fix(ci): repoint the deleted validate-actions at the live ecosystem repos

[hyperpolymath]

hyperpolymath/a2ml-validate-action and k9-validate-action are deleted (verified 404). An unresolvable uses: ref produces no check run at all — not a red one — so Validate A2ML manifests and Validate K9 contracts could never report, and any ruleset requiring them was unsatisfiable. The repo looked green while the check had simply never run.

The actions moved: a2ml-ecosystem/validate-action and k9-ecosystem/validate-action. Repointed rather than vendored — vendoring would create one drifting copy per repo.

Measured scope: 69 repos, 135 references. SHAs are those already proven green in the-nash-equilibrium#83.

Verified: no dead refs remain; every touched workflow still parses.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🔍 Hypatia Security Scan

Findings: 63 issues detected

Severity	Count
🔴 Critical	1
🟠 High	22
🟡 Medium	40

⚠️Action Required: Critical security issues found!

View findings

[
{
"reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
"type": "codeql_language_matrix_mismatch",
"file": "codeql.yml",
"action": "switch_codeql_matrix_to_actions",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in boj-build.yml",
"type": "missing_timeout_minutes",
"file": "boj-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in codeql.yml",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dependabot-automerge.yml",
"type": "missing_timeout_minutes",
"file": "dependabot-automerge.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
}
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review✅ Approved1 resolved / 1 findings

Updates GitHub Actions workflow references to point to live ecosystem repos, but the new action references keep the hyperpolymath/ prefix which contradicts the stated organization move.

✅ 1 resolved

✅ Bug: New action refs keep hyperpolymath/ prefix, contradicting stated move

📄 .github/workflows/dogfood-gate.yml:41📄 .github/workflows/dogfood-gate.yml:89
The PR description says the actions moved to a2ml-ecosystem/validate-action and k9-ecosystem/validate-action (a new org + validate-action repo), but the diff writes hyperpolymath/a2ml-ecosystem/validate-action@... and hyperpolymath/k9-ecosystem/validate-action@.... With the hyperpolymath/ owner retained, GitHub parses these as owner=hyperpolymath, repo=a2ml-ecosystem/k9-ecosystem, path=validate-action (a monorepo subdirectory), NOT the org form the description intends. If the intended target is the new org, the correct ref is a2ml-ecosystem/validate-action@<sha> (no hyperpolymath/). If the ref does not resolve, the uses: produces no check run at all — reintroducing the exact silent-green failure this PR sets out to fix. Confirm which location is real: if org, drop the hyperpolymath/ prefix; if it is genuinely a subdirectory in the hyperpolymath/a2ml-ecosystem monorepo, correct the PR description and verify validate-action/action.yml exists at the pinned SHAs.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}