From e13053ed883ad4e931ae75a1e98464563cb092e3 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 27 Oct 2026 01:13:04 +0000 Subject: [PATCH 1/4] chore(ci): one-off probe for close-lock's moved-tag fallback (scratch, not for merge) Two scratch workflows on this branch only. zz-one-off-close-lock regenerates actions.lock with regen_lock from hyperpolymath/standards#1350 and prints the result. zz-probe-moved-tags calls standards@75bd5994 mirror-reusable and panic-attack@b689a74 scan-and-report with no secrets, so it starts only if the lock closes over their old dtolnay pins. Both files are deleted after the measurement. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01JHfuPCv1pEiqkQGG5DQASb --- .github/workflows/zz-one-off-close-lock.yml | 49 +++++++++++++++++++++ .github/workflows/zz-probe-moved-tags.yml | 19 ++++++++ 2 files changed, 68 insertions(+) create mode 100644 .github/workflows/zz-one-off-close-lock.yml create mode 100644 .github/workflows/zz-probe-moved-tags.yml diff --git a/.github/workflows/zz-one-off-close-lock.yml b/.github/workflows/zz-one-off-close-lock.yml new file mode 100644 index 00000000..a4cce585 --- /dev/null +++ b/.github/workflows/zz-one-off-close-lock.yml @@ -0,0 +1,49 @@ +# SPDX-License-Identifier: MPL-2.0 +# ONE-OFF, scratch branch only, deleted after use. Regenerates this branch's +# actions.lock with the estate repair order (regen_lock in +# standards/scripts/regen-dependabot-locks.sh) from hyperpolymath/standards#1350, +# reports close-lock's moved-tag decisions and the --check verdict, and prints +# the lock. It has no `uses:` steps, so it needs no lock entry to start. It +# writes nothing back. +name: one-off actions.lock regeneration (moved tags) +on: + push: + branches: [claude/compassionate-fermat-9x7vpe] +permissions: + contents: read +jobs: + regen: + runs-on: ubuntu-latest + timeout-minutes: 20 + env: + GH_TOKEN: ${{ github.token }} + STANDARDS_BRANCH: claude/compassionate-fermat-9x7vpe-callee-lock + steps: + - name: Regenerate actions.lock and check closure + run: | + set -uo pipefail + git clone --quiet https://github.com/${{ github.repository }}.git e + git -C e checkout --quiet ${{ github.sha }} + git -C e log --oneline -1 + git clone --quiet --depth 1 --branch "$STANDARDS_BRANCH" https://github.com/metadatastician/standards.git std + git -C std log --oneline -1 + sudo apt-get install -y -qq gawk >/dev/null + gh extension install github/gh-actions-lock --pin v0.2.0 + gh actions-lock --version + export GH_BIN=gh REGEN_TOOLS="$PWD/std/scripts" + cp e/.github/workflows/actions.lock prior.lock + source std/scripts/regen-dependabot-locks.sh + outcome="$(regen_lock "$PWD/e" 2> regen.log || true)" + cat regen.log + echo "OUTCOME=$outcome" + echo "== close-lock moved-tag decisions" + grep -E '^ (~|SKIP|\+) ' regen.log || echo "(none)" + echo "== close-lock --check" + bash std/scripts/close-lock.sh --check e/.github/workflows; echo "CHECK_RC=$?" + echo "== dtolnay records" + grep -A4 "^ 'dtolnay/rust-toolchain@\(e2a55d2\|02cb101\)" e/.github/workflows/actions.lock || echo "(no dtolnay records)" + git -C e status --porcelain + echo "LOCK-SHA256 $(sha256sum < e/.github/workflows/actions.lock | cut -d' ' -f1)" + echo "LOCK-BEGIN" + base64 -w 76 e/.github/workflows/actions.lock + echo "LOCK-END" diff --git a/.github/workflows/zz-probe-moved-tags.yml b/.github/workflows/zz-probe-moved-tags.yml new file mode 100644 index 00000000..9c0f5239 --- /dev/null +++ b/.github/workflows/zz-probe-moved-tags.yml @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: MPL-2.0 +# ONE-OFF, scratch branch only, deleted after use. Live probe for +# hyperpolymath/standards#1350: calls the two reusables whose dtolnay pins no +# current tag names (standards@75bd5994 mirror-reusable -> rust-toolchain@e2a55d2, +# panic-attack@b689a74 scan-and-report -> rust-toolchain@02cb101). No secrets +# are passed, so every mirror push and the cross-repo dispatch skip. The run +# starts only if actions.lock closes over both pins. +name: one-off moved-tag probe +on: + push: + branches: [claude/compassionate-fermat-9x7vpe] +permissions: + actions: read + contents: read +jobs: + mirror: + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-08-04 + scan: + uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@b689a74d2762a1c19839ae3fbd59b7fe5ef920ea # main 2026-10-01 From eb78c47a167727cb28134e6c8ef88a4c823cb5da Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 27 Oct 2026 01:18:29 +0000 Subject: [PATCH 2/4] chore(ci): actions.lock regenerated by standards#1350 (scratch, not for merge) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The lock printed by run 40431258680 (sha256 7ebd16fb…), unedited. close-lock closed both moved-tag pins from the called repositories' own locks: dtolnay/rust-toolchain@e2a55d2 and @02cb101, each with ref: 'v1'. Closure --check and check-lock-sync pass. The probe workflow should now start. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01JHfuPCv1pEiqkQGG5DQASb --- .github/workflows/actions.lock | 34 +++++++++++++++++++++++++++++++++- 1 file changed, 33 insertions(+), 1 deletion(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 7754a808..39144d27 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -105,6 +105,10 @@ workflows: - 'actions/checkout@v7.0.1' - 'hyperpolymath/cicd-suite@4c772eb235b04455307d5c03cbbc4f45130f7f0f' - 'mlugg/setup-zig@v2.2.1' + '.github/workflows/zz-one-off-close-lock.yml': [] + '.github/workflows/zz-probe-moved-tags.yml': + - 'hyperpolymath/panic-attack@b689a74d2762a1c19839ae3fbd59b7fe5ef920ea' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' dependencies: 'Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6': ref: 'v2.9.2' @@ -185,11 +189,21 @@ dependencies: commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' owner_id: 42048915 repo_id: 356423100 + 'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de': + ref: 'v1' + commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de' + owner_id: 1940490 + repo_id: 260749683 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8': ref: 'v1' commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8' owner_id: 1940490 repo_id: 260749683 + 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f': + ref: 'v1' + commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + owner_id: 1940490 + repo_id: 260749683 'dtolnay/rust-toolchain@v1': ref: 'v1' commit: 'sha1-7e38f4b43b4db5c8dd498af069a4f6196df1d067' @@ -244,10 +258,19 @@ dependencies: - 'Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8' + 'hyperpolymath/panic-attack@b689a74d2762a1c19839ae3fbd59b7fe5ef920ea': + ref: 'b689a74d2762a1c19839ae3fbd59b7fe5ef920ea' + commit: 'sha1-b689a74d2762a1c19839ae3fbd59b7fe5ef920ea' + owner_id: 6759885 + repo_id: 1152434997 + uses: + - 'Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de' 'hyperpolymath/standards@3c00687a5bbd0d881d351db8502417b5d0a8b0b0': ref: '3c00687a5bbd0d881d351db8502417b5d0a8b0b0' commit: 'sha1-3c00687a5bbd0d881d351db8502417b5d0a8b0b0' - owner_id: 6759885 + owner_id: 297579217 repo_id: 1116521501 uses: - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' @@ -261,6 +284,15 @@ dependencies: - 'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e' - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6' - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' + 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': + ref: '75bd5994470661a099df562d6d5ad2fe744dbd66' + commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66' + owner_id: 297579217 + repo_id: 1116521501 + uses: + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' 'mlugg/setup-zig@v2.2.1': ref: 'v2.2.1' commit: 'sha1-d1434d08867e3ee9daa34448df10607b98908d29' From 20ea3e230adf92799eecdd707f412cbd8606ebe4 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 27 Oct 2026 01:19:32 +0000 Subject: [PATCH 3/4] chore(ci): split the moved-tag probe from the standards repository move (scratch) On the previous commit the combined probe still failed at startup, but so did every caller of a hyperpolymath/standards reusable on this branch (governance, hypatia-scan, secret-scanner, spark-theatre-gate), including with main's untouched lock. Governance last started on 2026-10-23, before hyperpolymath/standards moved to metadatastician/standards. Two probes now separate the causes: - zz-probe-pa: panic-attack@b689a74 only (dtolnay@02cb101). The repo did not move, so this tests the moved-tag fallback alone. - zz-probe-std-new: mirror-reusable@75bd5994 called under the new name metadatastician/standards (dtolnay@e2a55d2). This commit's lock is not yet regenerated, so both probes are expected to fail at startup here. The regen job prints the lock for the next commit. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01JHfuPCv1pEiqkQGG5DQASb --- .github/workflows/zz-probe-moved-tags.yml | 19 ------------------- .github/workflows/zz-probe-pa.yml | 14 ++++++++++++++ .github/workflows/zz-probe-std-new.yml | 16 ++++++++++++++++ 3 files changed, 30 insertions(+), 19 deletions(-) delete mode 100644 .github/workflows/zz-probe-moved-tags.yml create mode 100644 .github/workflows/zz-probe-pa.yml create mode 100644 .github/workflows/zz-probe-std-new.yml diff --git a/.github/workflows/zz-probe-moved-tags.yml b/.github/workflows/zz-probe-moved-tags.yml deleted file mode 100644 index 9c0f5239..00000000 --- a/.github/workflows/zz-probe-moved-tags.yml +++ /dev/null @@ -1,19 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# ONE-OFF, scratch branch only, deleted after use. Live probe for -# hyperpolymath/standards#1350: calls the two reusables whose dtolnay pins no -# current tag names (standards@75bd5994 mirror-reusable -> rust-toolchain@e2a55d2, -# panic-attack@b689a74 scan-and-report -> rust-toolchain@02cb101). No secrets -# are passed, so every mirror push and the cross-repo dispatch skip. The run -# starts only if actions.lock closes over both pins. -name: one-off moved-tag probe -on: - push: - branches: [claude/compassionate-fermat-9x7vpe] -permissions: - actions: read - contents: read -jobs: - mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-08-04 - scan: - uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@b689a74d2762a1c19839ae3fbd59b7fe5ef920ea # main 2026-10-01 diff --git a/.github/workflows/zz-probe-pa.yml b/.github/workflows/zz-probe-pa.yml new file mode 100644 index 00000000..3fcbb72f --- /dev/null +++ b/.github/workflows/zz-probe-pa.yml @@ -0,0 +1,14 @@ +# SPDX-License-Identifier: MPL-2.0 +# ONE-OFF, scratch branch only, deleted after use. Probe for +# hyperpolymath/standards#1350, separated from the standards repository move: +# panic-attack@b689a74 scan-and-report pins dtolnay/rust-toolchain@02cb101, +# which no current tag names. No secrets, so the cross-repo dispatch skips. +name: one-off moved-tag probe (panic-attack) +on: + push: + branches: [claude/compassionate-fermat-9x7vpe] +permissions: + contents: read +jobs: + scan: + uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@b689a74d2762a1c19839ae3fbd59b7fe5ef920ea # main 2026-10-01 diff --git a/.github/workflows/zz-probe-std-new.yml b/.github/workflows/zz-probe-std-new.yml new file mode 100644 index 00000000..1218afa8 --- /dev/null +++ b/.github/workflows/zz-probe-std-new.yml @@ -0,0 +1,16 @@ +# SPDX-License-Identifier: MPL-2.0 +# ONE-OFF, scratch branch only, deleted after use. Probe for +# hyperpolymath/standards#1350 and the standards repository move: calls +# mirror-reusable@75bd5994 (pins dtolnay/rust-toolchain@e2a55d2, no current +# tag) under the repository's new name, metadatastician/standards. No +# secrets, so every mirror push skips. +name: one-off moved-tag probe (standards, new path) +on: + push: + branches: [claude/compassionate-fermat-9x7vpe] +permissions: + actions: read + contents: read +jobs: + mirror: + uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-08-04 From 286cd5697ba289300f9bce2c90408ed652824b33 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 27 Oct 2026 01:22:25 +0000 Subject: [PATCH 4/4] chore(ci): actions.lock regenerated for the split probes (scratch, not for merge) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The lock printed by run 40431898367 (sha256 4a964a43…), byte-identical. It re-keys the 75bd5994 record to metadatastician/standards and lists both probes. The two moved-tag records (dtolnay@02cb101, @e2a55d2, ref 'v1') came from the prior lock record this time. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01JHfuPCv1pEiqkQGG5DQASb --- .github/workflows/actions.lock | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 39144d27..945664c1 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -106,9 +106,10 @@ workflows: - 'hyperpolymath/cicd-suite@4c772eb235b04455307d5c03cbbc4f45130f7f0f' - 'mlugg/setup-zig@v2.2.1' '.github/workflows/zz-one-off-close-lock.yml': [] - '.github/workflows/zz-probe-moved-tags.yml': + '.github/workflows/zz-probe-pa.yml': - 'hyperpolymath/panic-attack@b689a74d2762a1c19839ae3fbd59b7fe5ef920ea' - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + '.github/workflows/zz-probe-std-new.yml': + - 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' dependencies: 'Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6': ref: 'v2.9.2' @@ -284,7 +285,7 @@ dependencies: - 'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e' - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6' - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': + 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': ref: '75bd5994470661a099df562d6d5ad2fe744dbd66' commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66' owner_id: 297579217