Skip to content

CI integrity M2: swap the required actionlint step to kjanat/actionlint v1.17.0 (hosted parity 25/25) - #476

Merged
seathatflowsinourveins merged 5 commits into
mainfrom
claude/actionlint-kjanat-swap-20260928
Sep 29, 2026
Merged

CI integrity M2: swap the required actionlint step to kjanat/actionlint v1.17.0 (hosted parity 25/25)#476
seathatflowsinourveins merged 5 commits into
mainfrom
claude/actionlint-kjanat-swap-20260928

Conversation

@seathatflowsinourveins

@seathatflowsinourveins seathatflowsinourveins commented Sep 29, 2026

Copy link
Copy Markdown
Collaborator

Scope

This PR carries out step 3 of integrity plan move M2. The required validate job's actionlint step moves from rhysd/actionlint 1.7.12 to kjanat/actionlint v1.17.0, and the non-required actionlint-successor trial job added in #449 is removed.

  • Lane: lane:foundation. It changes no shared hot file's content; manifests/evidence.json is only re-registered.
  • .github/workflows/validate.yml: the required step uses the trial job's download → sha256 → -version → -color pattern. The verifier confirmed the run block is equal apart from the directory name. The trial job is deleted.
  • catalog-freshness.yml pin row, catalogs/foundation/automation.json actionlint entry and the docs/github-automation.md install and attestation procedure all move to kjanat 1.17.0. Three present-tense statements that "the pinned actionlint rejects queue" are reworded as dated statements; behaviour is unchanged.
  • New receipt: evidence/artifacts/actionlint-successor-swap-20260928/. It records hosted parity, a fresh attestation check and the local negative control, with the fixture kept as text.
  • Not changed: observability/grand-dashboard/state.json, which is a shared hot file; its row update is a separate lane:shared PR. The sealed ci-supply-chain landscape verdict (catalogs/landscape/foundation.json layers[11]) still names rhysd and changes only through a sealed re-record (F-LT-1). Dated records stay as written.

SOTA sources

Evidence-class table

Evidence Class Result
Hosted parity hosted-observed 25 of 25 validate.yml push runs on main, b60d518 → f021926. The required rhysd step and the kjanat trial job both succeeded in every run. The verifier re-sampled 5 runs, and GPT-6 matched all 25 against GitHub.
Attestation upstream-unchanged The asset sha256 matches, and gh attestation verify -R kjanat/actionlint exits 0. The same archive checked with -R rhysd/actionlint exits 1 (404), so the check discriminates.
Lint at head upstream-unchanged kjanat 1.17.0 on the 20 workflows: 0 diagnostics, with and without shellcheck 0.9.0-1.
Negative control our-integration fixtures/nc.yml.txt: zizmor exits 0; kjanat exits 1 with property "missing" is not defined, with and without shellcheck.
Unit and registry checks our-integration See below.

Still pending, as the receipt says: this PR's hosted run, which the checks below close; a hosted negative control, not run because it would need --no-verify or a test edit; evidence that the hosted shellcheck rule ran; and the PyYAML parser cross-check.

Local commands run

  • python3 -m unittest tests.test_workflow_hardening tests.test_catalog_freshness_pins tests.test_adoption_docs_consistency tests.test_catalog_freshness_propose: exit 0, OK (skipped=3).
  • python3 scripts/validate.py: exit 0, "receipts": 165, "status": "passed". component_matrix.py --check and new_host_grand_list.py --check both exit 0.
  • The three pre-push registry tests: exit 0, 3 OK.
  • Failing first: with only validate.yml swapped, tests.test_catalog_freshness_pins fails with '1.7.12' != '1.17.0', and passes after the pin row changes.

Decision record

Plan move M2 (the integrity plan) authorizes the swap once the hosted job matches the local zero-difference result, per the automation.json selection note from #449. The overturn condition: rhysd resumes releases, or GitHub ships an official workflow linter CLI. Either candidate is compared by the 2026-09-27 parity method before the pin changes.

Host evidence

None needed. This is a CI gate change, and the hosted evidence is GitHub's.

Checklist

  • Review loop: an independent Claude verifier (8/8 claims confirmed) and an evidence-reviewer (4 low findings) ran. So did a GPT-6 cross-family review (codex exec -s read-only -m gpt-6-astra -c model_reasoning_effort=max), which returned MERGE with no findings. The one repair round addressed all four low findings in 399020a0.
  • Main was merged in (348d3163), and the hot-file registration is the last commit.

🤖 Generated with Claude Code

Scout and others added 5 commits September 28, 2026 20:38
Scout @claude
validate: swap the required actionlint step to kjanat/actionlint v1.1…
b5bf953 
…7.0 (M2 step 3)

The required validate job's actionlint step now downloads kjanat/actionlint
v1.17.0 with the trial job's URL, pinned digest, sha256sum --check, extract
and -version/-color pattern, still after zizmor, and the non-required
actionlint-successor trial job is removed. The job keeps the workflow-level
contents: read, harden-runner in audit mode first and persist-credentials:
false.

On every push run of validate.yml on main from b60d518 (#449) through
f021926 (#469), 25 of 25, the trial job and the rhysd 1.7.12 step both
succeeded (actionlint exit 0: no diagnostics). A fresh local run of the
documented procedure verified the archive digest, the release checksums file
and gh attestation verify -R kjanat/actionlint (exit 0; a wrong-repository
control exits 1), and 1.17.0 reports 0 diagnostics on this branch's 20
workflows with and without shellcheck 0.9.0-1.

catalog-freshness.yml's pin row, automation.json's actionlint interface
(six lines, 2026-09-27 note kept as history) and docs/github-automation.md's
install and attestation procedure (same line count) follow the pin. The
present-tense claims that the pinned actionlint rejects concurrency `queue`
are reworded as dated statements; no behaviour changes, and the propose-job
concurrency assertion is unchanged.

Receipt: evidence/artifacts/actionlint-successor-swap-20260928/.

SOTA sources: kjanat/actionlint v1.17.0 (immutable release; annotated tag
2da2ceb4 -> commit 08bb2c4f; SLSA provenance signed by
.github/workflows/release.yml@refs/tags/v1.17.0; docs/install.md lines
124-134, docs/usage.md lines 275-284, CHANGELOG.md lines 13 and 238),
rhysd/actionlint v1.7.12 (docs/usage.md lines 181-190), zizmor 1.30.1
(.github/requirements-ci.txt).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Scout @claude
evidence: register the actionlint successor swap receipt
a37fb70 
Register the two new receipt files and re-register validate.yml,
catalog-freshness.yml, automation.json, docs/github-automation.md and
tests/test_catalog_freshness_propose.py through host_receipts.register_file,
per the docs/lanes.md hot-file protocol (shared hot file in the branch's last
commit). As in #449, the receipt is hash-listed in files[] with no receipts[]
entry. component_matrix.py --check and new_host_grand_list.py --check passed
unchanged, so neither --write ran; python3 scripts/validate.py exits 0.

SOTA sources: docs/lanes.md hot-file protocol; scripts/host_receipts.py
register_file; precedent b60d518 (#449).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Scout @claude
actionlint swap receipt: record the local negative control, narrow it…
399020a 
…em 1, date the procedure's rhysd-era results (review repair)

- receipt/README: local_negative_control (fixture fixtures/nc.yml.txt, zizmor 0, kjanat exit 1 with and without shellcheck);
  trial item 1 is closed except the shellcheck sub-claim; hosted negative control and hosted shellcheck evidence stay pending,
  with the reason (no --no-verify, no test edit); dated-records citation widened to docs/catalog-provenance.md L133-189.
- docs/github-automation.md: one appended sentence (no new line) dating the 2026-09-20/21 results to rhysd v1.7.12's procedure.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Scout
Merge remote-tracking branch 'origin/main' into claude/actionlint-kja…
348d316 
…nat-swap-20260928
Scout @claude
Hot-file registration after merging main (docs/lanes.md protocol): re…
93432f2 
…-register the 8 changed paths

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
@seathatflowsinourveins seathatflowsinourveins added the lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers label Sep 29, 2026
@seathatflowsinourveins
seathatflowsinourveins merged commit 94894f5 into main Sep 29, 2026
25 checks passed
@seathatflowsinourveins
seathatflowsinourveins deleted the claude/actionlint-kjanat-swap-20260928 branch September 29, 2026 02:01
@seathatflowsinourveins seathatflowsinourveins mentioned this pull request Sep 29, 2026
Merged
seathatflowsinourveins added a commit that referenced this pull request Sep 29, 2026
@seathatflowsinourveins Scout @claude
Grand dashboard: integrity-lane rows after #476 (actionlint M2 swappe…
76183fc 
…d, CodeQL M4 retitled, skills-trial window row) (#478)

Changes only foundation gate rows in the shared hot file state.json (lane:shared, trading ack needed);
bumps recorded_at_utc and re-registers state.json.

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@seathatflowsinourveins