ci: vendor validation scripts and remove remote action pins

[hyperpolymath]

Automated PR to fix CI after deleted actions.

[sonarqubecloud]

Quality Gate passed

Issues
6 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

CI failed: CodeQL analysis failed because the repository contains no valid JavaScript or TypeScript source code to process, triggering exit code 32.

Overview

1 CodeQL analysis failure found where the JavaScript/TypeScript scanner encountered only empty or syntax-free files or no source files at all.

Failures

CodeQL JavaScript Analysis Failure (confidence: high)

• Type: configuration
• Affected jobs: 90125889565
• Related to change: unclear
• Root cause: The CodeQL action attempted to analyze JavaScript/TypeScript in a repository that contains no source files for that language, triggering CodeQL error exit code 32.
• Suggested fix: Remove 'javascript-typescript' from the languages matrix in the CodeQL workflow configuration if the repository does not contain JavaScript or TypeScript code.

Summary

• Change-related failures: 0
• Infrastructure/flaky failures: 0
• Recommended action: Update the workflow configuration to target the correct languages for the repository.

Code Review✅ Approved2 resolved / 2 findings

Vendors validation scripts and removes remote action pins to fix CI action failures. Consider addressing the read loops skipping final lines and space normalization stripping only single spaces.

Auto-approved: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria.

✅ 2 resolved

✅ Edge Case: read loops skip final line lacking trailing newline

📄 .githooks/validate-k9.sh:122-131📄 .githooks/validate-k9.sh:141-150📄 .githooks/validate-k9.sh:169-183📄 .githooks/validate-a2ml.sh:102-111📄 .githooks/validate-a2ml.sh:128-142📄 .githooks/validate-a2ml.sh:239-253📄 .githooks/validate-a2ml.sh:270-280
Every while IFS= read -r line; do ... done < "$file" loop in both scripts drops the file's last line when it has no trailing newline, because read returns non-zero on EOF and the loop body doesn't execute. A valid file whose required field (e.g. K9 name, or an a2ml name/version) sits on an unterminated last line would be falsely reported as missing, causing spurious CI failures. Use while IFS= read -r line || [[ -n "$line" ]]; do to also process the trailing partial line.

✅ Bug: normalise_level only strips one leading/trailing space

📄 .githooks/validate-k9.sh:95-108
In normalise_level, raw="${raw## }" and raw="${raw%% }" use the literal pattern (a single space, no glob), so only one space is removed. A leash value indented with tabs or multiple spaces (e.g. after #*= leaves hunt) normalises to hunt, which fails the exact match against kennel yard hunt and is falsely reported as an invalid security level. Use extglob ${raw##*( )}/${raw%%*( )} or a [[:space:]]-aware trim.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Gitar has auto-approved this PR (configure)