Skip to content

fix(ci): update reusable workflow SHAs to @7fdc2705df74b4e352d2a1cde3e87a5923fdf329 - #31

Closed
hyperpolymath wants to merge 4 commits into
mainfrom
fix/ci-426-batch12
Closed

fix(ci): update reusable workflow SHAs to @7fdc2705df74b4e352d2a1cde3e87a5923fdf329#31
hyperpolymath wants to merge 4 commits into
mainfrom
fix/ci-426-batch12

Conversation

@hyperpolymath

@hyperpolymath hyperpolymath commented Aug 13, 2026

Copy link
Copy Markdown
Owner

Part of estate-wide standards#426 remediation - Batch 12 SHA update to fix Bug A and Bug B in reusable workflows.


Summary by Gitar

  • CI Workflows:
    • Added .github/workflows/main-estate-audit.yml for central estate CI/CD auditing
    • Updated template placeholders in .github/workflows/dogfood-gate.yml

This will update automatically on new commits.

hyperpolymath and others added 3 commits July 27, 2026 19:39
scaffoldia was scaffolded from rsr-template-repo but never fully
instantiated. Unlike its sibling contractiles, scaffoldia had already been
partially cured in earlier PRs (#16/#17): README.adoc, root SECURITY.md,
and the descriptiles migration (no 6a2/ directory) were already clean.
This closes the remaining gaps.

Placeholder substitution:
- ~420 {{TOKEN}} identity placeholders resolved across ~65 files (AUTHOR,
  AUTHOR_EMAIL, OWNER, REPO, FORGE, PROJECT(_NAME), CURRENT_YEAR/DATE,
  VERSION, LICENSE, CONDUCT_*, SECURITY_EMAIL, PACKAGE_NAME, etc.), derived
  from the repo's own SPDX headers, LICENSE file, and GitHub's own
  description (verified via `gh repo view`).
- Deliberately left alone: container/*, machine-readable-design/{canonical-
  directory-structure,harvested-registry}/, docs-template/,
  .machine_readable/configs/{selur-compose,stapeln}.toml (recurring
  per-service templates, not one-time identity), and validator/mechanism
  files whose job is to literally match "{{PLACEHOLDER}}" as a drift
  detector.
- Fixed the literal (non-{{}}) "rsr-template-repo" self-identity string in
  ~15 files, most notably .machine_readable/contractiles/* (a stale,
  never-updated copy of an earlier root Justfile — root's own doctor/tour/
  help-me recipes already said "scaffoldia"; the contractiles/ copy still
  said "rsr-template-repo"), docs/onboarding/{llm-warmup-dev,llm-warmup-
  user,QUICKSTART-USER}.adoc (never cured, described a nonexistent
  installable end-user app with fabricated `just run`/`just heal`/`just
  setup` commands), build/setup.sh, and a Dogfood Gate footer link that
  pointed at the wrong repo. Left alone genuine references to the real
  upstream rsr-template-repo (pipeline mentions, "clone this to start a
  new project" examples, provenance notes, the groove.just drift detector).
- Fixed a real (non-template) bug in docs/attribution/CITATIONS.adoc: all
  five citation formats linked to "github.com/hyperpolymath/Scaffoldia"
  (capitalised, from {{PROJECT_NAME}}) instead of the actual lowercase
  repo slug.
- Fixed docs/developer/ABI-FFI-README.adoc's Idris2 example, which showed
  "import SCAFFOLDIA.ABI.Foreign" (from {{PROJECT}}) — the real module
  path is "Abi.Foreign" per abi.ipkg; there is no project-name namespace
  prefix.
- Removed a fabricated PGP fingerprint/key from .github/SECURITY.md and
  .well-known/security.txt (confirmed via `curl https://github.com/
  hyperpolymath.gpg` and `gh api users/hyperpolymath/gpg_keys` that no key
  has ever been uploaded) rather than inventing one.

Zig — the hard requirement (src/interface/ffi/src/main.zig had the same
three real Zig 0.16 compile bugs as contractiles, beyond placeholder text):
- `Handle` was `opaque { allocator: ..., initialized: ... }` — opaque types
  cannot have fields; changed to a plain `struct` (still opaque to C
  callers, which only ever see a pointer).
- `callconv(.C)` is not a valid CallingConvention member under Zig 0.16;
  changed to `.c`.
- `std.heap.c_allocator` requires libc; build.zig never linked it.
- build.zig was a no-op stub; rewritten into a real build: a static
  library target (`.link_libc = true`), a test step for main.zig, and a
  second module for test/integration_test.zig that imports main.zig by
  its registered module name ("scaffoldia").
- test/integration_test.zig was a fully-commented-out placeholder; replaced
  with 10 real tests exercising every exported scaffoldia_* function
  (lifecycle, process/process_array incl. null-buffer, strings, version,
  build_info, error handling).

Verified: `zig fmt --check .` exit 0; `zig build` exit 0; `zig build test
--summary all` exit 0, 13/13 tests pass (3 unit + 10 integration);
`idris2 --build abi.ipkg` exit 0; `just --list` exit 0; all workflow YAML
still parses.

Justfile fake-gate recipes replaced with real invocations (build,
build-release, test, test-verbose, test-smoke, e2e, aspect, bench, fmt,
fmt-check, lint, deps, install) or deleted where genuinely unimplementable
(`run`/`run-verbose` — this is a library with no executable; `readiness` —
duplicated crg-grade/crg-badge with no distinct real check). Fixed `clean`,
which previously did `rm -rf ... build/ ...` and would have deleted the
repo's own tracked build/ orchestration directory (build/just/*.just,
build/contractile.just, build/guix.scm) — now targets only build/ttc/,
.zig-cache/, and zig-out/.

tests/e2e.sh (previously fully commented-out) now runs real preflight +
idris2 build + zig build/test, using its existing check/green/red helpers.
benches/template_bench.sh dropped its "Template Validation" and "Template
Instantiation" sections (called the two now-deleted scripts) and kept/
renumbered the real Zig-build/Zig-test/workflow-validation benchmarks;
fixed a pre-existing `rm -rf zig-cache` path bug (real dir is `.zig-cache`).

Deleted template-only machinery: scripts/validate-template.sh,
tests/e2e/template_instantiation_test.sh,
.machine_readable/ai/PLACEHOLDERS.adoc. No workflow referenced them.

Rewrote docs/status/TEST-NEEDS.adoc, which previously narrated the deleted
validate-template.sh's "8-phase validation" as the repo's own feature and
claimed a placeholder Zig test was "PASSING" — now describes the real test
suite and the 13/13 pass count honestly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…e87a5923fdf329

Part of estate-wide standards#426 remediation - Batch 11 SHA update.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
…e87a5923fdf329

Part of estate-wide standards#426 remediation - Batch 12 SHA update.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
@hyperpolymath
hyperpolymath enabled auto-merge (squash) August 13, 2026 03:14
@gitar-bot

gitar-bot Bot commented Aug 13, 2026

Copy link
Copy Markdown

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

Gitar

@sonarqubecloud

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

@hyperpolymath

Copy link
Copy Markdown
Owner Author

Closing auto-generated PR as part of nuclear cleanup. Will be recreated fresh from current state if still needed.

auto-merge was automatically disabled August 14, 2026 04:02

Pull request was closed

@hyperpolymath
hyperpolymath deleted the fix/ci-426-batch12 branch August 18, 2026 12:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant