_validate.txt
GitHub Actions: Secret Scanner / 1_scan _ shell-secrets.txt
GitHub Actions: Dogfood Gate / 3_Groove manifest check.txt
GitHub Actions: Governance / 4_governance _ Security policy checks.txt

coderabbitai · 2026-09-14T22:53:41Z

Rate Limit Exceeded

@hyperpolymath have exceeded the limit for the number of chat messages per hour. Please wait 30 minutes and 49 seconds before sending another message.

scorecard.yml is already repaired on branch fix/repair-startup-dead-scorecard-yml (PR #120), which re-indents `actions: read` INTO the analysis job's own permissions block. That is the correct cure: job-level permissions REPLACE the top-level map, so the analysis job never inherited `read-all` and Scorecard was running without `actions: read`. Deleting the stray line made the file parse but left the job functionally short. Restoring this file from main so PR #120 owns it uncontested. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

coderabbitai Bot previously approved these changes Sep 14, 2026

View reviewed changes

hyperpolymath enabled auto-merge (squash) September 14, 2026 17:30

hyperpolymath dismissed coderabbitai[bot]’s stale review via 11e4fb5 September 14, 2026 20:46

coderabbitai Bot approved these changes Sep 14, 2026

View reviewed changes

Navigation Menu

fix(ci): repair unparseable scorecard.yml and restore the missing contents: read - #120

fix(ci): repair unparseable scorecard.yml and restore the missing contents: read#120
hyperpolymath wants to merge 2 commits into
mainfrom
fix/repair-startup-dead-scorecard-yml

hyperpolymath commented Sep 14, 2026

Uh oh!

coderabbitai Bot commented Sep 14, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

sonarqubecloud Bot commented Sep 14, 2026

Uh oh!

coderabbitai Bot commented Sep 14, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

hyperpolymath commented Sep 14, 2026

Why this was never noticed

Verification

Uh oh!

coderabbitai Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

sonarqubecloud Bot commented Sep 14, 2026

Quality Gate failed

Uh oh!

coderabbitai Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Sep 14, 2026

Rate Limit Exceeded

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Sep 14, 2026 •

edited

Loading

coderabbitai Bot commented Sep 14, 2026 •

edited

Loading