Repository navigation
CI: required checks can never report — ABI Contract / Cross-Platform startup_failure (setup-zig not allow-listed); K9 + Sonar red on main #103
Description
Activity
- added a commit that references this issue
on Sep 30, 2026 Item 1 (required-check producers): fixed by #104, merged 2026-09-30T15:19Z as ec5db2f. The owner ruled to swap the action, not to change the allow-list.
mlugg/setup-zigis replaced byscripts/install-zig.sh. It fetches the official ziglang.org Zig 0.15.2 x86_64-linux tarball and checks it against a pinned sha256. At pin time the tarball's minisign signature was verified against the ZSF key. No third-party action is used. The Actions allow-list is unchanged.- In
actions.lock, the threemlugg/setup-zig@v2.2.1entries were removed by hand.gh actions-lock --no-fixreports valid. - PR head fbd8151 ran
ABI Contract(run 36735322502) andCross-Platform Build & Test(run 36735322301). Both concluded success, with no startup_failure and every step executed. All four required contexts ran as real check runs, and all four passed:Linux109955370259,Zig ↔ Idris tables in sync109955371714,Idris2 model type-checks109955372159,AffineScript ↔ Zig FFI symbols in sync109955371947. - Rule-suite 4298237478 for the merge push shows every rule
pass, with no bypass: required_status_checks, required_signatures, non_fast_forward and deletion.
Still open here and not touched by #104:
Governancestill ends in startup_failure (run 36735326413 on the PR). Pages and Mirror were not re-checked.- K9
Pedigree block missing 'name' fieldis still red on the PR (Dogfood Gate run 36735322245). - Sonar and Hypatia on main were not examined.
- The criterion that the ruleset be SET-EQUAL to the contexts a PR head produces holds for the four required contexts, as observed on fix(ci): install Zig from a pinned, verified tarball — replaces non-allow-listed mlugg/setup-zig (#103) #104.
Confirmed on
mainat ec5db2f (push event):ABI Contractrun 36735829015 andCross-Platform Build & Testrun 36735829299 both concluded success.Governance(36735833054),Mirror to Git Forges(36735834472) andGitHub Pages(36735836472) still end in startup_failure, and Dogfood Gate (36735828996) is still red on K9. Those items stay open.- added a commit that references this issue
on Sep 30, 2026
Problem
main(070529e) cannot produce the checks its own ruleset requires. No PR can therefore satisfy the required-status-checks rule, and auto-merge can never fire.Linux,Idris2 model type-checks,Zig ↔ Idris tables in syncandAffineScript ↔ Zig FFI symbols in sync. They come from theCross-Platform Build & TestandABI Contractworkflows. Both end instartup_failureonmain070529e and on PR fix(launcher): regenerate game-server-admin launcher with the XDG pid/log ladder #102, so they create no check runs at all.Governance,GitHub PagesandMirror to Git Forgesalso end instartup_failureonmain. The run pages for ABI Contract (run 35609965294) and Cross-Platform (run 35609970129) give the cause:mlugg/setup-zig(at the pinned SHA) in the repo or org Actions policy, or to replace it with an allowed Zig setup. Weakening the policy estate-wide is not the cure.Dogfood Gate / Validate K9 contractsfails onmainand on PRs:SonarCloud Code AnalysisandHypatia Security Scanfail onmain070529e.Acceptance criteria
Cross-Platform Build & TestandABI Contractstart on a PR and onmain, with nostartup_failure. Each of the four required contexts appears on the PR head as a real check run. The fixing PR names the startup error text from the run page.Governance,GitHub PagesandMirror to Git Forgesno longer end instartup_failureonmain.container/deploy.k9.nclcarries a pedigreename(andversion/schema_version), andValidate K9 contractsis green onmain.SonarCloud Code Analysisis green onmain, or is removed with a stated reason.Found while landing #102. #102 inherits these reds and does not cause them. Its auto-merge (squash) is armed and will stay parked until item 1 is fixed.