From db466ba0b28c023b01434e41879ec9727eda5693 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 1 Jul 2026 22:40:38 +0100 Subject: [PATCH 1/2] fix(panicbot): rename colon-named findings file + fail-loud filename guard MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Panicbot Sweep failed 3 consecutive weekly runs (06-14/06-21/06-28): actions/upload-artifact rejects ':' in paths, and one legacy file (shared-context/findings/indieweb2-bastion/2026-02-14T00:00:00Z.json — the only colon path in the tree) failed the whole sweep's artifact upload. The writer (scripts/submit-finding.sh) already emits colon-free names (%Y%m%d-%H%M%S), so the file is residue from an older path, not a live writer bug — renamed to 2026-02-14T00-00-00Z.json. Added a fail-loud pre-upload guard that names any future offender instead of letting the upload step fail cryptically (fail loudly; the guard points at the writer). Co-Authored-By: Claude Fable 5 --- .github/workflows/panicbot-sweep.yml | 15 +++++++++++++++ ...4T00:00:00Z.json => 2026-02-14T00-00-00Z.json} | 0 2 files changed, 15 insertions(+) rename shared-context/findings/indieweb2-bastion/{2026-02-14T00:00:00Z.json => 2026-02-14T00-00-00Z.json} (100%) diff --git a/.github/workflows/panicbot-sweep.yml b/.github/workflows/panicbot-sweep.yml index 236897c0..29fc3b61 100644 --- a/.github/workflows/panicbot-sweep.yml +++ b/.github/workflows/panicbot-sweep.yml @@ -107,6 +107,21 @@ jobs: echo "- **Mode**: ${{ inputs.mode || 'advisor' }}" >> "$GITHUB_STEP_SUMMARY" echo "- **Scope**: ${{ inputs.scope || 'all' }}" >> "$GITHUB_STEP_SUMMARY" + # upload-artifact rejects ':' in paths; a single legacy colon-named file + # failed the whole sweep for 3 consecutive weeks. The writer + # (scripts/submit-finding.sh) already emits colon-free names — this guard + # fails LOUDLY (naming the offender) if any regressed writer reintroduces + # one, instead of the upload step failing cryptically. + - name: Guard — no artifact-illegal filenames + if: always() + run: | + BAD=$(find shared-context/findings -name '*:*' -print) + if [ -n "$BAD" ]; then + echo "::error::Colon-named findings file(s) break artifact upload — fix the writer, then rename:" + echo "$BAD" + exit 1 + fi + - name: Upload findings artifact if: always() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 diff --git a/shared-context/findings/indieweb2-bastion/2026-02-14T00:00:00Z.json b/shared-context/findings/indieweb2-bastion/2026-02-14T00-00-00Z.json similarity index 100% rename from shared-context/findings/indieweb2-bastion/2026-02-14T00:00:00Z.json rename to shared-context/findings/indieweb2-bastion/2026-02-14T00-00-00Z.json From 8a80ba50457d091c6d2fa55f3e83ef51cf9b1ccb Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 7 Jul 2026 16:11:02 +0100 Subject: [PATCH 2/2] fix(ci): estate-wide structural CI fixes - grant secret-scanner reusable its requested job permissions - drop invalid timeout-minutes on reusable-call jobs - drop hashFiles() from job-level if: expressions --- .github/workflows/governance.yml | 1 - .github/workflows/hypatia-scan.yml | 1 - .github/workflows/mirror.yml | 1 - .github/workflows/scorecard.yml | 1 - .github/workflows/secret-scanner.yml | 5 ++++- 5 files changed, 4 insertions(+), 5 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 6246c3b3..1f28b5de 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -32,4 +32,3 @@ permissions: jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@e9c8888769a703924cc3c0d717900960d78aea00 # main 2026-06-27 - timeout-minutes: 30 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 769e4195..900904ba 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -32,5 +32,4 @@ jobs: # Total caller-side wall-clock cap for the reusable. Matches # Hypatia's `missing_timeout_minutes` rule expectation. The scan is # typically ~3 min; the cap leaves headroom for slow estate builds. - timeout-minutes: 30 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 00f335ca..fe6f7afd 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -13,4 +13,3 @@ jobs: mirror: uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e9c8888769a703924cc3c0d717900960d78aea00 secrets: inherit - timeout-minutes: 60 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index a66954ea..6800d4ac 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -17,4 +17,3 @@ jobs: id-token: write uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e9c8888769a703924cc3c0d717900960d78aea00 secrets: inherit - timeout-minutes: 20 diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 0078829f..5dc265c0 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -15,6 +15,9 @@ permissions: jobs: scan: + permissions: + contents: read + pull-requests: write + actions: read uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@e9c8888769a703924cc3c0d717900960d78aea00 secrets: inherit - timeout-minutes: 20