From 935166def202962d32ffe9bb2adac683a09c48ed Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 27 Jul 2026 21:52:15 +0100 Subject: [PATCH] fix(ci): remove dead rsr-antipattern reusable ref, fix K9 pedigree gap MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three independent CI-blocker fixes bundled together (verified individually, listed by check name): lint-workflows: rsr-antipattern.yml called hyperpolymath/standards/.github/workflows/rsr-antipattern-reusable.yml, which has never existed on that repo (empty result from the commits API filtered on that path; absent from the current rsr-template-repo too). The estate's own docs/audits/audit-reusables-convergence-2026-05-26.adoc confirms `antipattern-check` was retired as part of the "Old rsr-template suite" and its required-status-check context was dropped because "no workflow ever produced" it again. Its function (language/package anti-pattern policy) is already covered by governance.yml -> governance-reusable.yml's language-policy/package-policy jobs, which this repo already runs. No SHA exists to pin against a file that was never committed, so the fix is to delete the dead workflow rather than write an unresolvable pin. Validate K9 contracts: locally reproduced the reported 8 errors / 10 files. 6 of the 8 were a scope bug in the shared k9-ecosystem validate-action (coordination.k9, session/custom-checks.k9, and self-validating/methodology-guard.k9.ncl are not K9 pedigree contracts at all — fixed at the source in hyperpolymath/k9-ecosystem#21, with a local paths-ignore override here as a stopgap since the wrapper pins the action to a commit SHA). The remaining 2 were a genuine defect in container/deploy.k9.ncl: missing the literal `K9!` first line, and its `pedigree` field pointed at a let-bound variable rather than an inline `pedigree = { ... }` block, so the validator's line-based scanner never saw name/version/leash. Fixed by adding the magic line and re-exposing the required fields inline via a Nickel record merge. Latent, non-blocking finding: adding `K9!` as line 1 breaks `nickel typecheck` (the file's own "Usage" comment documents that command). This is NOT new — the existing canonical templates (.machine_readable/self-validating/template-*.k9.ncl) already have this same property and already fail `nickel typecheck` today. No workflow in this repo invokes `nickel typecheck` on `.k9.ncl` files, so nothing is currently gated on it, but it means the whole estate's K9.ncl convention would break instantly if that check were ever wired up. Recorded here for whoever picks that up; out of scope to fix in this PR. openssf-compliance: N/A for bitfuckit — its "Check no unfilled placeholder tokens" step was already passing (its .machine_readable/6a2/ECOSYSTEM.a2ml describes bitfuckit itself, not the template it was scaffolded from). Co-Authored-By: Claude Opus 5 --- .github/workflows/dogfood-gate.yml | 22 ++++++++++++++++++++++ .github/workflows/rsr-antipattern.yml | 15 --------------- container/deploy.k9.ncl | 12 +++++++++++- 3 files changed, 33 insertions(+), 16 deletions(-) delete mode 100644 .github/workflows/rsr-antipattern.yml diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index f195987..17e59f2 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -92,6 +92,28 @@ jobs: with: path: '.' strict: 'false' + # Local override of the action's default paths-ignore, pending + # hyperpolymath/k9-ecosystem# (adds the same three entries to + # the action's own default so wrapper repos won't need this + # override once that PR merges and this pin is refreshed). + # coordination.k9 / session/custom-checks.k9 are the estate-standard + # session-management coordination bindings (plain YAML, unrelated + # to K9 pedigree contracts). methodology-guard.k9.ncl is a K9 + # *validator definition*, not a pedigree target. None of the three + # were ever meant to satisfy the K9!/pedigree schema this action + # checks for. + paths-ignore: | + vendor/ + vendored/ + verified-container-spec/ + .audittraining/ + integration/fixtures/ + test/fixtures/ + tests/fixtures/ + absolute-zero/ + coordination.k9 + session/custom-checks.k9 + self-validating/methodology-guard.k9.ncl - name: Write summary run: | diff --git a/.github/workflows/rsr-antipattern.yml b/.github/workflows/rsr-antipattern.yml deleted file mode 100644 index a2a9656..0000000 --- a/.github/workflows/rsr-antipattern.yml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RSR Anti-Pattern Check - Uses reusable workflow from standards - -name: RSR Anti-Pattern Check -on: - push: - branches: [main, master, develop] - pull_request: - branches: [main, master, develop] -permissions: - contents: read - -jobs: - antipattern-check: - uses: hyperpolymath/standards/.github/workflows/rsr-antipattern-reusable.yml@main diff --git a/container/deploy.k9.ncl b/container/deploy.k9.ncl index 819566f..4be6a85 100644 --- a/container/deploy.k9.ncl +++ b/container/deploy.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # deploy.k9.ncl — bitfuckit deployment component (Hunt level) # @@ -143,7 +144,16 @@ echo "K9: Rollback complete." # Export the component { - pedigree = component_pedigree, + # Re-exposed inline (in addition to the let-bound component_pedigree + # above) so the K9 validator's line-based scanner — which looks for a + # literal `pedigree = { ... name = ...; version = ...; leash = ... }` + # block rather than evaluating Nickel — can see the required fields + # without having to resolve the let-binding indirection. + pedigree = component_pedigree & { + name = "bitfuckit-deploy", + version = "0.1.0", + leash = 'Hunt, + }, deployment = deployment, scripts = scripts,