From 323979cbc48b27c632c183853a7c05f53389bc42 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 28 Jul 2026 16:48:17 +0100 Subject: [PATCH] fix(ci): green the 8-week ClusterFuzzLite red, correct a 2-major-version pin comment, re-key a stale audit path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Four independent hygiene fixes, each measured rather than assumed. **ClusterFuzzLite batch fuzzing has failed every week since at least 2026-06-07** (06-07, 06-14, 06-21, 06-28, 07-05, 07-12, 07-19, 07-26). It is `schedule:`-triggered, so it never appeared on the main-branch push board and the 2026-07-21 sweep — which measured push-on-main only — did not see it. The `address` leg passes; the `undefined` leg dies at "Build Fuzzers (undefined)" with: cargo fuzz build --release --sanitizer=undefined fuzz_octad_id error: invalid value 'undefined' for '--sanitizer ' [possible values: address, leak, memory, thread, none] cargo-fuzz has no UBSan option, so this combination can never work for a Rust project. `cflite_pr.yml` was already corrected to `[address]`; the batch variant was missed. Dropping `undefined` is the honest fix — `thread`/`leak` are valid for Rust and can be added deliberately later. **The CodeQL pin comment was wrong by two major versions.** The pinned SHA e4fba868 is real and is upstream tag **v4.37.3**, but both `uses:` lines annotated it `# v3.28.1`. A pin comment that misstates the version defeats the audit purpose of SHA pinning, since reviewers read the comment, not the hash. Note for the record: an unpushed local commit proposed re-pinning these to 29b1f65c1f735799893313399435a59f54045865. That SHA **does not exist** in github/codeql-action (the API returns 422), so it was dropped rather than salvaged. **A stale audit key was re-firing the only High-severity finding in the scan.** `audits/assail-classifications.a2ml` keyed `connectors/clients/rescript/src/VeriSimVql.res`; the VCL rename moved that file to `VeriSimVcl.res` and the classification never followed, so its `UnsafeDeserialization` finding was unsuppressed. Every classification key in the file now resolves to an existing path. **push-email-notify.yml removed** per the estate ruling that retains push-email only in 007, robodog-defensive-systems-lab and defensive-multiplicity. It was already `disabled_manually` and no variable or secret references it. Also adds local-noise entries to `.gitignore` (db files, caches, agent worktrees, export/build outputs). Deliberately does **not** ignore `.editorconfig`: it is tracked, annotated in `REUSE.toml`, and checked by the governance `quality` job's editorconfig-checker. Verified: `reuse lint` 775/775 compliant, zero unused licences; `tests/doc-consonance-gate.sh` passes; both edited workflows parse as YAML. The one `validate-a2ml.sh` error on this file is **pre-existing on origin/main** — byte-identical output with and without this change. --- .github/workflows/cflite_batch.yml | 9 ++++++- .github/workflows/codeql.yml | 4 +-- .github/workflows/push-email-notify.yml | 33 ------------------------- .gitignore | 16 ++++++++++++ audits/assail-classifications.a2ml | 2 +- 5 files changed, 27 insertions(+), 37 deletions(-) delete mode 100644 .github/workflows/push-email-notify.yml diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml index abeb145..9b7eefe 100644 --- a/.github/workflows/cflite_batch.yml +++ b/.github/workflows/cflite_batch.yml @@ -14,7 +14,14 @@ jobs: strategy: fail-fast: false matrix: - sanitizer: [address, undefined] + # `undefined` is NOT a valid cargo-fuzz sanitizer. cargo-fuzz accepts + # only address/leak/memory/thread/none, so the UBSan leg failed at + # "Build Fuzzers (undefined)" every week from at least 2026-06-07 to + # 2026-07-26 with: + # error: invalid value 'undefined' for '--sanitizer ' + # It is schedule-triggered, so it never showed on the main-branch + # board. cflite_pr.yml was already corrected; this file was missed. + sanitizer: [address] steps: - name: Build Fuzzers (${{ matrix.sanitizer }}) id: build diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 38339e9..c61745b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -39,12 +39,12 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.28.1 + uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.28.1 + uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml deleted file mode 100644 index 2a95f5d..0000000 --- a/.github/workflows/push-email-notify.yml +++ /dev/null @@ -1,33 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dormant push-email notification. ARMED by setting the repo variable -# PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; -# sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by -# new repos from the template; placed on existing repos by the farm sweep. -name: Push email notification -on: - push: {} -permissions: - contents: read -jobs: - notify: - name: Email on push - if: ${{ vars.PUSH_EMAIL_ENABLED == 'true' }} - runs-on: ubuntu-latest - steps: - - name: Send push notification email - uses: dawidd6/action-send-mail@12335b969ae3fb71bee5f2c6b829744261aec34c # pinned - with: - server_address: ${{ secrets.SMTP_HOST }} - server_port: ${{ secrets.SMTP_PORT }} - secure: true - username: ${{ secrets.SMTP_USER }} - password: ${{ secrets.SMTP_PASS }} - from: "GitHub Push <${{ secrets.SMTP_USER }}>" - to: "jonathan.jewell@gmail.com j.d.a.jewell@open.ac.uk" - subject: "[${{ github.repository }}] push to ${{ github.ref_name }} by ${{ github.actor }}" - body: | - Repository: ${{ github.repository }} - Branch: ${{ github.ref_name }} - Pusher: ${{ github.actor }} - Compare: ${{ github.event.compare }} - Head msg: ${{ github.event.head_commit.message }} diff --git a/.gitignore b/.gitignore index 896e6e5..3415090 100644 --- a/.gitignore +++ b/.gitignore @@ -114,3 +114,19 @@ ai-cli-crash-capture/ # Fuzz harness build artifacts fuzz/target/ rust-core/fuzz/target/ + +# Local database files +*.db +*.db-journal +*.db-shm +*.db-wal + +# Local caches and agent worktrees +.cache/ +.claude/ + +# Local export and build outputs +/exports/*.json +/exports/*.lgt +composer/*.beam +composer/build/ diff --git a/audits/assail-classifications.a2ml b/audits/assail-classifications.a2ml index 51b8167..b994475 100644 --- a/audits/assail-classifications.a2ml +++ b/audits/assail-classifications.a2ml @@ -30,7 +30,7 @@ ;; inside `try { } catch` returning result<_, VeriSimError.t>. The ;; graceful degradation the finding asks for is already present. (classification - (file "connectors/clients/rescript/src/VeriSimVql.res") + (file "connectors/clients/rescript/src/VeriSimVcl.res") (category "UnsafeDeserialization") (audit "try-wrapped stringify→parseExn round-trips") (rationale "parse of self-stringified JSON inside try; cannot throw on external input"))