fix(deps): repoint tramiton git-deps to the renamed firmwerk repo (fixes CI) #240

Merged

sharang merged 2 commits from fix/firmwerk-dep-repoint into main 2026-08-31 17:09:09 +00:00

Conversation 0 Commits 2 Files Changed 2

+20 -18

sharang commented 2026-08-31 16:23:09 +00:00

Owner

Copy Link

Copy Source

Problem

CI / Check and every Deploy job are red on main and all PRs. Root cause is a stale private git-dependency URL, not any code:

compliance-agent/Cargo.toml pinned tramiton-core/-repro/-sbom at ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git, which went stale two ways:

1. #231 repointed the CI insteadOf rewrite to git.breakpilot.com — so it no longer matches the old gitea.meghsakha.com host, and Cargo falls back to a raw SSH clone → Host key verification failed → failed to get tramiton-core as a dependency.
2. The repo was renamed tramiton → firmwerk (git.breakpilot.com/sharang/firmwerk), so the old path is gone too.

Fix

Repoint the three git-deps to ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git, tag unchanged (v0.4.1 = the same commit ae4fc137 our lock already pinned, where the crates are still named tramiton-*), and update the matching Cargo.lock source URLs. Pure repoint — no crate rename, no code change.

Validated locally

• cargo fetch ✓ and cargo metadata --offline ✓ resolve the dep from the new URL
• resolved source = git+ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git?tag=v0.4.1
• firmwerk clone lands in cargo's git db; commit hash identical to before (ae4fc137)

Follow-up (not here)

At firmwerk main the crates were renamed to firmwerk-core/-repro/-sbom (under crates/) and there's a newer v0.4.2. Migrating the deps + the ~16 tramiton_* call sites to the firmwerk-* crates at a newer tag is a separate change (possible API drift); this PR only unblocks CI on the identical pinned code. Consider renaming the TRAMITON_FETCH_TOKEN secret to match too.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv

## Problem `CI / Check` and every Deploy job are **red on `main` and all PRs**. Root cause is a stale private git-dependency URL, not any code: `compliance-agent/Cargo.toml` pinned `tramiton-core/-repro/-sbom` at `ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git`, which went stale **two ways**: 1. **#231** repointed the CI `insteadOf` rewrite to `git.breakpilot.com` — so it no longer matches the old `gitea.meghsakha.com` host, and Cargo falls back to a raw SSH clone → `Host key verification failed` → `failed to get tramiton-core as a dependency`. 2. The repo was **renamed tramiton → firmwerk** (`git.breakpilot.com/sharang/firmwerk`), so the old path is gone too. ## Fix Repoint the three git-deps to `ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git`, **tag unchanged** (`v0.4.1` = the same commit `ae4fc137` our lock already pinned, where the crates are still named `tramiton-*`), and update the matching `Cargo.lock` source URLs. **Pure repoint** — no crate rename, no code change. ## Validated locally - `cargo fetch` ✓ and `cargo metadata --offline` ✓ resolve the dep from the new URL - resolved source = `git+ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git?tag=v0.4.1` - firmwerk clone lands in cargo's git db; commit hash identical to before (`ae4fc137`) ## Follow-up (not here) At firmwerk `main` the crates were renamed to `firmwerk-core/-repro/-sbom` (under `crates/`) and there's a newer `v0.4.2`. Migrating the deps + the ~16 `tramiton_*` call sites to the firmwerk-* crates at a newer tag is a separate change (possible API drift); this PR only unblocks CI on the identical pinned code. Consider renaming the `TRAMITON_FETCH_TOKEN` secret to match too. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv

sharang added 1 commit 2026-08-31 16:23:10 +00:00

fix(deps): repoint tramiton git-deps to the renamed firmwerk repo (fixes CI) ... b5c33bdd52

The private git-dependency still pointed at
ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git, which is stale two
ways: #231 repointed the host to git.breakpilot.com, and the repo was renamed
tramiton -> firmwerk. The CI `insteadOf` rewrite is keyed on git.breakpilot.com,
so it never matched the old host and Cargo fell back to a raw SSH clone of a dead
host -> "Host key verification failed" -> "failed to get tramiton-core as a
dependency". This broke `CI / Check` and every Deploy job on main and all PRs.

Repoint the three git-deps (tramiton-core/-repro/-sbom) to
ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git, tag unchanged (v0.4.1 =
same commit ae4fc137, where the crates are still named tramiton-*), and update
the matching Cargo.lock source URLs. Pure repoint — no crate rename, no code
change. Migrating the deps to the firmwerk-* crates at a newer tag is a
follow-up.

Validated: `cargo fetch` + `cargo metadata --offline` resolve the dep from the
new URL; resolved source is git+ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git?tag=v0.4.1.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv

sharang added 1 commit 2026-08-31 16:59:04 +00:00

fix(deps): bump h2 0.4.13 -> 0.4.19 (RUSTSEC-2026-0258, unblocks CI audit) ... 20067fcf44

The CI Security Audit step fails on RUSTSEC-2026-0258 — "h2 unbounded empty
DATA frames" (DoS), fixed in h2 >= 0.4.16. h2 is a transitive dependency
(hyper/reqwest), so this is a lockfile-only bump; no Cargo.toml or code change,
diff limited to the single version line. The remaining audit findings (anyhow,
git2, lru) are `unsound` warnings, not vulnerabilities, and do not fail the step.

Folded into this CI-fix PR because the audit gate blocks every PR from going
green, including this one.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv

sharang merged commit e0c54c4659 into main 2026-08-31 17:09:09 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

P0-demo

CERTifAI P0 demo build tickets (CS-*)

bug

critical

enhancement

epic

Tracking issue spanning multiple sub-issues

high

infrastructure

onboarding

Multi-target onboarding wizard redesign

performance

security

v0.3.0

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Benjamin_Boenisch sharang (Sharang Parnerkar)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#240