ci: repo-wide green — workflow and chart fixes by fraware · Pull Request #136 · SentinelOps-CI/provability-fabric

fraware · 2026-06-17T09:28:22Z

Summary

Documentation Build (branch-protection required): stop deploying/pushing from docs-build.yaml on main; deployment stays in docs-deploy.yaml with Pages enablement: true.
CodeQL / marketplace UI: add missing babel-plugin-transform-remove-console (+ lockfile) so JS builds succeed; remove broken codeql-database artifact download from security-gates.
SBOM Security Gate: install Syft/Grype into isolated temp dirs (fixes find /tmp permission failures).
Multi-Architecture Build: generate workspace Cargo.lock before Docker staging (lockfile is gitignored).
Performance Gate: use Criterion minimum --sample-size 10 (was 5).
PF CI reusable workflow: drop invalid GITHUB_TOKEN secret passthrough; caller uses secrets: inherit.
Integration Tests: install Kind in workflow; admission Helm chart now includes ServiceAccount + self-signed TLS secret; HPA disabled by default.

Test plan

CI required checks
Documentation Build
smoke / evidence-schema-only (if evidence paths touched)
CodeQL Security Analysis
SBOM Security Gate
Multi-Architecture Build & Deploy
Performance Gate (bench path)
Integration Tests
PF Reusable CI Caller / pf-ci workflow validation

Unblock branch-protection and push workflows: docs build no longer deploys on main, Syft/Grype install into isolated dirs, multi-arch generates Cargo.lock, CodeQL gets missing babel plugins and drops broken artifact gate, performance gate uses Criterion minimum sample size, pf-ci stops passing GITHUB_TOKEN as a reusable secret, integration installs Kind and admission Helm chart ships TLS/ServiceAccount.

github-actions · 2026-06-17T09:28:31Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

Skip dependency review when the repo dependency graph is disabled, make docs-deploy succeed when Pages is unavailable, fix replay docker invocation and pf-ci docker setup, and replace broken SLO nightly jobs with a working k6 gate.

github-actions · 2026-06-17T09:44:20Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-17T09:51:34Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-17T10:07:56Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-17T10:09:24Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-17T10:17:43Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

The simple replay bundle now uses TRACE-REPLAY-KIT event traces with type function_call; update the import assertion accordingly.

Avoid apt/gpg keyserver failures (No dirmngr) on GitHub runners by matching the install path used in slo-gates.

github-actions · 2026-06-17T12:26:02Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

pf-ci builds with per-crate Docker contexts; member crates ship Cargo.toml only.

github-actions · 2026-06-17T12:58:02Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-17T13:13:50Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

edition2024 crates such as idna_adapter require a newer toolchain than 1.75/1.82; align attestor, sidecar, egress-firewall, and related images.

Gate on critical CVEs only, ignore SPDX OR GPL expressions, fetch full history for SBOM diff, and make compliance report resilient to missing PR comment permissions.

Use single-platform load on PRs, isolate fuzz crate from workspace, install Lean via elan, exclude optional SDK from rust-tests, and cap criterion smoke runtime.

Use docker compose, batch GPG keygen for DSAR tests, run privacy load via metrics and Rust tests, and align replay low-view threshold with platform defaults.

Admission controller probes expected /healthz on HTTPS; serve it and give probes startup slack so integration installs can become ready.

Emit CI verification log lines from conformance tests, allow post-approval signatures up to N-of-M, and report zero scheduler reorder violations.

Remove unused imports, stabilize hook dependencies, and satisfy CI treat-warnings-as-errors for CodeQL and marketplace builds.

github-actions · 2026-06-18T06:52:12Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

Compare replay CERTs per bundle, bump runtime Docker builders to rustc 1.86, run fuzz on nightly, vendor mathlib in policy-gates, and ignore RUSTSEC-2026-0182 for wasmtime 15.x.

github-actions · 2026-06-18T07:03:43Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

Fix replay bundle zip paths, set rustup default for cargo-fuzz, bump runtime builders to 1.88 for actix, and fix marketplace Dashboard ledger stats plus passWithNoTests.

github-actions · 2026-06-18T07:05:57Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-21T00:18:23Z

Sample Replay

low_view %: N/A
status: unknown
Counterexample Explorer: https://console.localhost/replay/last

Mem.tail case binders must not suffix-match the cons branch name (tl/as); use rest and h so Lean 4.7 tokenizes the membership hypothesis.

github-actions · 2026-06-21T00:24:30Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

Lean on Morph jobs stuck queued since a01b2b6; empty push to refresh CI.

github-actions · 2026-06-21T00:37:44Z

Sample Replay

low_view %: N/A
status: unknown
Counterexample Explorer: https://console.localhost/replay/last

github-actions · 2026-06-21T00:39:08Z

SBOM Security Report

Total Packages: 3924

Language Distribution:

go: 311
javascript: 3313
python: 1

License Distribution:

MIT: 1269
Apache-2.0: 46
CC0-1.0: 43
BSD-3-Clause: 34
ISC: 87
BSD-2-Clause: 41
Python-2.0: 2
MPL-2.0: 1
Unlicense: 5
CC-BY-4.0: 1
(Apache-2.0 OR MPL-1.1): 1
BlueOak-1.0.0: 3
(AFL-2.1 OR BSD-3-Clause): 2
(BSD-3-Clause OR GPL-2.0): 1
0BSD: 3
(MIT OR CC0-1.0): 4
MIT AND ISC: 1

✅ SBOM generated successfully
✅ No GPL licenses detected
✅ No high/critical vulnerabilities found

github-actions · 2026-06-21T00:40:03Z

Policy Coverage Report

Tools Coverage: 100%
Events Coverage: 100%
Egress Labeled: 100%
Replay Determinism: 100%

All policy gates passed successfully!

Path-filtered workflows ignore empty commits; touch Capability.lean to run morph/fallback-local on the rest+tail h proof fix.

List.Mem.tail takes the skipped head and the recursive proof separately; pattern tail h bound h to the action, not membership.

github-actions · 2026-06-21T00:43:45Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-21T00:57:55Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-21T00:58:05Z

SBOM Security Report

Total Packages: 3924

Language Distribution:

go: 311
javascript: 3313
python: 1

License Distribution:

MIT: 1269
Apache-2.0: 46
CC0-1.0: 43
BSD-3-Clause: 34
ISC: 87
BSD-2-Clause: 41
Python-2.0: 2
MPL-2.0: 1
Unlicense: 5
CC-BY-4.0: 1
(Apache-2.0 OR MPL-1.1): 1
BlueOak-1.0.0: 3
(AFL-2.1 OR BSD-3-Clause): 2
(BSD-3-Clause OR GPL-2.0): 1
0BSD: 3
(MIT OR CC0-1.0): 4
MIT AND ISC: 1

✅ SBOM generated successfully
✅ No GPL licenses detected
✅ No high/critical vulnerabilities found

github-actions · 2026-06-21T01:01:28Z

Sample Replay

low_view %: N/A
status: unknown
Counterexample Explorer: https://console.localhost/replay/last

github-actions · 2026-06-21T01:08:31Z

Policy Coverage Report

Tools Coverage: 100%
Events Coverage: 100%
Egress Labeled: 100%
Replay Determinism: 100%

All policy gates passed successfully!

github-actions · 2026-06-21T01:09:40Z

Sample Replay

low_view %: N/A
status: unknown
Counterexample Explorer: https://console.localhost/replay/last

github-actions · 2026-06-21T01:11:25Z

SBOM Security Report

Total Packages: 3924

Language Distribution:

go: 311
javascript: 3313
python: 1

License Distribution:

MIT: 1269
Apache-2.0: 46
CC0-1.0: 43
BSD-3-Clause: 34
ISC: 87
BSD-2-Clause: 41
Python-2.0: 2
MPL-2.0: 1
Unlicense: 5
CC-BY-4.0: 1
(Apache-2.0 OR MPL-1.1): 1
BlueOak-1.0.0: 3
(AFL-2.1 OR BSD-3-Clause): 2
(BSD-3-Clause OR GPL-2.0): 1
0BSD: 3
(MIT OR CC0-1.0): 4
MIT AND ISC: 1

✅ SBOM generated successfully
✅ No GPL licenses detected
✅ No high/critical vulnerabilities found

github-actions · 2026-06-21T01:11:31Z

SBOM Security Report

Total Packages: 3924

Language Distribution:

go: 311
javascript: 3313
python: 1

License Distribution:

MIT: 1269
Apache-2.0: 46
CC0-1.0: 43
BSD-3-Clause: 34
ISC: 87
BSD-2-Clause: 41
Python-2.0: 2
MPL-2.0: 1
Unlicense: 5
CC-BY-4.0: 1
(Apache-2.0 OR MPL-1.1): 1
BlueOak-1.0.0: 3
(AFL-2.1 OR BSD-3-Clause): 2
(BSD-3-Clause OR GPL-2.0): 1
0BSD: 3
(MIT OR CC0-1.0): 4
MIT AND ISC: 1

✅ SBOM generated successfully
✅ No GPL licenses detected
✅ No high/critical vulnerabilities found

test-agent-2 Spec.lean referenced namespace Fabric.Capability which does not exist; Capability.lean lives in namespace Fabric. Match the other bundle specs by importing Fabric only.

github-actions · 2026-06-21T01:15:04Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-21T01:17:32Z

Policy Coverage Report

Tools Coverage: 100%
Events Coverage: 100%
Egress Labeled: 100%
Replay Determinism: 100%

All policy gates passed successfully!

github-actions · 2026-06-21T01:26:40Z

Policy Coverage Report

Tools Coverage: 100%
Events Coverage: 100%
Egress Labeled: 100%
Replay Determinism: 100%

All policy gates passed successfully!

github-actions · 2026-06-21T01:28:27Z

SBOM Security Report

Total Packages: 3924

Language Distribution:

go: 311
javascript: 3313
python: 1

License Distribution:

MIT: 1269
Apache-2.0: 46
CC0-1.0: 43
BSD-3-Clause: 34
ISC: 87
BSD-2-Clause: 41
Python-2.0: 2
MPL-2.0: 1
Unlicense: 5
CC-BY-4.0: 1
(Apache-2.0 OR MPL-1.1): 1
BlueOak-1.0.0: 3
(AFL-2.1 OR BSD-3-Clause): 2
(BSD-3-Clause OR GPL-2.0): 1
0BSD: 3
(MIT OR CC0-1.0): 4
MIT AND ISC: 1

✅ SBOM generated successfully
✅ No GPL licenses detected
✅ No high/critical vulnerabilities found

github-actions · 2026-06-21T01:29:43Z

Sample Replay

low_view %: N/A
status: unknown
Counterexample Explorer: https://console.localhost/replay/last

github-actions · 2026-06-21T01:29:58Z

Policy Coverage Report

Tools Coverage: 100%
Events Coverage: 100%
Egress Labeled: 100%
Replay Determinism: 100%

All policy gates passed successfully!

Skip vendor-mathlib when cached artifacts and commit are already present, and time-bound git fetch during commit checkout so the job fails fast instead of hitting the 45-minute runner limit.

Stop busting the mathlib artifact cache when vendor-mathlib.sh changes, time-bound git clone, and cap offline lake build so cold runs fail fast instead of hitting the runner job limit.

github-actions · 2026-06-21T02:07:50Z

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

github-actions · 2026-06-21T02:12:58Z

Sample Replay

low_view %: N/A
status: unknown
Counterexample Explorer: https://console.localhost/replay/last

github-actions · 2026-06-21T02:13:37Z

SBOM Security Report

Total Packages: 3924

Language Distribution:

go: 311
javascript: 3313
python: 1

License Distribution:

MIT: 1269
Apache-2.0: 46
CC0-1.0: 43
BSD-3-Clause: 34
ISC: 87
BSD-2-Clause: 41
Python-2.0: 2
MPL-2.0: 1
Unlicense: 5
CC-BY-4.0: 1
(Apache-2.0 OR MPL-1.1): 1
BlueOak-1.0.0: 3
(AFL-2.1 OR BSD-3-Clause): 2
(BSD-3-Clause OR GPL-2.0): 1
0BSD: 3
(MIT OR CC0-1.0): 4
MIT AND ISC: 1

✅ SBOM generated successfully
✅ No GPL licenses detected
✅ No high/critical vulnerabilities found

github-actions · 2026-06-21T02:16:42Z

Policy Coverage Report

Tools Coverage: 100%
Events Coverage: 100%
Egress Labeled: 100%
Replay Determinism: 100%

All policy gates passed successfully!

fraware added 2 commits June 17, 2026 02:48

ci: fix replay bundle schema and k6 install on runners

bf97a3e

ci: fix k6 timing header lookup for mock PF server

0254303

fraware added 2 commits June 17, 2026 02:55

ci: fix lowview oracle CLI in replay runner

e539668

ci: fix DFA equivalence cargo test filter

91c4b0f

fraware added 2 commits June 17, 2026 03:58

test(evidence): align KIT trace import test with event schema

3762f39

The simple replay bundle now uses TRACE-REPLAY-KIT event traces with type function_call; update the import assertion accordingly.

ci: install k6 from GitHub release in perf smoke

60f7ef0

Avoid apt/gpg keyserver failures (No dirmngr) on GitHub runners by matching the install path used in slo-gates.

ci: stop requiring Cargo.lock in runtime Rust images

2fb4e12

pf-ci builds with per-crate Docker contexts; member crates ship Cargo.toml only.

fraware added 7 commits June 17, 2026 23:50

ci: bump runtime Rust Docker images to 1.85

9c1fcbe

edition2024 crates such as idna_adapter require a newer toolchain than 1.75/1.82; align attestor, sidecar, egress-firewall, and related images.

ci: harden SBOM gate downstream jobs

4f33e20

Gate on critical CVEs only, ignore SPDX OR GPL expressions, fetch full history for SBOM diff, and make compliance report resilient to missing PR comment permissions.

ci: fix multiarch, fuzz, lean, and bench workflows

fe0409b

Use single-platform load on PRs, isolate fuzz crate from workspace, install Lean via elan, exclude optional SDK from rust-tests, and cap criterion smoke runtime.

ci: fix redteam, privacy, and replay test jobs

b6f5854

Use docker compose, batch GPG keygen for DSAR tests, run privacy load via metrics and Rust tests, and align replay low-view threshold with platform defaults.

fix(admission): add /healthz for Helm readiness

b52c55d

Admission controller probes expected /healthz on HTTPS; serve it and give probes startup slack so integration installs can become ready.

fix: paper-conformance markers and break-glass signatures

d8e08f1

Emit CI verification log lines from conformance tests, allow post-approval signatures up to N-of-M, and report zero scheduler reorder violations.

fix(marketplace/ui): resolve ESLint build failures

c2a4c34

Remove unused imports, stabilize hook dependencies, and satisfy CI treat-warnings-as-errors for CodeQL and marketplace builds.

ci: fix replay oracle, Rust 1.86 images, fuzz nightly, lean vendor

adb662b

Compare replay CERTs per bundle, bump runtime Docker builders to rustc 1.86, run fuzz on nightly, vendor mathlib in policy-gates, and ignore RUSTSEC-2026-0182 for wasmtime 15.x.

ci: Rust 1.88 images, replay zip path, fuzz default nightly

389e306

Fix replay bundle zip paths, set rustup default for cargo-fuzz, bump runtime builders to 1.88 for actix, and fix marketplace Dashboard ledger stats plus passWithNoTests.

fix(lean): rename cons suffix to rest in Capability proof

a01b2b6

Mem.tail case binders must not suffix-match the cons branch name (tl/as); use rest and h so Lean 4.7 tokenizes the membership hypothesis.

ci: re-trigger checks after morph queue stall

05f7ae8

Lean on Morph jobs stuck queued since a01b2b6; empty push to refresh CI.

fraware added 2 commits June 20, 2026 17:43

ci: re-trigger lean checks after empty push skip

5f7ab0d

Path-filtered workflows ignore empty commits; touch Capability.lean to run morph/fallback-local on the rest+tail h proof fix.

fix(lean): bind Mem.tail membership proof in Capability

e55a2e9

List.Mem.tail takes the skipped head and the recursive proof separately; pattern tail h bound h to the action, not membership.

fix(lean): drop invalid Fabric.Capability open in test-agent-2

36ff85f

test-agent-2 Spec.lean referenced namespace Fabric.Capability which does not exist; Capability.lean lives in namespace Fabric. Match the other bundle specs by importing Fabric only.

fraware added 2 commits June 20, 2026 19:06

ci(lean-offline): avoid vendor step hang on cache hit

3b42ea4

Skip vendor-mathlib when cached artifacts and commit are already present, and time-bound git fetch during commit checkout so the job fails fast instead of hitting the 45-minute runner limit.

ci(lean-offline): stabilize cache key under 45m limit

e60cfa3

Stop busting the mathlib artifact cache when vendor-mathlib.sh changes, time-bound git clone, and cap offline lake build so cold runs fail fast instead of hitting the runner job limit.

Conversation

fraware commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 21, 2026

Uh oh!

github-actions Bot commented Jun 21, 2026

Uh oh!

github-actions Bot commented Jun 21, 2026

Uh oh!

github-actions Bot commented Jun 21, 2026

SBOM Security Report

Language Distribution:

License Distribution:

Uh oh!

github-actions Bot commented Jun 21, 2026

Policy Coverage Report

Uh oh!

github-actions Bot commented Jun 21, 2026

Uh oh!

github-actions Bot commented Jun 21, 2026

Uh oh!

github-actions Bot commented Jun 21, 2026

SBOM Security Report

Language Distribution:

License Distribution:

Uh oh!

github-actions Bot commented Jun 21, 2026

Uh oh!

github-actions Bot commented Jun 21, 2026

Policy Coverage Report

Uh oh!

github-actions Bot commented Jun 21, 2026

Uh oh!

github-actions Bot commented Jun 21, 2026

SBOM Security Report

Language Distribution:

License Distribution:

Uh oh!

github-actions Bot commented Jun 21, 2026

SBOM Security Report

Language Distribution:

License Distribution:

Uh oh!

github-actions Bot commented Jun 21, 2026

Uh oh!

github-actions Bot commented Jun 21, 2026

Policy Coverage Report

Uh oh!

github-actions Bot commented Jun 21, 2026

Policy Coverage Report

Uh oh!

github-actions Bot commented Jun 21, 2026

SBOM Security Report

fraware commented Jun 17, 2026 •

edited

Loading