sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 62 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

fix(deps): repoint tramiton git-deps to the renamed firmwerk repo (fixes CI)
CI / Check (push) Skipped
CI / Detect Changes (pull_request) Skipped
Details
CI / Deploy Agent (pull_request) Skipped
Details
CI / Deploy Dashboard (pull_request) Skipped
Details
CI / Deploy Docs (pull_request) Skipped
Details
CI / Deploy MCP (pull_request) Skipped
Details
CI / Check (pull_request) Failing after 6m53s
Details

Browse Source 
The private git-dependency still pointed at
ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git, which is stale two
ways: #231 repointed the host to git.breakpilot.com, and the repo was renamed
tramiton -> firmwerk. The CI `insteadOf` rewrite is keyed on git.breakpilot.com,
so it never matched the old host and Cargo fell back to a raw SSH clone of a dead
host -> "Host key verification failed" -> "failed to get tramiton-core as a
dependency". This broke `CI / Check` and every Deploy job on main and all PRs.

Repoint the three git-deps (tramiton-core/-repro/-sbom) to
ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git, tag unchanged (v0.4.1 =
same commit ae4fc137, where the crates are still named tramiton-*), and update
the matching Cargo.lock source URLs. Pure repoint — no crate rename, no code
change. Migrating the deps to the firmwerk-* crates at a newer tag is a
follow-up.

Validated: `cargo fetch` + `cargo metadata --offline` resolve the dep from the
new URL; resolved source is git+ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git?tag=v0.4.1.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv
This commit is contained in:
Sharang Parnerkar
2026-08-31 18:22:52 +02:00
co-authored by Claude Fable 5
parent 8dcdad9fe7
commit b5c33bdd52
2 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Cargo.lock
Generated
+3 -3
View File
@@ -6176,7 +6176,7 @@ dependencies = [
[[package]] [[package]]
name = "tramiton-core" name = "tramiton-core"
version = "0.4.1" version = "0.4.1"
source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba" source = "git+ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
dependencies = [ dependencies = [
"serde", "serde",
"tempfile", "tempfile",
@@ -6188,7 +6188,7 @@ dependencies = [
[[package]] [[package]]
name = "tramiton-repro" name = "tramiton-repro"
version = "0.4.1" version = "0.4.1"
source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba" source = "git+ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
dependencies = [ dependencies = [
"serde", "serde",
"serde_json", "serde_json",
@@ -6203,7 +6203,7 @@ dependencies = [
[[package]] [[package]]
name = "tramiton-sbom" name = "tramiton-sbom"
version = "0.4.1" version = "0.4.1"
source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba" source = "git+ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
dependencies = [ dependencies = [
"object", "object",
"serde", "serde",
compliance-agent/Cargo.toml
+6 -4
View File
@@ -16,14 +16,16 @@ compliance-dast = { path = "../compliance-dast" }
werkbank-exec = { path = "../werkbank-exec" } werkbank-exec = { path = "../werkbank-exec" }
# Native firmware build/target detection for bare-metal & RTOS artifacts. # Native firmware build/target detection for bare-metal & RTOS artifacts.
# Same-company IP, used directly (not via CLI) so the whole tramiton suite is # Same-company IP, used directly (not via CLI) so the whole tramiton suite is
# available to the onboarding classifier. NOTE: CI must be able to fetch this # available to the onboarding classifier. Repo renamed tramiton -> firmwerk
# (git.breakpilot.com/sharang/firmwerk); crates stay tramiton-* at tag v0.4.1.
# NOTE: CI must be able to fetch this
# private repo (see the git-auth step in .gitea/workflows/ci.yml). # private repo (see the git-auth step in .gitea/workflows/ci.yml).
tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" } tramiton-core = { git = "ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git", tag = "v0.4.1" }
# tramiton-repro drives the reproducible build (NixBackend seal_and_build) that # tramiton-repro drives the reproducible build (NixBackend seal_and_build) that
# yields a sealed lock; `libraries_from_inputs` is the analysis-only fallback. # yields a sealed lock; `libraries_from_inputs` is the analysis-only fallback.
tramiton-repro = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" } tramiton-repro = { git = "ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git", tag = "v0.4.1" }
# tramiton-sbom renders the bill of materials from a sealed lock (+ binary SCA). # tramiton-sbom renders the bill of materials from a sealed lock (+ binary SCA).
tramiton-sbom = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" } tramiton-sbom = { git = "ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git", tag = "v0.4.1" }
serde = { workspace = true } serde = { workspace = true }
serde_json = { workspace = true } serde_json = { workspace = true }
tokio = { workspace = true } tokio = { workspace = true }