Skip to content

fix(ci): the invisible-character gate never matched anything - #62

Open
hyperpolymath wants to merge 1 commit into
mainfrom
fix/empty-linter-pattern-never-matched
Open

fix(ci): the invisible-character gate never matched anything#62
hyperpolymath wants to merge 1 commit into
mainfrom
fix/empty-linter-pattern-never-matched

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Measured 2026-08-27: this gate caught 0 of 6 invisible-character test cases. It has never detected an NBSP, zero-width space, BOM, soft hyphen, bidi override or word joiner.

Root cause

The pattern used UTF-8 byte sequences (\xc2\xa0) while grep -P matches characters. Bytes c2 a0 are one character U+00A0; \xc2\xa0 asks for two, U+00C2 then U+00A0 — never present.

grep -P '\xc2\xa0'  ->  miss
grep -P '\x{a0}'    ->  MATCH

Only \x00 worked, being single-byte in both readings. The gate ran, passed, and could not see what it exists to see.

Fixed

  • codepoint escapes in place of byte sequences
  • C0 controls \x01-\x08,\x0B,\x0C,\x0E-\x1F added (TAB/LF/CR excluded)
  • grep -a — without it grep skips any NUL-bearing file as binary

The C0 range matters: a stray backspace byte made a workflow unparseable in developer-ecosystem, so it never ran — and this linter called it clean.

Canonical fix: hyperpolymath/empty-linter#70. 1 file(s) here.

Verified: YAML re-parsed, and the corrected pattern was confirmed to catch a real NBSP before the change was kept.

MEASURED 2026-08-27: this gate's pattern caught 0 OF 6 invisible-character test
cases. It has never detected an NBSP, zero-width space, BOM, soft hyphen, bidi
override or word joiner.

ROOT CAUSE: the pattern used UTF-8 BYTE sequences (\xc2\xa0) while grep -P
matches CHARACTERS. Bytes c2 a0 are ONE character U+00A0; \xc2\xa0 asks for TWO
characters, U+00C2 then U+00A0, which is never present.

  grep -P '\xc2\xa0'  ->  miss
  grep -P '\x{a0}'    ->  MATCH

Only \x00 worked, being single-byte in both readings.

FIXED: codepoint escapes; C0 control characters \x01-\x08,\x0B,\x0C,\x0E-\x1F
added (TAB/LF/CR excluded); and grep -a, without which grep skips any NUL-bearing
file as binary.

The C0 range matters: a stray BACKSPACE byte made a workflow unparseable in
developer-ecosystem, so it never ran, and this linter called it clean.

Canonical fix: hyperpolymath/empty-linter#70. 1 file(s) here.
VERIFIED: YAML re-parsed, and the corrected pattern was confirmed to catch a real
NBSP before the change was kept.
@coderabbitai

coderabbitai Bot commented Aug 27, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ffa1fac3-0c37-490f-8098-c0de9d51afb9

📥 Commits

Reviewing files that changed from the base of the PR and between ce01994 and 57ad5da.

📒 Files selected for processing (1)
  • .github/workflows/dogfood-gate.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (2)
  • GitHub Check: Gitar
  • GitHub Check: Codacy Static Code Analysis
⚠️ CI failures not shown inline (20)

GitHub Actions: Dogfood Gate / 1_Validate A2ML manifests.txt: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]A2ML Manifest Validation
 Scanning . for .a2ml files...
 Found 118 .a2ml file(s)
   Validating: ./.github/0.1-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/0.1-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/6a2/AGENTIC.a2ml
   Validating: ./.machine_readable/6a2/ECOSYSTEM.a2ml
   Validating: ./.machine_readable/6a2/META.a2ml
   Validating: ./.machine_readable/6a2/NEUROSYM.a2ml
   Validating: ./.machine_readable/6a2/PLAYBOOK.a2ml
   Validating: ./.machine_readable/6a2/STATE.a2ml
   Validating: ./.machine_readable/CLADE.a2ml
   Validating: ./.machine_readable/ENSAID_CONFIG.a2ml
   Validating: ./.machine_readable/agent_instructions/coverage.a2ml
   Validating: ./.machine_readable/agent_instructions/debt.a2ml
   Validating: ./.machine_readable/agent_instructions/methodology.a2ml
   Validating: ./.machine_readable/ai/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/ai/AI.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/anchors/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/anchors/ANCHOR.a2ml
   Validating: ./.machine_readable/configs/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/contractiles/dust/Dustfile.a2ml
   Validating: ./.machine_readable/contractiles/intend/Intendfile.a2ml
   Validating: ./.machine_readable/contractiles/lust/Intentfile.a2ml
   Validating: ./.machine_readable/contractiles/must/Mustfile.a2ml
   Validating: ./.machine_readable/contractiles/trust/Trustfile.a2ml
   Validating: ./.machine_readable/integrations/feedback-o-tron.a2ml
   Validating: ./.machine_readable/integrations/proven.a2ml
   Validating: ./.machine_readable/integrations/verisimdb.a2ml
   Validating: ./.machine_readable/integrations/vexometer.a2ml
   Validating: ./.machine_readable/policies/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/policies/MAINTENANCE-AXES.a2ml
   Validating: ./.machine_readable/policies/MAINTE...

GitHub Actions: Dogfood Gate / Validate A2ML manifests: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]A2ML Manifest Validation
 Scanning . for .a2ml files...
 Found 118 .a2ml file(s)
   Validating: ./.github/0.1-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/0.1-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/6a2/AGENTIC.a2ml
   Validating: ./.machine_readable/6a2/ECOSYSTEM.a2ml
   Validating: ./.machine_readable/6a2/META.a2ml
   Validating: ./.machine_readable/6a2/NEUROSYM.a2ml
   Validating: ./.machine_readable/6a2/PLAYBOOK.a2ml
   Validating: ./.machine_readable/6a2/STATE.a2ml
   Validating: ./.machine_readable/CLADE.a2ml
   Validating: ./.machine_readable/ENSAID_CONFIG.a2ml
   Validating: ./.machine_readable/agent_instructions/coverage.a2ml
   Validating: ./.machine_readable/agent_instructions/debt.a2ml
   Validating: ./.machine_readable/agent_instructions/methodology.a2ml
   Validating: ./.machine_readable/ai/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/ai/AI.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/anchors/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/anchors/ANCHOR.a2ml
   Validating: ./.machine_readable/configs/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/contractiles/dust/Dustfile.a2ml
   Validating: ./.machine_readable/contractiles/intend/Intendfile.a2ml
   Validating: ./.machine_readable/contractiles/lust/Intentfile.a2ml
   Validating: ./.machine_readable/contractiles/must/Mustfile.a2ml
   Validating: ./.machine_readable/contractiles/trust/Trustfile.a2ml
   Validating: ./.machine_readable/integrations/feedback-o-tron.a2ml
   Validating: ./.machine_readable/integrations/proven.a2ml
   Validating: ./.machine_readable/integrations/verisimdb.a2ml
   Validating: ./.machine_readable/integrations/vexometer.a2ml
   Validating: ./.machine_readable/policies/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/policies/MAINTENANCE-AXES.a2ml
   Validating: ./.machine_readable/policies/MAINTE...

GitHub Actions: Dogfood Gate / 3_Validate eclexiaiser manifest.txt: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run if [ ! -f "eclexiaiser.toml" ]; then
 �[36;1mif [ ! -f "eclexiaiser.toml" ]; then�[0m
 �[36;1m  # Check if repo has a Containerfile — if so, recommend eclexiaiser�[0m
 �[36;1m  if [ -f "Containerfile" ]; then�[0m
 �[36;1m    echo "::warning::Containerfile present but no eclexiaiser.toml. Run \`eclexiaiser init\` to scaffold energy/carbon budgets."�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "has_manifest=false" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mecho "has_manifest=true" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m�[0m
 �[36;1m# Validate TOML structure using Python 3.11+ tomllib�[0m
 �[36;1mpython3 -c "�[0m
 �[36;1mimport tomllib, sys�[0m
 �[36;1mwith open('eclexiaiser.toml', 'rb') as f:�[0m
 �[36;1m    data = tomllib.load(f)�[0m
 �[36;1mproject = data.get('project', {})�[0m
 �[36;1mif not project.get('name', '').strip():�[0m
 �[36;1m    print('ERROR: project.name is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfunctions = data.get('functions', [])�[0m
 �[36;1mif not functions:�[0m
 �[36;1m    print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfor fn in functions:�[0m
 �[36;1m    if not fn.get('name', '').strip():�[0m
 �[36;1m        print('ERROR: function name cannot be empty', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1m    if not fn.get('source', '').strip():�[0m
 �[36;1m        print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1mprint(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')�[0m
 �[36;1m" || {�[0m
 �[36;1m  echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"�[0m

GitHub Actions: Dogfood Gate / Validate eclexiaiser manifest: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run if [ ! -f "eclexiaiser.toml" ]; then
 �[36;1mif [ ! -f "eclexiaiser.toml" ]; then�[0m
 �[36;1m  # Check if repo has a Containerfile — if so, recommend eclexiaiser�[0m
 �[36;1m  if [ -f "Containerfile" ]; then�[0m
 �[36;1m    echo "::warning::Containerfile present but no eclexiaiser.toml. Run \`eclexiaiser init\` to scaffold energy/carbon budgets."�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "has_manifest=false" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mecho "has_manifest=true" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m�[0m
 �[36;1m# Validate TOML structure using Python 3.11+ tomllib�[0m
 �[36;1mpython3 -c "�[0m
 �[36;1mimport tomllib, sys�[0m
 �[36;1mwith open('eclexiaiser.toml', 'rb') as f:�[0m
 �[36;1m    data = tomllib.load(f)�[0m
 �[36;1mproject = data.get('project', {})�[0m
 �[36;1mif not project.get('name', '').strip():�[0m
 �[36;1m    print('ERROR: project.name is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfunctions = data.get('functions', [])�[0m
 �[36;1mif not functions:�[0m
 �[36;1m    print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfor fn in functions:�[0m
 �[36;1m    if not fn.get('name', '').strip():�[0m
 �[36;1m        print('ERROR: function name cannot be empty', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1m    if not fn.get('source', '').strip():�[0m
 �[36;1m        print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1mprint(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')�[0m
 �[36;1m" || {�[0m
 �[36;1m  echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"�[0m

GitHub Actions: Dogfood Gate / 4_Groove manifest check.txt: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Dogfood Gate / Groove manifest check: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Dogfood Gate / 5_Validate K9 contracts.txt: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]K9 Configuration Validation
 Scanning . for K9 files (.k9, .k9.ncl)...
 Found 7 K9 file(s)
   Validating: ./.machine_readable/contractiles/k9/examples/ci-config.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/examples/project-metadata.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/examples/setup-repo.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/template-hunt.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/template-kennel.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/template-yard.k9.ncl
   Validating: ./container/deploy.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'

GitHub Actions: Dogfood Gate / Validate K9 contracts: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]K9 Configuration Validation
 Scanning . for K9 files (.k9, .k9.ncl)...
 Found 7 K9 file(s)
   Validating: ./.machine_readable/contractiles/k9/examples/ci-config.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/examples/project-metadata.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/examples/setup-repo.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/template-hunt.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/template-kennel.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/template-yard.k9.ncl
   Validating: ./container/deploy.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'

GitHub Actions: Governance / 4_governance _ Language _ package anti-pattern policy.txt: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run rule_module="cicd_rules"
 �[36;1mrule_module="cicd_rules"�[0m
 �[36;1mrule_type="banned_language_file"�[0m
 �[36;1mrule="${rule_module}/${rule_type}"�[0m
 �[36;1m�[0m
 �[36;1m# Baseline lookup: returns 0 (exempt) if the file appears in�[0m
 �[36;1m# .hypatia-baseline.json with a matching rule_module + type.�[0m
 �[36;1m# Honours both `file` (exact) and `file_pattern` (glob) entries.�[0m
 �[36;1m# The glob → regex translation mirrors apply-baseline.sh exactly:�[0m
 �[36;1m#   `**` matches any depth (incl. `/`); `*` matches one segment.�[0m
 �[36;1m# Pattern support unblocks language-demo repos (absolute-zero�[0m
 �[36;1m# carries ~30 banned-language example files under `examples/`)�[0m
 �[36;1m# and any repo that vendors such subtrees, replacing per-file�[0m
 �[36;1m# `.hypatia-ignore` enumeration with one `file_pattern` entry.�[0m
 �[36;1min_baseline() {�[0m
 �[36;1m  local target="$1"�[0m
 �[36;1m  [ -f .hypatia-baseline.json ] || return 1�[0m
 �[36;1m  command -v jq >/dev/null 2>&1 || return 1�[0m
 �[36;1m  # Note: the `as $pat` capture is essential — inside `test(...)`�[0m
 �[36;1m  # the dot rebinds to test's input ($f, a string), so�[0m
 �[36;1m  # `.file_pattern` would error with "Cannot index string". We�[0m
 �[36;1m  # capture file_pattern in $pat first, then reference it inside�[0m
 �[36;1m  # the test() argument.�[0m
 �[36;1m  jq -e \�[0m
 �[36;1m    --arg rm "$rule_module" \�[0m
 �[36;1m    --arg rt "$rule_type" \�[0m
 �[36;1m    --arg f  "$target" \�[0m
 �[36;1m    'any(.[];�[0m
 �[36;1m         .rule_module == $rm and .type == $rt�[0m
 �[36;1m         and (�[0m
 �[36;1m           (.file? // null) == $f�[0m
 �[36;1m           or (�[0m
 �[36;1m             (.file_pattern? // null) as $pat�[0m
 �[36;1m             | $pat != null�[0m
 �[36;1m             and ($f | test(�[0m
 �[36;1m               $pat�[0m
 �[36;1m               | gsub("\\*\\*"; "DOUBLESTAR")�[0m
 �[36;1m               | gsub("\\*"; "[^/]*")�[0m
 �[36;1m               | gsub(...

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run rule_module="cicd_rules"
 �[36;1mrule_module="cicd_rules"�[0m
 �[36;1mrule_type="banned_language_file"�[0m
 �[36;1mrule="${rule_module}/${rule_type}"�[0m
 �[36;1m�[0m
 �[36;1m# Baseline lookup: returns 0 (exempt) if the file appears in�[0m
 �[36;1m# .hypatia-baseline.json with a matching rule_module + type.�[0m
 �[36;1m# Honours both `file` (exact) and `file_pattern` (glob) entries.�[0m
 �[36;1m# The glob → regex translation mirrors apply-baseline.sh exactly:�[0m
 �[36;1m#   `**` matches any depth (incl. `/`); `*` matches one segment.�[0m
 �[36;1m# Pattern support unblocks language-demo repos (absolute-zero�[0m
 �[36;1m# carries ~30 banned-language example files under `examples/`)�[0m
 �[36;1m# and any repo that vendors such subtrees, replacing per-file�[0m
 �[36;1m# `.hypatia-ignore` enumeration with one `file_pattern` entry.�[0m
 �[36;1min_baseline() {�[0m
 �[36;1m  local target="$1"�[0m
 �[36;1m  [ -f .hypatia-baseline.json ] || return 1�[0m
 �[36;1m  command -v jq >/dev/null 2>&1 || return 1�[0m
 �[36;1m  # Note: the `as $pat` capture is essential — inside `test(...)`�[0m
 �[36;1m  # the dot rebinds to test's input ($f, a string), so�[0m
 �[36;1m  # `.file_pattern` would error with "Cannot index string". We�[0m
 �[36;1m  # capture file_pattern in $pat first, then reference it inside�[0m
 �[36;1m  # the test() argument.�[0m
 �[36;1m  jq -e \�[0m
 �[36;1m    --arg rm "$rule_module" \�[0m
 �[36;1m    --arg rt "$rule_type" \�[0m
 �[36;1m    --arg f  "$target" \�[0m
 �[36;1m    'any(.[];�[0m
 �[36;1m         .rule_module == $rm and .type == $rt�[0m
 �[36;1m         and (�[0m
 �[36;1m           (.file? // null) == $f�[0m
 �[36;1m           or (�[0m
 �[36;1m             (.file_pattern? // null) as $pat�[0m
 �[36;1m             | $pat != null�[0m
 �[36;1m             and ($f | test(�[0m
 �[36;1m               $pat�[0m
 �[36;1m               | gsub("\\*\\*"; "DOUBLESTAR")�[0m
 �[36;1m               | gsub("\\*"; "[^/]*")�[0m
 �[36;1m               | gsub(...

GitHub Actions: Governance / 5_governance _ Security policy checks.txt: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

GitHub Actions: Governance / governance _ Security policy checks: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

GitHub Actions: Governance / 6_governance _ Well-Known (RFC 9116 + RSR).txt: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m

GitHub Actions: Governance / 8_governance _ Allowlist Preflight.txt: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run rm -rf .standards-checkout
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-actions-policy.sh" \�[0m
 �[36;1m  "$GITHUB_REPOSITORY" "$RUNNER_TEMP/allowed-actions.json"�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GH_***REDACTED_SECRET_ASSIGNMENT***
 gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable. Example:
   env:
     GH_***REDACTED_SECRET_ASSIGNMENT*** github.token }}
 ERROR: could not read live Actions permissions for hyperpolymath/anvomidaviser
 ##[error]Process completed with exit code 1.

GitHub Actions: Governance / governance _ Allowlist Preflight: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run rm -rf .standards-checkout
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-actions-policy.sh" \�[0m
 �[36;1m  "$GITHUB_REPOSITORY" "$RUNNER_TEMP/allowed-actions.json"�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GH_***REDACTED_SECRET_ASSIGNMENT***
 gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable. Example:
   env:
     GH_***REDACTED_SECRET_ASSIGNMENT*** github.token }}
 ERROR: could not read live Actions permissions for hyperpolymath/anvomidaviser
 ##[error]Process completed with exit code 1.

GitHub Actions: Governance / 9_governance _ Workflow security linter.txt: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1mSCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m# Self-hosting fallback: when THIS repository is standards, its own�[0m
 �[36;1m# working tree already holds the script, and during a rename that copy�[0m
 �[36;1m# is the only correct one — the pinned main checkout still has the old�[0m
 �[36;1m# name. Preferring the fetched copy keeps every other caller on the�[0m
 �[36;1m# canonical version.�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f scripts/check-workflow-duplicate-keys.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / governance _ Workflow security linter: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1mSCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m# Self-hosting fallback: when THIS repository is standards, its own�[0m
 �[36;1m# working tree already holds the script, and during a rename that copy�[0m
 �[36;1m# is the only correct one — the pinned main checkout still has the old�[0m
 �[36;1m# name. Preferring the fetched copy keeps every other caller on the�[0m
 �[36;1m# canonical version.�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f scripts/check-workflow-duplicate-keys.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / governance _ Workflow security linter: fix(ci): the invisible-character gate never matched anything

Conclusion: failure

View job details

##[group]Run if [ -f .github/workflows/actions.lock ]; then
 �[36;1mif [ -f .github/workflows/actions.lock ]; then�[0m
 �[36;1m  # The lockfile records transitive dependency evidence, while direct�[0m
 �[36;1m  # workflow references remain visibly SHA-pinned. Keep both layers:�[0m
 �[36;1m  # external analysers and GitHub's sha_pinning_required setting do�[0m
 �[36;1m  # not infer direct pins from actions.lock.�[0m
 �[36;1m  gh extension install github/gh-actions-lock�[0m
 �[36;1m  bash scripts/update-actions-lock.sh --verify-local�[0m
 �[36;1m  unpinned=$(grep -rnE --include='*.yml' --include='*.yaml' \�[0m
 �[36;1m    "^[[:space:]]+uses:" .github/workflows/ | \�[0m
 �[36;1m    grep -v "@[a-f0-9]\{40\}" | \�[0m
 �[36;1m    grep -v "uses: \./\|uses: docker://\|uses: hyperpolymath/standards/" || true)�[0m
 �[36;1m  if [ -n "$unpinned" ]; then�[0m
 �[36;1m    echo "ERROR: direct workflow references not SHA-pinned:"�[0m
 �[36;1m    echo "$unpinned"�[0m
 �[36;1m    exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "Lockfile coverage verified; direct references SHA-pinned"�[0m
 �[36;1melse�[0m
 �[36;1m  unpinned=$(grep -rnE --include='*.yml' --include='*.yaml' \�[0m
 �[36;1m    "^[[:space:]]+uses:" .github/workflows/ | \�[0m
 �[36;1m    grep -v "@[a-f0-9]\{40\}" | \�[0m
 �[36;1m    grep -v "uses: \./\|uses: docker://\|uses: actions/github-script\|uses: hyperpolymath/standards/" || true)�[0m
 �[36;1m  if [ -n "$unpinned" ]; then�[0m
 �[36;1m    echo "ERROR: no .github/workflows/actions.lock in THIS TREE, and these refs are not SHA-pinned."�[0m
 �[36;1m  echo "  Prefer \`gh actions-lock\` — it also locks the transitive dependencies"�[0m
 �[36;1m  echo "  of composite actions, which an inline SHA cannot express."�[0m
 �[36;1m  echo "  Do NOT do both: gh actions-lock refuses a ref no tag or branch contains,"�[0m
 �[36;1m  echo "  so inline pinning REMOVES actions from the lockfile."�[0m
 �[36;1m    echo "$unpinned"�[0m
 �[36;1m    exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "All ...
🔇 Additional comments (2)
.github/workflows/dogfood-gate.yml (2)

135-135: LGTM!


124-124: 🎯 Functional Correctness

No change is required for this finding.

grep -aPrl does not silently omit a leading BOM. GNU grep 3.8 exits with character code point value in \x{} or \o{} is too large for this pattern. The repository also has no Issue #70 establishing the stated requirement.


📝 Walkthrough

Summary by CodeRabbit

  • Bug Fixes
    • Improved detection of invisible and control characters during automated quality checks.
    • Scans now also cover additional non-printing characters and binary-formatted files.

Walkthrough

The workflow updates its invisible-character pattern to use Unicode code points, adds C0 controls and the word joiner, and makes grep scan binary files as text.

Changes

Invisible-character gate correction

Layer / File(s) Summary
Gate pattern and scan update
.github/workflows/dogfood-gate.yml
The pattern uses Unicode code-point escapes, includes selected C0 controls and the word joiner, and places the null-byte match first. The grep command now uses -a to treat binary files as text.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 57ad5

The workflow change is localized to invisible-character matching, and no concrete merge-blocking correctness or deployment risk remains. It is merge-ready after normal checks.

Poem

I’m a rabbit with a tidy gate,
Invisible bytes now meet their fate.
Code points hop in a clearer line,
Binary files join the scan in time.
The workflow checks what it should find.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Linked Issues check ⚠️ Warning The PR implements the codepoint escapes, C0 control range, and grep -a requirements for the CI gate. It does not implement the linked issue's separate leading-BOM check, compiled-linter updates in std… Add the separate byte-wise leading-BOM check, update stdlib/ByteDetector.affine and config.ncl with the matching C0-control logic, and update the other inlined gate copies required by issue #70. Verify all target characters, corrupted workf…
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the main change: fixing the CI invisible-character gate. It is concise and specific.
Description check ✅ Passed The description explains the root cause, implemented changes, and verification results. It does not use the repository headings or include the RSR Quality Checklist, but it contains the key informatio…
Out of Scope Changes check ✅ Passed The two-line change is limited to .github/workflows/dogfood-gate.yml and directly supports the invisible-character gate fix. No unrelated changes are present.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Full details: Description check

Explanation

The description explains the root cause, implemented changes, and verification results. It does not use the repository headings or include the RSR Quality Checklist, but it contains the key information needed to review this small change.

Full details: Linked Issues check

Explanation

The PR implements the codepoint escapes, C0 control range, and grep -a requirements for the CI gate. It does not implement the linked issue's separate leading-BOM check, compiled-linter updates in stdlib/ByteDetector.affine and config.ncl, or estate-wide pattern updates. These are required coding objectives in issue #70.

Resolution

Add the separate byte-wise leading-BOM check, update stdlib/ByteDetector.affine and config.ncl with the matching C0-control logic, and update the other inlined gate copies required by issue #70. Verify all target characters, corrupted workflows, clean files, and legitimate whitespace.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@sonarqubecloud

Copy link
Copy Markdown

@codacy-production

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

Run reviewer

TIP This summary will be updated as you push new changes.

@gitar-bot

gitar-bot Bot commented Aug 27, 2026

Copy link
Copy Markdown

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

Gitar

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant