fix(ci): repair doc-truthing guard after #614's .md→.adoc migration#617
Merged
Conversation
#614 migrated six status/history docs from .md to .adoc, but the doc-truthing guard kept the old .md paths in two places, turning main's `build` job red: - BANNERED_DOCS presence list -> "bannered doc is missing" for BACKEND-IMPLEMENTATION / COMPILER-CAPABILITIES / ALPHA-1-RELEASE-NOTES - over-claim ratchet baseline (tools/doc-overclaims.allow) -> "new over-claim(s)" for the migrated .adoc history/roadmap snapshots (identical already-blessed claims, now at .adoc paths + .adoc markup) Fix (hotfix + hardening): - Re-key the over-claim baseline to the migrated .adoc paths via `--update`: a 1:1 re-bless of identical historical/roadmap content, no new live over-claims. - Harden the presence check so it cannot re-break on a future migration: BANNERED_DOCS are now extension-less stems resolved to whichever of .adoc/.md is present (.adoc preferred). Verified: guard exits 0 on the merged tree; resolver tested for the .adoc / .md / neither cases. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Lz7pRcec2Z3tVtaAhvB3M8
🔍 Hypatia Security ScanFindings: 42 issues detected
View findings[
{
"reason": "Action denoland/setup-deno@v2 needs attention",
"type": "unpinned_action",
"file": "publish-jsr.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in scorecard-enforcer.yml",
"type": "scorecard_publish_with_run_step",
"file": "scorecard-enforcer.yml",
"action": "split_scorecard_publish_job",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in instant-sync.yml",
"type": "secret_action_without_presence_gate",
"file": "instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
"type": "js_exec_sync",
"file": "/home/runner/work/affinescript/affinescript/packages/affinescript-cli/mod.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "Shell execution -- validate input before passing to shell (2 occurrences, CWE-78)",
"type": "js_exec_sync",
"file": "/home/runner/work/affinescript/affinescript/packages/affine-vscode/mod.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
"type": "js_exec_sync",
"file": "/home/runner/work/affinescript/affinescript/affinescript-vite/src/affine-plugin-improved.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "expect() in hot path (32 occurrences, CWE-754)",
"type": "expect_in_hot_path",
"file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/wasm_gen.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "medium"
},
{
"reason": "expect() in hot path (29 occurrences, CWE-754)",
"type": "expect_in_hot_path",
"file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/affine_gen.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "medium"
},
{
"reason": "unsafe block -- requires SAFETY comment (2 occurrences, CWE-676)",
"type": "unsafe_block",
"file": "/home/runner/work/affinescript/affinescript/runtime/src/panic.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "medium"
},
{
"reason": "unsafe block -- requires SAFETY comment (1 occurrences, CWE-676)",
"type": "unsafe_block",
"file": "/home/runner/work/affinescript/affinescript/runtime/src/alloc.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
hyperpolymath
added a commit
that referenced
this pull request
Jun 21, 2026
#614 added lib/borrow_polonius/dune unformatted; the build job's `dune build @fmt` requires a blank line between the comment block and the (library ...) stanza. It was masked on main until #617 fixed the doc-truthing guard that failed earlier in the same job. Only the blank line is added (canonical `dune format-dune-file` output); no other dune files are touched — root dune-project / .build/dune-project "drift" only under newer local dune and is not flagged by CI's dune. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Lz7pRcec2Z3tVtaAhvB3M8
hyperpolymath
added a commit
that referenced
this pull request
Jun 21, 2026
## What Greens `main`'s `build` job. After #617 fixed the doc-truthing guard, the next `build` step — `dune build @fmt` — fails because **#614 added `lib/borrow_polonius/dune` without the blank line** `dune fmt` requires between the comment block and the `(library …)` stanza. ## Fix Add the single blank line (canonical `dune format-dune-file` output). Nothing else changes. > Note: root `dune-project` / `.build/dune-project` show "drift" only under newer **local** dune (3.14.0) and drift identically on `2aa00ff` where CI's `@fmt` was green — i.e. CI's dune does **not** flag them, so they're deliberately left untouched. ## Why this is a separate PR #614 was merged (bypass) while its CI was incomplete — the `build` job died at doc-truthing *before* reaching `@fmt`, so its `@fmt` compliance was never checked. #617 fixed the first failure; this fixes the one it unmasked. After this, the `build` job should be green. Verified: `dune format-dune-file lib/borrow_polonius/dune` is now a no-op. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Lz7pRcec2Z3tVtaAhvB3M8 --- _Generated by [Claude Code](https://claude.ai/code/session_01Lz7pRcec2Z3tVtaAhvB3M8)_ Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Repairs
main's redCIafter #614 merged. Thebuildjob's./tools/check-doc-truthing.shgovernance guard failed because #614 migrated six status/history docs from.md→.adoc, but the guard still keyed off the old.mdpaths in two places:BANNERED_DOCS) →bannered doc is missingforBACKEND-IMPLEMENTATION,COMPILER-CAPABILITIES,ALPHA-1-RELEASE-NOTES.tools/doc-overclaims.allow) →new over-claim(s)for the migrated.adochistory/roadmap snapshots (identical, already-blessed claims — just at.adocpaths with.adocmarkup).On the previous
maintip (2aa00ff) this guard was green, so this is a regression introduced purely by the migration — not new over-claiming.Fix (hotfix + hardening)
.adocpaths via the tool's documented--update. This is a 1:1 re-bless of identical historical/roadmap content — every removed.mdsignature has an equivalent.adocone added; zero new live over-claims.BANNERED_DOCSare now extension-less stems resolved to whichever of.adoc/.mdis present (.adocpreferred).Verification
./tools/check-doc-truthing.sh→ exit 0: "OK: doc-truthing intact — presence invariants + over-claim ratchet (DOC-04/05/08/09).".adoc; only.md→.md; neither → missing.dune buildclean. (The onlybuild-job step after the guard isdune build @fmt; this change touches no OCaml, so it's unaffected.)Greens the
buildjob /CIonmain.🤖 Generated with Claude Code
https://claude.ai/code/session_01Lz7pRcec2Z3tVtaAhvB3M8
Generated by Claude Code