chore: fill or remove RSR template placeholders

[hyperpolymath]

openssf-compliance.yml fails when any of the thirteen files it checks still contains a {{PLACEHOLDER}} token. This clears them, with no invention.

• Deleted the TEMPLATE INSTRUCTIONS (delete this block before publishing) comment — the template says to delete it, and it is where every legend line lived, so a large share of the reported tokens were the file documenting its own placeholders.
• Filled what the repository itself supplies: owner and repo from the git remote, project name, year, forge, main branch, contact email.
• Removed PGP and website lines. https://github.com/<user>.gpg returns HTTP 200 for every account; with no key uploaded the body is a stub reading "This user hasn't uploaded any GPG keys". No key is published for either account, and commit signing here is SSH — unrelated. The template sanctions this: "Optional: Remove sections that don't apply (e.g. PGP if you don't use it)."\n\nA security policy telling a researcher to encrypt to a key that does not exist is worse than one that does not mention encryption.\n\nWhere applicable, this also fixes a misrouted advisory URL. A previous just init copied already-filled templates out of squisher-corpus, so 51 repositories directed vulnerability reports to hyperpolymath/squisher-corpus — a repository unrelated to the code being reported, meaning the affected maintainer never saw them. Repointed from this repository's own git remote.

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

CI failed: CI failures in contract and manifest validation jobs caused by missing K9 magic numbers/pedigree names and missing A2ML identity fields introduced during template placeholder cleanups.

Overview

CI encountered validation failures in two separate workflow jobs ("Validate K9 contracts" and "Validate A2ML manifests") due to missing required fields and magic numbers in template files following placeholder updates.

Failures

K9 Contract Validation Failure (confidence: high)

• Type: test
• Affected jobs: 90327280027
• Related to change: yes
• Root cause: The validation script .githooks/validate-k9.sh failed because .machine_readable/svc/k9/template-hunt.k9.ncl is missing the required 'K9!' magic number on its first non-empty line and lacks the 'name' field in its pedigree block.
• Suggested fix: Update .machine_readable/svc/k9/template-hunt.k9.ncl to include 'K9!' as the first non-empty line and add the required 'name' field to the pedigree block.

A2ML Manifest Validation Failure (confidence: high)

• Type: test
• Affected jobs: 90327280124
• Related to change: yes
• Root cause: The validation script .githooks/validate-a2ml.sh found 1 error across 106 scanned .a2ml files due to a missing required identity field (agent-id, name, or project).
• Suggested fix: Identify which .a2ml manifest file is missing its identity field and add the required agent-id, name, or project field.

Summary

• Change-related failures: 2 validation failures (K9 contracts and A2ML manifests) caused by missing mandatory metadata fields after placeholder modifications.
• Infrastructure/flaky failures: 0
• Recommended action: Update the affected K9 contract and A2ML manifest files to supply the missing required fields and magic numbers.

Code Review 🚫 Blocked 0 resolved / 1 findings

Fills and removes RSR template placeholders to satisfy OpenSSF compliance checks, but the estate-wide security compliance workflow introduces invalid YAML where actions: read is nested under the scalar permissions: read-all.

🚨 Bug: Invalid YAML: 'actions: read' nested under scalar 'permissions: read-all'

📄 .github/workflows/codeql.yml 📄 .github/workflows/dogfood-gate.yml 📄 .github/workflows/governance.yml 📄 .github/workflows/hypatia-scan.yml 📄 .github/workflows/instant-sync.yml 📄 .github/workflows/mirror.yml 📄 .github/workflows/push-email-notify.yml 📄 .github/workflows/release.yml 📄 .github/workflows/rhodibot.yml 📄 .github/workflows/scorecard.yml 📄 .github/workflows/secret-scanner.yml 📄 .github/workflows/static-analysis-gate.yml

permissions: read-all is a scalar value; the added line actions: read is indented beneath it, which is not valid YAML (you cannot attach a mapping key to a scalar). This makes the workflow file unparseable and the workflow will fail to load. The same one-line change is applied identically to all 13 workflow files, breaking each. To grant read-all plus an explicit scope, use the mapping form, e.g. permissions: on its own line followed by contents: read and actions: read, or drop the read-all scalar. Note also this permissions: key sits at column 0 outside the job, so it does not apply to the trigger-boj job as intended.

Replace the `read-all` scalar with an explicit permissions mapping so the added `actions: read` scope is valid YAML.

permissions:
  contents: read
  actions: read

🤖 Prompt for agents

Code Review: Fills and removes RSR template placeholders to satisfy OpenSSF compliance checks, but the estate-wide security compliance workflow introduces invalid YAML where `actions: read` is nested under the scalar `permissions: read-all`.

1. 🚨 Bug: Invalid YAML: 'actions: read' nested under scalar 'permissions: read-all'
   Files: .github/workflows/codeql.yml, .github/workflows/dogfood-gate.yml, .github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/instant-sync.yml, .github/workflows/mirror.yml, .github/workflows/push-email-notify.yml, .github/workflows/release.yml, .github/workflows/rhodibot.yml, .github/workflows/scorecard.yml, .github/workflows/secret-scanner.yml, .github/workflows/static-analysis-gate.yml

   `permissions: read-all` is a scalar value; the added line `  actions: read` is indented beneath it, which is not valid YAML (you cannot attach a mapping key to a scalar). This makes the workflow file unparseable and the workflow will fail to load. The same one-line change is applied identically to all 13 workflow files, breaking each. To grant read-all plus an explicit scope, use the mapping form, e.g. `permissions:` on its own line followed by `  contents: read` and `  actions: read`, or drop the `read-all` scalar. Note also this `permissions:` key sits at column 0 outside the job, so it does not apply to the `trigger-boj` job as intended.

   Fix (Replace the `read-all` scalar with an explicit permissions mapping so the added `actions: read` scope is valid YAML.):
   permissions:
     contents: read
     actions: read

Tip

Comment Gitar fix CI to trigger a fix.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}