Repository navigation
ci: repin the standards reusables to metadatastician/standards - #352
Merged
Merged
Conversation
The standards repository moved from hyperpolymath to metadatastician between 2026-10-25 and 2026-10-26. Since then every workflow that calls a standards reusable has failed at startup with zero jobs: the scheduled Scorecard, and Governance and Secret Scanner on PRs. Workflows that call nothing in standards (CodeQL, Hypatia, Agda) still run. choreographic-types failed the same way on the same day, on an unchanged commit and the same pin. Fix: - Point the four `uses:` lines at metadatastician/standards, keeping the same commit (75bd5994). - Move the actions.lock record to the new owner: the key, the four workflow entries, and owner_id 297579217. repo_id is unchanged, since a transfer keeps the repository id. gh actions-lock is not available here, so the lock record was edited by hand. This PR's own Governance and Secret Scanner runs are the test. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV
Contributor
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update standards workflow references .github/workflows/governance.yml, .github/workflows/mirror.yml, .github/workflows/scorecard.yml, .github/workflows/secret-scanner.yml |
The four workflows now use metadatastician/standards for their reusable workflow references. The governance comment also names this repository. Workflow paths and pinned commit SHAs remain unchanged. |
Priority:
Estimated code review effort: 1 (Trivial) | ~4 minutes
Change: Bug fix
Possibly related issues
hyperpolymath/reposystem#319— This change updates four standards workflow references, which overlaps with the issue’s caller-reference objective. The supplied summary does not indicate changes to lock records or startup behaviour.
Merge Risk: 
4e97e
-
No actionable merge-blocking risk remains in this workflow-reference update.
Pre-merge checks: 
-
Check name Status Explanation Title check The title clearly identifies the main change: updating the standards reusable-workflow references to metadatastician/standards. Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Description check The description states the problem (the standards repository moved from hyperpolymath to metadatastician, and workflows calling its reusables fail at startup with zero jobs). It names the affected wor… Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)
Full details: Description check
-
Explanation
The description states the problem (the standards repository moved from hyperpolymath to metadatastician, and workflows calling its reusables fail at startup with zero jobs). It names the affected workflows, the repin to metadatastician/standards at commit 75bd5994, the actions.lock edits, and the separate Actions allowlist cause. It is specific and directly related to the changeset, so it passes.
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
🔍 Hypatia Security ScanFindings: 38 issues detected
View findings[
{
"reason": "Required file missing",
"type": "missing",
"file": "0-AI-MANIFEST.a2ml",
"level": "epi",
"action": "create",
"rule_module": "root_hygiene",
"severity": "high",
"evidence": [
{
"span": {
"file": "0-AI-MANIFEST.a2ml",
"end_line": 0,
"start_line": 0
},
"rule": "root_hygiene/missing",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": ".github/workflows/label-triage.yml",
"level": "epi",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "triage",
"evidence": [
{
"span": {
"file": ".github/workflows/label-triage.yml",
"end_line": 0,
"start_line": 0
},
"rule": "workflow_audit/missing_timeout_minutes",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": ".github/workflows/labels.yml",
"level": "epi",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "sync",
"evidence": [
{
"span": {
"file": ".github/workflows/labels.yml",
"end_line": 0,
"start_line": 0
},
"rule": "workflow_audit/missing_timeout_minutes",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"line": 39,
"reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
"type": "RE001",
"file": ".github/workflows/labels.yml",
"level": "epi",
"action": "report",
"rule_module": "research_extensions",
"severity": "medium",
"evidence": [
{
"span": {
"file": ".github/workflows/labels.yml",
"end_line": 39,
"start_line": 39
},
"rule": "research_extensions/RE001",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"line": 53,
"reason": "job in .github/workflows/label-triage.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
"type": "RE001",
"file": ".github/workflows/label-triage.yml",
"level": "epi",
"action": "report",
"rule_module": "research_extensions",
"severity": "medium",
"evidence": [
{
"span": {
"file": ".github/workflows/label-triage.yml",
"end_line": 53,
"start_line": 53
},
"rule": "research_extensions/RE001",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"line": 87,
"reason": "job in .github/workflows/hypatia-scan.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
"type": "RE001",
"file": ".github/workflows/hypatia-scan.yml",
"level": "epi",
"action": "report",
"rule_module": "research_extensions",
"severity": "medium",
"evidence": [
{
"span": {
"file": ".github/workflows/hypatia-scan.yml",
"end_line": 87,
"start_line": 87
},
"rule": "research_extensions/RE001",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"line": 46,
"reason": "job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
"type": "RE001",
"file": ".github/workflows/push-email-notify.yml",
"level": "epi",
"action": "report",
"rule_module": "research_extensions",
"severity": "medium",
"evidence": [
{
"span": {
"file": ".github/workflows/push-email-notify.yml",
"end_line": 46,
"start_line": 46
},
"rule": "research_extensions/RE001",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"line": 34,
"reason": "workflow .github/workflows/labels.yml:34 job `sync` has no `timeout-minutes:` — defaults to 360 min on hang",
"type": "WH006",
"file": ".github/workflows/labels.yml",
"level": "epi",
"action": "report",
"rule_module": "workflow_hardening",
"severity": "medium",
"evidence": [
{
"span": {
"file": ".github/workflows/labels.yml",
"end_line": 34,
"start_line": 34
},
"rule": "workflow_hardening/WH006",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"line": 48,
"reason": "workflow .github/workflows/label-triage.yml:48 job `triage` has no `timeout-minutes:` — defaults to 360 min on hang",
"type": "WH006",
"file": ".github/workflows/label-triage.yml",
"level": "epi",
"action": "report",
"rule_module": "workflow_hardening",
"severity": "medium",
"evidence": [
{
"span": {
"file": ".github/workflows/label-triage.yml",
"end_line": 48,
"start_line": 48
},
"rule": "workflow_hardening/WH006",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"line": null,
"reason": "workflow .github/workflows/hypatia-scan.yml uploads SARIF to code scanning but masks the scanner's failure (`|| true` / `|| echo 0`) and never asserts the findings artefact is a non-empty array. When the scanner fails, this uploads a SARIF with zero results, and GitHub AUTO-CLOSES every previously-open alert for that category — silently, with the job green.",
"type": "WH014",
"file": ".github/workflows/hypatia-scan.yml",
"level": "epi",
"action": "report",
"rule_module": "workflow_hardening",
"severity": "high",
"evidence": [
{
"span": {
"file": ".github/workflows/hypatia-scan.yml",
"end_line": 0,
"start_line": 0
},
"rule": "workflow_hardening/WH014",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Owner
Author
|
Governance and Secret Scanner still fail at startup on this head ( With the repin, both runs now resolve their workflow names, so the reusables are found. GitHub then refuses them before any job starts. Cause: the repository runs Actions on the The fix is outside this PR and needs admin rights:
After that, re-running these two checks should show them starting jobs. No re-run is useful before then. Generated by Claude Code |
hyperpolymath
enabled auto-merge (squash)
October 26, 2026 18:20
hyperpolymath
disabled auto-merge
October 26, 2026 19:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The standards repository moved from
hyperpolymathtometadatasticianbetween 2026-10-25 and 2026-10-26. Both names now resolve to the same HEAD (ecf80c5). Since then every workflow here that calls a standards reusable has failed at startup with zero jobs:Workflows that call nothing in standards (CodeQL, Hypatia, Agda) still run. choreographic-types failed the same way the same morning, on an unchanged commit and pin.
Two causes; this PR fixes the in-repo one
uses:path. Runs on the oldhyperpolymath/standards/...path fail before GitHub even reads the workflow name. This PR repins tometadatastician/standardsat the same commit (75bd5994). With the new path, the runs now resolve their names (Governance,Secret Scanner).allowed_actions=selected. The canonical allowlist (config/settings/actions-allowlist.jsonin standards) hashyperpolymath/*but nometadatastician/*, so the moved workflows are refused before any job starts.scripts/set-allowed-actions.shin standards describes exactly that symptom. This is a repository setting, outside this PR. It needsmetadatastician/*added to the canonical allowlist and then applied withset-allowed-actions.sh(owner, admin rights).Changes
governance.yml,secret-scanner.yml,scorecard.yml,mirror.yml:uses:now points atmetadatastician/standards, keeping the same commit.actions.lock: the standards record moves to the new owner. That covers the dependency key, the four workflow entries, andowner_id297579217 (was 6759885).repo_idis unchanged, since a transfer keeps the repository id. This was edited by hand becausegh actions-lockis not available here; running it on this branch would confirm the record.Testing
🤖 Generated with Claude Code
https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV