Skip to content

build,ci: fix Hypatia env, update CI policy text to AffineScript, fix mix path in service unit#43

Merged
hyperpolymath merged 1 commit intomainfrom
cleanup-non-port-2026-04-30
Apr 30, 2026
Merged

build,ci: fix Hypatia env, update CI policy text to AffineScript, fix mix path in service unit#43
hyperpolymath merged 1 commit intomainfrom
cleanup-non-port-2026-04-30

Conversation

@hyperpolymath
Copy link
Copy Markdown
Owner

@hyperpolymath hyperpolymath commented Apr 30, 2026

Summary

Three of the four sub-parts of the deferred cleanup ledger from PR #40's out-of-scope list. The fourth (port the 6 .ts cartridge adapters to AffineScript→typed-wasm) is delegated to a scheduled remote agent that fires 2026-05-07 and runs one cartridge per pass, so it stays opportunistic and reviewable.

Changes

File Fix
.github/workflows/hypatia-scan.yml Adds job-level GITHUB_TOKEN env (Hypatia CLI calls gh api for Dependabot lookups; without the token it logs Dependabot alerts unavailable: GITHUB_TOKEN not set and the job exits non-zero). Adds security-events: read permission.
.github/workflows/rsr-antipattern.yml "use ReScript instead" → "use AffineScript→typed-wasm instead". Header comment + Allows banner updated to reflect estate-wide language policy 2026-04-30 (RS/TS/JS default is AffineScript; ReScript transitional / adapter-shim only).
.github/workflows/ts-blocker.yml "port to Zig or ReScript" / "use Zig or ReScript instead" → "Zig (systems) or AffineScript→typed-wasm (application)". Underlying detection unchanged.
elixir/boj-rest.service Replace hardcoded ExecStart=/usr/bin/mix (which is apt's 1.14, fails mix.exs ~> 1.15 check on Ubuntu 24.04 LTS) with ExecStart=mix run --no-halt. Adds Environment=PATH with asdf shims, cargo bin, ~/.local/bin. Adds ASDF_DIR + ASDF_DATA_DIR so asdf shims work under systemd's clean env. Bumps cartridge-count comment 112 → 115.

Why these specifically

PR #40 (spec drift) merged on 2026-04-30 surfaced four follow-up cleanups; this PR closes three of them. The fourth (.ts → AffineScript ports) was deliberately scheduled rather than rushed — verifying AffineScript readiness for each cartridge is genuinely per-cartridge work and the scheduled agent does it one at a time.

The boj-rest.service fix in particular was discovered the hard way during the maintainer's install: the deployed unit needed a hand-patch (~/.config/systemd/user/boj-rest.service) to point at ~/.asdf/installs/elixir/1.18.4-otp-25/bin/mix. Persisting the fix to the source template (with %h systemd-substitution + asdf shim PATH) means the next person installing on a fresh Ubuntu doesn't repeat the dance.

The three pre-existing CI failures that were blocking PRs #40, #41, #42 are likely partially closed by this PR:

  • Hypatia — should now pass with GITHUB_TOKEN wired up.
  • TS/JS Blocker and antipattern-check — will still fail on the 6 .ts cartridge adapters (academic-workflow-mcp, bofig-mcp, ephapax-mcp, fireflag-mcp, hesiod-mcp, sanctify-mcp). Those are the scheduled agent's work. Admin-merge-without-CI is still expected for this PR.

Test plan

  • CI shows Hypatia passing on this branch (GITHUB_TOKEN now available).
  • Diff visual review for the policy text — make sure no instance of "use ReScript instead" remains in the workflow files.
  • After merge, fresh install on a clean Ubuntu 24.04 LTS host with asdf + the toolchain-pins from PR build: pin toolchain versions via tracked .tool-versions #41: bash setup.sh && just doctor && just deps && just build && just install-service — confirm boj-rest.service starts cleanly without the (Mix) You're trying to run :boj_rest on Elixir v1.14.0 error that was previously hit.

Out of scope

🤖 Generated with Claude Code

@hyperpolymath @claude
build,ci: fix Hypatia env, update CI policy text to AffineScript, fix…
69b47b7 
… mix path in service unit

Three of the four sub-parts of the deferred cleanup ledger from PR #40's
out-of-scope list. The fourth (port the 6 .ts cartridge adapters to
AffineScript→typed-wasm) is delegated to a scheduled remote agent that
fires 2026-05-07 and runs one cartridge per pass.

## .github/workflows/hypatia-scan.yml — fix GITHUB_TOKEN missing

The Hypatia scan step was failing on every PR with:

  Warning: Dependabot alerts unavailable: GITHUB_TOKEN not set
            — cannot query Dependabot alerts
  ##[error]Process completed with exit code 1.

Hypatia's CLI calls `gh api` for Dependabot alert lookups. Without
GITHUB_TOKEN in the env it can't query, and exits non-zero. Other steps
in the same workflow had GITHUB_TOKEN set on a per-step basis; this
moves it to job-level so all steps see it.

Also adds `security-events: read` to permissions (needed for the
Dependabot alert API).

## .github/workflows/{rsr-antipattern,ts-blocker}.yml — AffineScript not ReScript

Per estate-wide language policy 2026-04-30: RS/TS/JS → AffineScript →
typed-wasm. ReScript is also being phased out; only allowed as adapter
shims to upstream ReScript-using systems. The CI "use X instead"
messages now point at AffineScript, with Zig→WASM called out as the
systems-level alternative.

Specifically:

  rsr-antipattern.yml:
    - Header comment: "Allows: ReScript, Deno, ..."
        -> "Allows: AffineScript, Deno, Rust/SPARK, ..." with explicit
        carve-out that ReScript is shim-only.
    - "use ReScript instead" (TS check)        -> "use AffineScript→typed-wasm instead"
    - "use ReScript instead" (tsconfig check)  -> same
    - Summary banner: lists AffineScript as default, ReScript as
      transitional / adapter-shim only.

  ts-blocker.yml:
    - "port to Zig or ReScript" (existing-TS path)  -> "port to Zig or AffineScript"
    - "use Zig or ReScript instead" (new-JS path)   -> "use ... AffineScript→typed-wasm
                                                        for application code, Zig→WASM for systems"

Both keep the underlying detection unchanged; only the user-facing
guidance text changes.

## elixir/boj-rest.service — replace hardcoded /usr/bin/mix

The unit hardcoded `ExecStart=/usr/bin/mix run --no-halt`, which fails
on hosts where Elixir is asdf-managed (the only practical way to get
Elixir ≥ 1.15 on Ubuntu 24.04 LTS, since apt ships 1.14). The unit
would crash-loop with:

  ** (Mix) You're trying to run :boj_rest on Elixir v1.14.0 but it
  has declared in its mix.exs file it supports only Elixir ~> 1.15

Fix:

  - Adds Environment=PATH including %h/.asdf/shims, %h/.cargo/bin, and
    %h/.local/bin (in that order before system paths). %h is systemd's
    home-directory specifier, so the unit is portable across users.
  - Adds Environment=ASDF_DIR + ASDF_DATA_DIR so the asdf shim resolves
    correctly under systemd's clean environment.
  - Changes ExecStart to `mix run --no-halt` (PATH lookup), so the
    asdf shim picks up whatever Elixir is pinned in .tool-versions
    (now 1.18.4-otp-25 per the toolchain-pins PR #41).

Bumps the cartridge-count comment on LimitNOFILE from 112 to 115 to
match the rest of the repo post-#40.

## What this PR does NOT do

  - Port any of the 6 .ts cartridge adapters to AffineScript. That is
    delegated to a scheduled remote agent (one cartridge per pass,
    weekly, starting 2026-05-07).
  - Re-run any tests. The systemd unit fix is verified via the live
    install on the maintainer's machine, where boj-rest.service is
    currently `active (running)` with the patched (deployed-only)
    Environment=PATH approach. Persisting the fix to the source
    template is what this PR does.
  - Touch any cartridge code, build wiring, or non-CI workflow logic.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@hyperpolymath hyperpolymath merged commit d71189c into main Apr 30, 2026
8 of 12 checks passed
@hyperpolymath hyperpolymath deleted the cleanup-non-port-2026-04-30 branch April 30, 2026 15:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath