ci: vendor validation scripts and remove remote action pins

[hyperpolymath]

Automated PR to fix CI after deleted actions.

[gitar-bot]

CI failed: CI validation failed due to an unaddressed A2ML manifest missing required identity fields and a K9 contract file missing the 'K9!' magic number and pedigree metadata.

Overview

A total of 2 unique validation job failures occurred during the CI run: one in A2ML manifest validation and another in K9 contract validation. Both failures are directly related to the repository's vendored validation scripts checking manifest and contract formats.

Failures

A2ML Manifest Validation Failure (confidence: high)

• Type: test
• Affected jobs: 90125134919
• Related to change: yes
• Root cause: The file .github/0.1-AI-MANIFEST.a2ml lacks required identity fields (agent-id, name, or project) required by .githooks/validate-a2ml.sh.
• Suggested fix: Add the required identity fields (agent-id, name, or project) to .github/0.1-AI-MANIFEST.a2ml.

K9 Contract Validation Failure (confidence: high)

• Type: test
• Affected jobs: 90125134924
• Related to change: yes
• Root cause: The K9 contract file ./.machine_readable/contractiles/k9/template-hunt.k9.ncl is missing the required 'K9!' magic number on its first non-empty line and/or lacks a valid 'name' field in its pedigree block.
• Suggested fix: Ensure the first non-empty line of ./.machine_readable/contractiles/k9/template-hunt.k9.ncl is exactly K9! and populate the required pedigree metadata fields.

Summary

• Change-related failures: 2 validation script failures (A2ML manifest and K9 contract format errors)
• Infrastructure/flaky failures: 0
• Recommended action: Update .github/0.1-AI-MANIFEST.a2ml and ./.machine_readable/contractiles/k9/template-hunt.k9.ncl to satisfy the vendored validation checks introduced or enforced by the PR.

Code Review ✅ Approved 2 resolved / 2 findings

Vendors validation scripts and removes remote action pins to fix CI. Consider addressing the trailing newline skip and single-space normalization limitations in the shell script parsing logic.

Auto-approved: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria.

✅ 2 resolved

✅ Edge Case: Last line skipped when file lacks trailing newline

📄 .githooks/validate-k9.sh:122-131 📄 .githooks/validate-k9.sh:141-150 📄 .githooks/validate-k9.sh:169-183 📄 .githooks/validate-a2ml.sh:102-111 📄 .githooks/validate-a2ml.sh:128-142 📄 .githooks/validate-a2ml.sh:239-253 📄 .githooks/validate-a2ml.sh:270-280
All the while IFS= read -r line; do ... done < "$file" loops silently drop the final line of any file that does not end in a newline (confirmed: a 3-line file with no trailing newline yields only 2 reads). A K9 pedigree's closing brace, name/leash field, or an A2ML identity/version line placed on an unterminated last line would go unvalidated, producing false passes. Guard the loops with the standard idiom, e.g. while IFS= read -r line || [[ -n "$line" ]]; do.

✅ Bug: normalise_level trims only one leading/trailing space

📄 .githooks/validate-k9.sh:95-108 📄 .githooks/validate-k9.sh:224-228 📄 .githooks/validate-k9.sh:262-275
${raw## } and ${raw%% } use a single-space glob pattern, so they strip exactly one space, not a run of spaces. A leash value written with extra spacing (e.g. leash = "hunt") leaves a leading space in security_level_value, so the comparison against kennel/yard/hunt fails and a valid file is reported as an invalid security level (and the hunt-signature check is bypassed). Use a whitespace-class trim such as raw="${raw#"${raw%%[![:space:]]*}"}"; raw="${raw%"${raw##*[![:space:]]}"}" (the same idiom already used for paths-ignore) instead of the single-space strips.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Gitar has auto-approved this PR (configure)