Skip to content

fix(ci): repair 4 soft-gate workflow validation errors (FR-001) #640

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KooshaPari merged 4 commits into from
Aug 5, 2026
Merged

fix(ci): repair 4 soft-gate workflow validation errors (FR-001) #640

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6cbb81e
fix(ci): repair 4 soft-gate workflows failing workflow validation (sa…
KooshaPari Aug 5, 2026
f485d8e
fix(ci): add types to scorecard branch_protection_rule trigger
KooshaPari Aug 5, 2026
0826a4a
fix(ci): repair Mergify config - drop invalid post_merge, fix author …
KooshaPari Aug 5, 2026
9be992c
fix(ci): minimal valid mergify config (quoted check names, drop inval…
KooshaPari Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/hermetic-soft.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ name: Hermetic build (soft)

on:
pull_request:
branches: [main]
push:
branches: [main]
workflow_dispatch:
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/sast.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@ jobs:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: github/codeql-action/init-action@v4
- uses: github/codeql-action/init@v4
with:
languages: [typescript, python, rust, go]

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

actionlint .github/workflows/sast.yml

Repository: KooshaPari/sharecli

Length of output: 386

Use a scalar for the languages input.

languages: [typescript, python, rust, go] is invalid because the CodeQL initialization input expects a scalar. The workflow will fail validation unless this is rendered as a comma-separated string instead.

Proposed fix 
-          languages: [typescript, python, rust, go]
+          languages: "typescript,python,rust,go"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
languages: [typescript, python, rust, go]
languages: "typescript,python,rust,go"
🧰 Tools
🪛 actionlint (1.7.12)

[error] 14-14: expected scalar node for string value but found sequence node with "!!seq" tag

(syntax-check)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/sast.yml at line 14, Update the CodeQL initialization
configuration’s languages input to use a scalar comma-separated string
containing typescript, python, rust, and go instead of a YAML list.

Source: Linters/SAST tools

- uses: github/codeql-action/autobuild
- uses: github/codeql-action/analyze
- uses: github/codeql-action/autobuild@v4
- uses: github/codeql-action/analyze@v4
Comment on lines +12 to +16

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

file=.github/workflows/sast.yml

if rg -n 'github/codeql-action/(init|autobuild|analyze)`@v`[0-9]+([[:space:]]|$)' "$file"; then
  echo "Mutable CodeQL action references found." >&2
  exit 1
fi

for action in init autobuild analyze; do
  rg -n "github/codeql-action/${action}@[0-9a-f]{40}([[:space:]]|$)" "$file"
done

Repository: KooshaPari/sharecli

Length of output: 343

🌐 Web query:

github/codeql-action v4 current release commit SHA

💡 Result:

As of August 5, 2026, the current release of the github/codeql-action is v4.37.6 [1]. The commit SHA associated with the v4.37.6 release tag is 5595ccaf912efad79be6eef63a5619ff05969be3 [2].

Citations:

🌐 Web query:

"5595ccaf912efad79be6eef63a5619ff05969be3" codeql action v4.37.6

💡 Result:

The identifier 5595ccaf912efad79be6eef63a5619ff05969be3 corresponds to a specific commit hash within the official GitHub CodeQL Action repository (github/codeql-action) [1]. This commit is associated with the release of version v4.37.6 of the CodeQL Action [1][2]. The CodeQL Action is a GitHub Action used for running semantic code analysis to identify security vulnerabilities [3]. Version v4.37.6 is part of the v4 release line, which is built on the Node.js 24 runtime [3][4]. GitHub currently recommends users migrate to v4, as v3 is scheduled for deprecation in December 2026 [5][4].

Citations:

Security Misconfiguration (CWE-829): Inclusion of Functionality from Untrusted Control Sphere

Pin CodeQL actions to immutable commit SHAs.

.github/workflows/sast.yml:12-16 uses mutable github/codeql-action/(init|autobuild|analyze)@v4`` refs. An upstream tag retarget can make this workflow execute unreviewed action code. Replace these refs with full commit SHAs.

🧰 Tools
🪛 actionlint (1.7.12)

[error] 14-14: expected scalar node for string value but found sequence node with "!!seq" tag

(syntax-check)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/sast.yml around lines 12 - 16, Update the CodeQL workflow
steps using github/codeql-action/init, github/codeql-action/autobuild, and
github/codeql-action/analyze so each `@v4` reference is replaced with the
corresponding full immutable commit SHA, preserving the existing action versions
and configuration.

3 changes: 1 addition & 2 deletions .github/workflows/scorecard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ name: OpenSSF Scorecard

on:
branch_protection_rule:
types: [created, edited, deleted]
schedule:
- cron: '25 4 * * 1' # Weekly Monday 4:25 UTC
push:
Expand All @@ -20,8 +21,6 @@ jobs:
analysis:
name: Scorecard analysis
runs-on: ubuntu-latest
security:
permissions: read-all

steps:
- name: Checkout
Expand Down
3 changes: 0 additions & 3 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,6 @@ permissions:
contents: read
actions: read

env:


jobs:
# Secret Scanning
secrets:
Expand Down
32 changes: 16 additions & 16 deletions .mergify.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,9 @@ pull_request_rules:
conditions:
- "#review-requested=0"
- "#approved-reviews-by>=1"

@kilo-code-bot kilo-code-bot Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WARNING: Missing #review-requested=0 condition

The auto-merge rule no longer blocks merging when review requests are pending. A PR can now auto-merge even after someone requests a review from another person, potentially merging unreviewed code.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

- check-success=ci
- check-success=lint
- check-success=typecheck
- check-success=test
- check-success=ci / lint
- check-success=ci / test
- check-success=coverage
- -conflict
- -closed
actions:
Expand All @@ -20,14 +19,14 @@ pull_request_rules:
{{ title }} (#{{ number }})

Co-authored-by: {{ author }}
post_merge:
action: close
delete_head_branch: {}

# Auto-merge dependabot/Renovate PRs when CI passes
- name: Auto-merge dependency updates
conditions:
- author=dependabot[bot] | renovate[bot]
- check-success=ci
- author~=^(dependabot\[bot\]|renovate\[bot\])$
- check-success=ci / lint
- check-success=ci / test
- -conflict
- -closed
actions:
Expand All @@ -37,20 +36,21 @@ pull_request_rules:
{{ title }} (#{{ number }})

Co-authored-by: {{ author }}
post_merge:
action: close
delete_head_branch: {}

# Auto-merge bot PRs (CI configs, formatting) when CI passes
- name: Auto-merge bot housekeeping PRs
conditions:
- author=trunk-io[bot] | mergify[bot] | github-actions[bot]
- check-success=ci
- check-success=lint
- author~=^(trunk-io\[bot\]|mergify\[bot\]|github-actions\[bot\])$
- check-success=ci / lint
- check-success=ci / test
- -conflict
- -closed
actions:
merge:
method: squash
commit_message_template: |
{{ title }} (#{{ number }})

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Repository files matching .mergify.yml:\n'
git ls-files | grep -F '.mergify.yml' || true

if [ -f .mergify.yml ]; then
  printf '\n.mergify.yml lines 1-140:\n'
  cat -n .mergify.yml | sed -n '1,140p'
fi

printf '\nSearch for delete_head_branch and merge action definitions in Mergify config files:\n'
rg -n "delete_head_branch|actions:|merge:|delete_head_branch" .mergify.yml 2>/dev/null || true

Repository: KooshaPari/sharecli

Length of output: 4885

Add head-branch deletion to the housekeeping rule.

The automatic-merge rules already delete head branches, but the bot housekeeping rule only defines merge. Add delete_head_branch: {} inside its actions block so merged housekeeping PRs do not leave branches behind.

Proposed fix 
     actions:
       merge:
         method: squash
         commit_message_template: |
           {{ title }} (#{{ number }})
+      delete_head_branch: {}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
actions:
merge:
method: squash
commit_message_template: |
{{ title }} (#{{ number }})
actions:
merge:
method: squash
commit_message_template: |
{{ title }} (#{{ number }})
delete_head_branch: {}
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.mergify.yml around lines 49 - 53, Update the housekeeping rule’s actions
block in .mergify.yml to add the delete_head_branch action alongside merge,
using an empty configuration object so merged housekeeping pull requests delete
their head branches.


# Add reviewers based on changed paths
- name: Request review from team
Expand Down Expand Up @@ -128,9 +128,9 @@ pull_request_rules:
conditions:
- -closed
- -draft
- check-success=ci
- check-success=lint
- check-success=test
- check-success=ci / lint
- check-success=ci / test
- check-success=coverage
- "#approved-reviews-by>=1"
actions:
label:
Expand Down
Loading