Skip to content

fix(ci): repair 4 soft-gate workflow validation errors (FR-001) #640

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KooshaPari merged 4 commits into from
Aug 5, 2026
Merged

fix(ci): repair 4 soft-gate workflow validation errors (FR-001) #640

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6cbb81e
fix(ci): repair 4 soft-gate workflows failing workflow validation (sa…
KooshaPari Aug 5, 2026
f485d8e
fix(ci): add types to scorecard branch_protection_rule trigger
KooshaPari Aug 5, 2026
0826a4a
fix(ci): repair Mergify config - drop invalid post_merge, fix author …
KooshaPari Aug 5, 2026
9be992c
fix(ci): minimal valid mergify config (quoted check names, drop inval…
KooshaPari Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/hermetic-soft.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ name: Hermetic build (soft)

on:
pull_request:
branches: [main]
push:
branches: [main]
workflow_dispatch:
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/sast.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@ jobs:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: github/codeql-action/init-action@v4
- uses: github/codeql-action/init@v4
with:
languages: [typescript, python, rust, go]

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

actionlint .github/workflows/sast.yml

Repository: KooshaPari/sharecli

Length of output: 386

Use a scalar for the languages input.

languages: [typescript, python, rust, go] is invalid because the CodeQL initialization input expects a scalar. The workflow will fail validation unless this is rendered as a comma-separated string instead.

Proposed fix 
-          languages: [typescript, python, rust, go]
+          languages: "typescript,python,rust,go"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
languages: [typescript, python, rust, go]
languages: "typescript,python,rust,go"
🧰 Tools
🪛 actionlint (1.7.12)

[error] 14-14: expected scalar node for string value but found sequence node with "!!seq" tag

(syntax-check)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/sast.yml at line 14, Update the CodeQL initialization
configuration’s languages input to use a scalar comma-separated string
containing typescript, python, rust, and go instead of a YAML list.

Source: Linters/SAST tools

- uses: github/codeql-action/autobuild
- uses: github/codeql-action/analyze
- uses: github/codeql-action/autobuild@v4
- uses: github/codeql-action/analyze@v4
Comment on lines +12 to +16

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

file=.github/workflows/sast.yml

if rg -n 'github/codeql-action/(init|autobuild|analyze)`@v`[0-9]+([[:space:]]|$)' "$file"; then
  echo "Mutable CodeQL action references found." >&2
  exit 1
fi

for action in init autobuild analyze; do
  rg -n "github/codeql-action/${action}@[0-9a-f]{40}([[:space:]]|$)" "$file"
done

Repository: KooshaPari/sharecli

Length of output: 343

🌐 Web query:

github/codeql-action v4 current release commit SHA

💡 Result:

As of August 5, 2026, the current release of the github/codeql-action is v4.37.6 [1]. The commit SHA associated with the v4.37.6 release tag is 5595ccaf912efad79be6eef63a5619ff05969be3 [2].

Citations:

🌐 Web query:

"5595ccaf912efad79be6eef63a5619ff05969be3" codeql action v4.37.6

💡 Result:

The identifier 5595ccaf912efad79be6eef63a5619ff05969be3 corresponds to a specific commit hash within the official GitHub CodeQL Action repository (github/codeql-action) [1]. This commit is associated with the release of version v4.37.6 of the CodeQL Action [1][2]. The CodeQL Action is a GitHub Action used for running semantic code analysis to identify security vulnerabilities [3]. Version v4.37.6 is part of the v4 release line, which is built on the Node.js 24 runtime [3][4]. GitHub currently recommends users migrate to v4, as v3 is scheduled for deprecation in December 2026 [5][4].

Citations:

Security Misconfiguration (CWE-829): Inclusion of Functionality from Untrusted Control Sphere

Pin CodeQL actions to immutable commit SHAs.

.github/workflows/sast.yml:12-16 uses mutable github/codeql-action/(init|autobuild|analyze)@v4`` refs. An upstream tag retarget can make this workflow execute unreviewed action code. Replace these refs with full commit SHAs.

🧰 Tools
🪛 actionlint (1.7.12)

[error] 14-14: expected scalar node for string value but found sequence node with "!!seq" tag

(syntax-check)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/sast.yml around lines 12 - 16, Update the CodeQL workflow
steps using github/codeql-action/init, github/codeql-action/autobuild, and
github/codeql-action/analyze so each `@v4` reference is replaced with the
corresponding full immutable commit SHA, preserving the existing action versions
and configuration.

3 changes: 1 addition & 2 deletions .github/workflows/scorecard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ name: OpenSSF Scorecard

on:
branch_protection_rule:
types: [created, edited, deleted]
schedule:
- cron: '25 4 * * 1' # Weekly Monday 4:25 UTC
push:
Expand All @@ -20,8 +21,6 @@ jobs:
analysis:
name: Scorecard analysis
runs-on: ubuntu-latest
security:
permissions: read-all

steps:
- name: Checkout
Expand Down
3 changes: 0 additions & 3 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,6 @@ permissions:
contents: read
actions: read

env:


jobs:
# Secret Scanning
secrets:
Expand Down
140 changes: 8 additions & 132 deletions .mergify.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,138 +1,14 @@
# Mergify Configuration — Optimized for multi-language monorepos
# Docs: https://docs.mergify.com/

pull_request_rules:
# Auto-merge when all CI checks pass and PR is approved
- name: Auto-merge when approved + CI green
- name: auto-merge when approved and required checks green
conditions:
- "#review-requested=0"
- "#approved-reviews-by>=1"

@kilo-code-bot kilo-code-bot Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WARNING: Missing #review-requested=0 condition

The auto-merge rule no longer blocks merging when review requests are pending. A PR can now auto-merge even after someone requests a review from another person, potentially merging unreviewed code.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

- check-success=ci
- check-success=lint
- check-success=typecheck
- check-success=test
- -conflict
- -closed
- "check-success=ci / lint"
- "check-success=ci / test"
- "check-success=coverage"
- "-conflict"
- "-closed"
- "-draft"
actions:
merge:
method: squash

@kilo-code-bot kilo-code-bot Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SUGGESTION: Missing commit_message_template in merge action

The custom squash commit message template was removed. Auto-merged PRs will now use Mergify's default commit message format instead of the previous format that included the PR title, number, and co-author attribution.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

commit_message_template: |
{{ title }} (#{{ number }})

Co-authored-by: {{ author }}
post_merge:
action: close

# Auto-merge dependabot/Renovate PRs when CI passes
- name: Auto-merge dependency updates
conditions:
- author=dependabot[bot] | renovate[bot]
- check-success=ci
- -conflict
- -closed
actions:
merge:
method: squash
commit_message_template: |
{{ title }} (#{{ number }})

Co-authored-by: {{ author }}
post_merge:
action: close

# Auto-merge bot PRs (CI configs, formatting) when CI passes
- name: Auto-merge bot housekeeping PRs
conditions:
- author=trunk-io[bot] | mergify[bot] | github-actions[bot]
- check-success=ci
- check-success=lint
- -conflict
- -closed
actions:
merge:
method: squash

# Add reviewers based on changed paths
- name: Request review from team
conditions:
- -closed
- -draft
actions:
request_reviews:
teams:
- phenotype/core
github_accounts:
- KooshaPari

# Label PRs based on changed files
- name: Label Python changes
conditions:
- files~=\.py$
actions:
label:
add:
- python

- name: Label Rust changes
conditions:
- files~=\.rs$|Cargo\.
actions:
label:
add:
- rust

- name: Label Go changes
conditions:
- files~=\.go$|go\.
actions:
label:
add:
- go

- name: Label TypeScript changes
conditions:
- files~=\.ts$|\.tsx$|package\.json
actions:
label:
add:
- typescript

# Close stale PRs after 30 days
- name: Close stale PRs
conditions:
- -closed
- -draft
- age>=30d
- "#review-requested=0"
actions:
comment:
message: >
This PR has been automatically closed after 30 days of inactivity.
Feel free to reopen if still relevant.
close: {}

# Warn on large PRs
- name: Warn on large PRs
conditions:
- -closed
- -draft
- "#files>20"
actions:
comment:
message: >
**Large PR Alert**: This PR touches {{ number }} files.
Consider splitting into smaller PRs for easier review.

# Add ready-to-merge label when all checks pass
- name: Add ready-to-merge label
conditions:
- -closed
- -draft
- check-success=ci
- check-success=lint
- check-success=test
- "#approved-reviews-by>=1"
actions:
label:
add:
- ready-to-merge
delete_head_branch: {}
Loading