Repository navigation
fix(preservation): qualify the imported source and retire obsolete effects - #3
Conversation
|
Caution Review failedThe pull request is closed. Summary
Merge Risk:
 |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Add Carrot credits or activate Agent usage billing to use Autofix |
|
CodeRabbit Verify cannot start because this repository is not enabled for PR Verify. Enable PR testing in Verify settings. CodeRabbit Verify can be triggered again using the |
Bind preservation checks to the retained source tree and current head. Add independent provenance and output-validation controls, repair Semgrep upload permissions and Scorecard provisioning, and record finite retention destinations without claiming runtime qualification.
Keep complete security analyses and bind historical findings to exact imported objects. Replace broken policy and scanner callers with checked contracts, document unsupported source honestly, and preserve four obsolete deployment/propagation workflows byte-for-byte as inert records. No forge dispatch, remote history rewrite, or repository archival is performed by this commit.
hyperpolymath
changed the title
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: da16d4c163
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Remove a duplicate TruffleHog --fail argument because the pinned upstream action already supplies it. Scope Hypatia security-events write to its scan job, preserving required read grants. Add seven-day cooldowns to the existing four Dependabot version-update entries. Preserve all historical raw findings and exact-source qualification; no classifier broadening. Validation: actionlint and existing workflow-parser controls; parsed YAML comparison; actual retained SARIF/receipt equality and original import location qualification. Hosted new-head reruns remain required.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d15c5d0805
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…rchives Check secondary SARIF evidence and reject unresolved references before granting a historical disposition. Require immutable job and service container images, state the source-object language boundary precisely, and restore all five archived workflows to their original Git blobs with regression controls.
Use one named constant for the observed Scorecard placeholder while retaining all missing-location and mixed-source rejection controls.
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
❌ The last analysis has failed. |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cb7721c7e5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| permissions: | ||
| contents: read | ||
| actions: read |
There was a problem hiding this comment.
On the newly added pull_request runs for this documented private repository, this permissions block makes issues, pull-requests, and checks unavailable to the default token. The Scorecard action's private-repository guidance says to grant those reads so it can query commits and detect configured SAST tools, otherwise API calls can fail with Resource not accessible by integration; add the documented read permissions so the new PR check produces a complete Scorecard report rather than failing or reporting gaps.
Useful? React with 👍 / 👎.
| # Only this observed repository-level condition has a staging disposition. | ||
| # Missing security policy and every other Scorecard rule remain actionable. | ||
| if [[ "$reporter" == scorecard && "$rule" == FuzzingID ]] && | ||
| jq -e '(.message.text | startswith("score is 0: project is not fuzzed:")) and |
There was a problem hiding this comment.
When Scorecard reports the expected unfuzzed-repository result, its SARIF message starts with score is 0: project is not fuzzed followed by a newline and remediation text, not the colon required here, as shown in the published Scorecard SARIF output. Consequently the sole permitted FuzzingID advisory is always counted as actionable and the Scorecard workflow fails for this intentionally unfuzzed preservation repository; match the actual message boundary and add that real form to the fixture.
Useful? React with 👍 / 👎.
Scope
Preserve the private Poly SSG history, retain useful design material, and make the staging repository's real CI evidence reviewable before closure. The extracted import
9302dfcc3aedb7c52edf2867a2fcbf2c735878b4has the exact original subtree6a8aa93222c8261c3e81b37acd7d1bd59f42bdc4from Polystacke1af43bb102106b08cb694402bd1c04b96f1677c. Preservation verifies ancestry, tree identity and connectivity; it does not claim runtime parity or security qualification.Changes
docs/legacy-workflows/and remove their active effect entrypoints. No forge dispatch, remote history rewriting or repository archival has been performed.docs/RETENTION-PLAN.adocanddocs/WORKFLOW-DISPOSITION.adoc. The public, original comparison notes are separately merged in docs: retain a practical method for comparing SSGs stuff-of-awe/awesome-ssgs#2; private code and results remain private.Validation and closure
Local verification includes 18 preservation/SARIF scenarios, parser controls against floating and spoofed action refs, all 15 remaining workflow contracts, actionlint for modified workflows, Bash syntax and exact archival byte comparisons. Final hosted scans and substantive bot review are required at the current head; prior Semgrep's 313 findings are retained pending actual final disposition, not declared fixed.
Tracked by qualification issue #2 and Polystack preservation blocker #30. This is a preservation and retirement qualification, not a release. Do not merge while CI is disabled or required evidence/reviews remain unresolved.