From 48c437abfddf6c484edf6551043bd50c4e04f4be Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 29 Aug 2026 14:29:03 +0100 Subject: [PATCH 1/4] fix(ci): lock reusable workflow dependencies --- .github/workflows/actions.lock | 34 +++++++++++++++++++++++++++++----- 1 file changed, 29 insertions(+), 5 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 841130e..3de1a14 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -13,21 +13,27 @@ workflows: '.github/workflows/ffi-seams.yml': - 'actions/checkout@v7.0.1' - 'mlugg/setup-zig@v2.2.1' - '.github/workflows/governance.yml': [] - '.github/workflows/hypatia-scan.yml': [] + '.github/workflows/governance.yml': + - 'hyperpolymath/standards@6b38eb50104901e2fec80f9455a972bc3eced813' + '.github/workflows/hypatia-scan.yml': + - 'hyperpolymath/standards@6b38eb50104901e2fec80f9455a972bc3eced813' '.github/workflows/instant-sync.yml': - 'peter-evans/repository-dispatch@v4.0.1' '.github/workflows/label-triage.yml': [] '.github/workflows/labels.yml': [] - '.github/workflows/mirror.yml': [] + '.github/workflows/mirror.yml': + - 'hyperpolymath/standards@6b38eb50104901e2fec80f9455a972bc3eced813' '.github/workflows/push-email-notify.yml': - 'dawidd6/action-send-mail@v18' '.github/workflows/rust-ci.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' + - 'hyperpolymath/standards@6b38eb50104901e2fec80f9455a972bc3eced813' - 'swatinem/rust-cache@v2.9.2' - '.github/workflows/scorecard.yml': [] - '.github/workflows/secret-scanner.yml': [] + '.github/workflows/scorecard.yml': + - 'hyperpolymath/standards@6b38eb50104901e2fec80f9455a972bc3eced813' + '.github/workflows/secret-scanner.yml': + - 'hyperpolymath/standards@6b38eb50104901e2fec80f9455a972bc3eced813' '.github/workflows/status-gate.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' @@ -53,6 +59,24 @@ dependencies: commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' owner_id: 9919 repo_id: 259445878 + 'hyperpolymath/standards@6b38eb50104901e2fec80f9455a972bc3eced813': + ref: '6b38eb50104901e2fec80f9455a972bc3eced813' + commit: 'sha1-6b38eb50104901e2fec80f9455a972bc3eced813' + owner_id: 6759885 + repo_id: 1116521501 + uses: + - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' + - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' + - 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' + - 'editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c' + - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' + - 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' + - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406' + - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' + - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' 'mlugg/setup-zig@v2.2.1': ref: 'v2.2.1' commit: 'sha1-d1434d08867e3ee9daa34448df10607b98908d29' From 0f21e3045ba75f9147a0a061887d1ca840e8320a Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 29 Aug 2026 14:34:14 +0100 Subject: [PATCH 2/4] fix(ci): complete reusable transitive lock graph --- .github/workflows/actions.lock | 60 ++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 3de1a14..8ee34fc 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -77,6 +77,66 @@ dependencies: - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' + 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9': + ref: '55cc8345863c7cc4c66a329aec7e433d2d1c52a9' + commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' + owner_id: 44036562 + repo_id: 215566462 + 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': + ref: '3d3c42e5aac5ba805825da76410c181273ba90b1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a': + ref: '043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' + commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' + owner_id: 44036562 + repo_id: 192625955 + 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed': + ref: 'v2.0.5' + commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' + owner_id: 42048915 + repo_id: 356423100 + 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772': + ref: '6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' + commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772' + owner_id: 1940490 + repo_id: 260749683 + 'editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c': + ref: 'v2.2.0' + commit: 'sha1-840e866d93b8e032123c23bac69dece044d4d84c' + owner_id: 26415196 + repo_id: 297874902 + 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124': + ref: '54075bcc5e249e4758d363f27d099f55d843f124' + commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' + owner_id: 47606891 + repo_id: 331103973 + 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28': + ref: 'v4.37.8' + commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' + owner_id: 9919 + repo_id: 259445878 + 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406': + ref: 'v2.2.1' + commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406' + owner_id: 1006268 + repo_id: 212984112 + 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': + ref: 'v2.4.4' + commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' + owner_id: 67707773 + repo_id: 421101922 + 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6': + ref: '6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + owner_id: 580492 + repo_id: 298565987 + 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555': + ref: 'e83874834305fe9a4a2997156cb26c5de65a8555' + commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555' + owner_id: 135788 + repo_id: 208510314 'mlugg/setup-zig@v2.2.1': ref: 'v2.2.1' commit: 'sha1-d1434d08867e3ee9daa34448df10607b98908d29' From 1bce5114ea67f7fd2a04f4f67dbfb4fb115653ff Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 29 Aug 2026 14:43:05 +0100 Subject: [PATCH 3/4] fix(ci): repin reusable workflows to verified standard --- .github/workflows/actions.lock | 18 +++++++++--------- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 7 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 8ee34fc..5e36ce1 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -14,26 +14,26 @@ workflows: - 'actions/checkout@v7.0.1' - 'mlugg/setup-zig@v2.2.1' '.github/workflows/governance.yml': - - 'hyperpolymath/standards@6b38eb50104901e2fec80f9455a972bc3eced813' + - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd' '.github/workflows/hypatia-scan.yml': - - 'hyperpolymath/standards@6b38eb50104901e2fec80f9455a972bc3eced813' + - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd' '.github/workflows/instant-sync.yml': - 'peter-evans/repository-dispatch@v4.0.1' '.github/workflows/label-triage.yml': [] '.github/workflows/labels.yml': [] '.github/workflows/mirror.yml': - - 'hyperpolymath/standards@6b38eb50104901e2fec80f9455a972bc3eced813' + - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd' '.github/workflows/push-email-notify.yml': - 'dawidd6/action-send-mail@v18' '.github/workflows/rust-ci.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' - - 'hyperpolymath/standards@6b38eb50104901e2fec80f9455a972bc3eced813' + - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd' - 'swatinem/rust-cache@v2.9.2' '.github/workflows/scorecard.yml': - - 'hyperpolymath/standards@6b38eb50104901e2fec80f9455a972bc3eced813' + - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd' '.github/workflows/secret-scanner.yml': - - 'hyperpolymath/standards@6b38eb50104901e2fec80f9455a972bc3eced813' + - 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd' '.github/workflows/status-gate.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' @@ -59,9 +59,9 @@ dependencies: commit: 'sha1-db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28' owner_id: 9919 repo_id: 259445878 - 'hyperpolymath/standards@6b38eb50104901e2fec80f9455a972bc3eced813': - ref: '6b38eb50104901e2fec80f9455a972bc3eced813' - commit: 'sha1-6b38eb50104901e2fec80f9455a972bc3eced813' + 'hyperpolymath/standards@571cc734cd69fb846032ec77a662aa8ee4fc32cd': + ref: '571cc734cd69fb846032ec77a662aa8ee4fc32cd' + commit: 'sha1-571cc734cd69fb846032ec77a662aa8ee4fc32cd' owner_id: 6759885 repo_id: 1116521501 uses: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 6455f45..fd42d2b 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -15,4 +15,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@6b38eb50104901e2fec80f9455a972bc3eced813 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 52662fa..989347a 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -18,4 +18,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6b38eb50104901e2fec80f9455a972bc3eced813 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 3fe9bb8..9262384 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -13,5 +13,5 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@6b38eb50104901e2fec80f9455a972bc3eced813 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd secrets: inherit diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 3a8d198..f61a218 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -31,7 +31,7 @@ concurrency: jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@6b38eb50104901e2fec80f9455a972bc3eced813 + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd no-default-features: name: Cargo build + test (ephapax-cli, --no-default-features) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 9fd37c8..a04c47e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -17,4 +17,4 @@ jobs: contents: read security-events: write id-token: write - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@6b38eb50104901e2fec80f9455a972bc3eced813 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 29c25f1..084d51a 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -21,5 +21,5 @@ jobs: contents: read pull-requests: write actions: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@6b38eb50104901e2fec80f9455a972bc3eced813 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd secrets: inherit From 3d69f0519223f612d33043abf46b772c9faad02c Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 29 Aug 2026 14:44:10 +0100 Subject: [PATCH 4/4] style(ci): group summary output --- .github/workflows/rust-ci.yml | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index f61a218..4ecfca6 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -66,11 +66,13 @@ jobs: - name: Write summary if: always() run: | - echo "## --no-default-features build" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo "Proves the typed-wasm-verify feature is genuinely optional:" >> "$GITHUB_STEP_SUMMARY" - echo "ephapax-cli builds + tests with zero git dep on the" >> "$GITHUB_STEP_SUMMARY" - echo "hyperpolymath/typed-wasm repo." >> "$GITHUB_STEP_SUMMARY" + { + echo "## --no-default-features build" + echo "" + echo "Proves the typed-wasm-verify feature is genuinely optional:" + echo "ephapax-cli builds + tests with zero git dep on the" + echo "hyperpolymath/typed-wasm repo." + } >> "$GITHUB_STEP_SUMMARY" wasm-validate: name: wasm-tools validate (emitted modules) @@ -106,8 +108,10 @@ jobs: - name: Write summary if: always() run: | - echo "## wasm-tools validate" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo "Every module ephapax emits for the fixture corpus passes" >> "$GITHUB_STEP_SUMMARY" - echo "wasm-tools validate (structural validity gate), including" >> "$GITHUB_STEP_SUMMARY" - echo "the hypatia bridge.eph integration target." >> "$GITHUB_STEP_SUMMARY" + { + echo "## wasm-tools validate" + echo "" + echo "Every module ephapax emits for the fixture corpus passes" + echo "wasm-tools validate (structural validity gate), including" + echo "the hypatia bridge.eph integration target." + } >> "$GITHUB_STEP_SUMMARY"