ci: vendor validation scripts and remove remote action pins

[hyperpolymath]

Automated PR to fix CI after deleted actions.

[gitar-bot]

CI failed: CI validation failures occurred in K9 contracts (missing magic numbers and pedigree metadata) and A2ML manifests (missing required identity fields).

Overview

Two distinct validation job failures occurred in CI: K9 contract validation failed due to missing magic numbers and pedigree metadata fields, and A2ML manifest validation failed due to missing required identity fields in manifest files.

Failures

K9 Contract Validation Failure (confidence: high)

• Type: test
• Affected jobs: 90125501481
• Related to change: yes
• Root cause: The K9 contract validation script (.githooks/validate-k9.sh) found contract files lacking the mandatory 'K9!' magic number on the first non-empty line and missing the 'name' field in the pedigree block.
• Suggested fix: Update the affected K9 contract files (such as ./.machine_readable/contractiles/k9/template-hunt.k9.ncl) to include the exact 'K9!' magic number on their first non-empty line and provide a valid pedigree block containing the required 'name' field.

A2ML Manifest Validation Failure (confidence: high)

• Type: test
• Affected jobs: 90125501521
• Related to change: yes
• Root cause: The A2ML manifest validation script (.githooks/validate-a2ml.sh) detected manifest files missing a required identity field (agent-id, name, or project).
• Suggested fix: Inspect and update the .a2ml manifest files in the repository (such as ./.github/0.1-AI-MANIFEST.a2ml) to ensure the required identity field is specified.

Summary

• Change-related failures: 2 validation check failures (K9 contracts and A2ML manifests)
• Infrastructure/flaky failures: 0
• Recommended action: Fix the validation errors in the K9 contract and A2ML manifest files by adding the missing magic numbers, pedigree metadata, and identity fields, then re-run the CI pipeline.

Code Review ✅ Approved 2 resolved / 2 findings

Vendors validation scripts and removes remote action pins to fix CI, but the while-read loops skip the final line without a trailing newline and normalise_level leaves trailing spaces when lines have inline comments.

✅ 2 resolved

✅ Edge Case: while-read loops skip final line without trailing newline

📄 .githooks/validate-k9.sh:122-131 📄 .githooks/validate-k9.sh:141-150 📄 .githooks/validate-k9.sh:169-183 📄 .githooks/validate-a2ml.sh:102-111 📄 .githooks/validate-a2ml.sh:128-142 📄 .githooks/validate-a2ml.sh:239-253 📄 .githooks/validate-a2ml.sh:270-280
All the while IFS= read -r line; do ... done < "$file" loops in both validate-k9.sh and validate-a2ml.sh silently drop the last line if the file does not end in a newline, because read returns non-zero on the final unterminated line and the loop body is skipped. A .k9/.a2ml file whose closing } or a required field (name/version/leash/signature) sits on the last line without a trailing newline will be mis-validated — producing false 'missing field' errors that fail the gate, or missing a required check entirely. Fix by guarding every such loop: while IFS= read -r line || [[ -n "$line" ]]; do.

✅ Bug: normalise_level leaves trailing space when line has inline comment

📄 .githooks/validate-k9.sh:95-108 📄 .githooks/validate-k9.sh:262-276
In normalise_level(), the inline-comment strip raw="${raw%%#*}" runs AFTER the whitespace trims, and ${raw## }/${raw%% } only remove a single space each (the pattern is one literal space, so multiple spaces or tabs are not stripped). For a line like leash = "hunt" # note, the result is hunt (with a trailing space), so the exact comparison security_level_value == "hunt" fails: a valid level is reported as an invalid-level error and the hunt signature check (Check 5) is skipped. Trim whitespace last and handle runs of whitespace, e.g. strip the comment first then collapse with a [[:space:]] based trim.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}