# CI status: ci

Written by the dwarves forge (`dwarves serve`, its `[ci]` table) at 2026-11-01 22:52 UTC. Each pipeline runs on a new head of its branch (polled, last poll 2026-11-01 22:49:55.802378907) or on its cron, one run at a time.

| pipeline | repo | branch | commit | trigger | result | finished (UTC) | took | files |
|---|---|---|---|---|---|---|---|---|
| gunnar-ci | gunnar | master | `5672ebad` | push | 🔴 red | 2026-11-01 20:48 | 20m33s | `runs/gunnar-ci/20261101T2027Z-5672ebad` |
| holger-ci | holger | main | `cd14cdee` | push | 🔴 red | 2026-11-01 21:01 | 0m15s | `runs/holger-ci/20261101T2101Z-cd14cdee` |
| dwarves-ci | dwarves | main | `6ddce5b8` | push | 🔴 red | 2026-11-01 21:53 | 0m11s | `runs/dwarves-ci/20261101T2153Z-6ddce5b8` |
| dwarves-holger | dwarves | main | `472a1eb7` | cron 20 */6 * * * | 🔴 red | 2026-11-01 12:20 | 0m18s | `runs/dwarves-holger/20261101T1220Z-472a1eb7` |
| gunnar-ui-ci | gunnar-ui | main | `10f359b6` | push | 🔴 red | 2026-11-01 19:39 | 14m52s | `runs/gunnar-ui-ci/20261101T1924Z-10f359b6` |
| holger-ui-ci | holger-ui | main | `2c7765fb` | push | 🔴 red | 2026-11-01 21:15 | 5m44s | `runs/holger-ui-ci/20261101T2109Z-2c7765fb` |
| monetize-ci | monetize | main | `e9d2d1b1` | push | 🟡 running |  |  |  |
| edda-ci | edda | main | `1c537a38` | push | 🔴 red | 2026-11-01 22:05 | 12m02s | `runs/edda-ci/20261101T2153Z-1c537a38` |
| heimdall-ci | heimdall | main | `d5be6fa9` | push | 🟢 green | 2026-11-01 22:52 | 41m09s | `runs/heimdall-ci/20261101T2210Z-d5be6fa9` |
| tunnr-drift | tunnr | main | `211de030` | manual | 🟢 green | 2026-11-01 21:50 | 6m23s | `runs/tunnr-drift/20261101T2143Z-211de030` |
| scorecard-gunnar | gunnar | master | `c6c50dd6` | cron 30 2 * * * | 🟢 green | 2026-11-01 02:31 | 1m11s | `runs/scorecard-gunnar/20261101T0230Z-c6c50dd6` |
| scorecard-holger | holger | main | `50cbe685` | cron 30 2 * * * | 🟢 green | 2026-11-01 02:32 | 1m11s | `runs/scorecard-holger/20261101T0231Z-50cbe685` |
| scorecard-heimdall | heimdall | main | `b8ff56c8` | cron 30 2 * * * | 🟢 green | 2026-11-01 02:33 | 1m16s | `runs/scorecard-heimdall/20261101T0232Z-b8ff56c8` |
| monetize-full | monetize | main | `95a34a0c` | cron 15 3 * * * | 🔴 red | 2026-11-01 03:54 | 39m01s | `runs/monetize-full/20261101T0315Z-95a34a0c` |
| fuzz-gunnar | gunnar | master | `c6c50dd6` | cron 0 4 * * * | 🟢 green | 2026-11-01 04:44 | 43m51s | `runs/fuzz-gunnar/20261101T0400Z-c6c50dd6` |
| fuzz-holger | holger | main | `50cbe685` | cron 0 4 * * * | 🟢 green | 2026-11-01 05:19 | 35m29s | `runs/fuzz-holger/20261101T0444Z-50cbe685` |
| coverage-gunnar | gunnar | master | `c6c50dd6` | cron 0 5 * * * | 🔴 red | 2026-11-01 06:01 | 26m39s | `runs/coverage-gunnar/20261101T0535Z-c6c50dd6` |
| coverage-holger | holger | main | `50cbe685` | cron 0 5 * * * | 🟢 green | 2026-11-01 06:08 | 6m10s | `runs/coverage-holger/20261101T0601Z-50cbe685` |
| deps-gunnar | gunnar |  |  |  | ⚪ not run yet |  |  |  |
| deps-holger | holger |  |  |  | ⚪ not run yet |  |  |  |
| fuzz-monetize | monetize | main | `95a34a0c` | cron 0 4 * * * | 🔴 red | 2026-11-01 05:19 | 0m11s | `runs/fuzz-monetize/20261101T0519Z-95a34a0c` |
| fuzz-monetize-impl | monetize | main | `95a34a0c` | cron 0 4 * * * | 🟢 green | 2026-11-01 05:35 | 15m28s | `runs/fuzz-monetize-impl/20261101T0519Z-95a34a0c` |
| coverage-monetize | monetize | main | `95a34a0c` | cron 0 5 * * * | 🔴 red | 2026-11-01 06:14 | 6m16s | `runs/coverage-monetize/20261101T0608Z-95a34a0c` |
| deps-monetize | monetize |  |  |  | ⚪ not run yet |  |  |  |
| scorecard-monetize | monetize | main | `95a34a0c` | cron 30 2 * * * | 🟢 green | 2026-11-01 02:35 | 1m10s | `runs/scorecard-monetize/20261101T0233Z-95a34a0c` |
| bench-gunnar | gunnar |  |  |  | ⚪ not run yet |  |  |  |
| bench-holger | holger |  |  |  | ⚪ not run yet |  |  |  |

## Why red

- **gunnar-ci** `5672ebad`: run explorer-run_pipeline-1793564876511 failed: 0/1 steps passed — `cargo xtask ci --quick` exited 1: test every_default_build_links_only_the_approved_outbound_clients ... FAILED \| thread 'every_default_build_links_only_the_approved_outbound_clients' (7566) panicked at crates/gunnar-recipe/tests/airgap_default_builds.rs:196:5: \| a default build is not an airgap build: \| error: cannot update the lo
- **holger-ci** `cd14cdee`: run explorer-run_pipeline-1793566889754 failed: 0/1 steps passed — `cargo xtask ci --quick` exited 101: error: cannot update the lock file /home/rickard/tgt/ci/src/holger/estate/Cargo.lock because --locked was passed to prevent this
- **dwarves-ci** `6ddce5b8`: run explorer-run_pipeline-1793569991086 failed: 0/1 steps passed — `cargo xtask ci --quick` exited 101: error: linking with `clang` failed: exit status: 1 \| error: could not compile `getrandom` (build script) due to 1 previous error \| error: linking with `clang` failed: exit status: 1 \| error: could not compile `libc` (build script) due to 1 previous error
- **dwarves-holger** `472a1eb7`: run explorer-run_pipeline-1793535620610 failed: 0/1 steps passed — `cargo xtask ci --quick --only build:holger` exited 101: error: linking with `clang` failed: exit status: 1 \| error: could not compile `getrandom` (build script) due to 1 previous error \| error: linking with `clang` failed: exit status: 1 \| error: could not compile `libc` (build script) due to 1 previous error
- **gunnar-ui-ci** `10f359b6`: lockcheck: STALE /home/rickard/tgt/ci/src/gunnar-ui/Cargo.lock: the lock differs from the committed one (a cargo run in this checkout rewrote it, so the committed lock is stale) \| fix: cd /home/rickard/tgt/ci/src/gunnar-ui && cargo metadata --format-version 1 >/dev/null && git add Cargo.lock (commit the lock cargo resolves) \| STALE /home/rickard/tgt/ci/src/gunnar-ui/Cargo.lock: the lock differs fr
- **holger-ui-ci** `2c7765fb`: lockcheck: STALE /home/rickard/tgt/ci/src/holger-ui/browser-tests/Cargo.lock: error: cannot update the lock file /home/rickard/tgt/ci/src/holger-ui/browser-tests/Cargo.lock because --locked was passed to prevent this \| fix: cargo xtask ci lockfollow (runs: cd /home/rickard/tgt/ci/src/holger-ui/browser-tests && cargo update -p estate-front@0.3.3 -p monetize-embed@0.3.0 -p monetize-estate-side@0.3.0
- **edda-ci** `1c537a38`: test: a_classical_only_sshd_is_still_reached_on_curve25519, the_client_negotiates_mlkem768x25519_sha256_with_stock_sshd \| thread 'a_classical_only_sshd_is_still_reached_on_curve25519' (75751) panicked at crates/nornir-git/tests/openssh_kex.rs:43:5:
- **monetize-full** `95a34a0c`: the failing step: lockcheck
- **coverage-gunnar** `c6c50dd6`: run explorer-run_pipeline-1793511319093 failed: 0/1 steps passed — `cargo ci-verbs coverage` exited 1: test every_default_build_links_only_the_approved_outbound_clients ... FAILED \| thread 'every_default_build_links_only_the_approved_outbound_clients' (72317) panicked at crates/gunnar-recipe/tests/airgap_default_builds.rs:196:5: \| a default build is not an airgap build: \| error: cannot update the 
- **fuzz-monetize** `95a34a0c`: run explorer-run_pipeline-1793510378374 failed: 0/1 steps passed — `cargo ci-verbs fuzz --seconds 300` exited 1: error: cannot update the lock file /home/rickard/tgt/ci/src/monetize/fuzz/Cargo.lock because --locked was passed to prevent this
- **coverage-monetize** `95a34a0c`: run explorer-run_pipeline-1793513290207 failed: 1/2 steps passed — `cargo ci-verbs coverage` exited 1: test the_lake_is_bought_laid_updated_and_terminated_on_both_open_axes ... FAILED \| thread 'the_lake_is_bought_laid_updated_and_terminated_on_both_open_axes' (19296) panicked at crates/lake-product/tests/the_lake_lives_its_whole_life.rs:16:5: \| Running unittests src/lib.rs (/backup/ci-target/monet

## scorecard-gunnar

OpenSSF Scorecard v5.6.0, local mode, on `gunnar` at `c6c50dd6`: **9.2 / 10** (the aggregate of the checks local mode runs).

| check | score | reason |
|---|---|---|
| Binary-Artifacts | 10 / 10 | no binaries found in the repo |
| Dangerous-Workflow | 10 / 10 | no dangerous workflow patterns detected |
| Dependency-Update-Tool | 10 / 10 | update tool detected |
| Fuzzing | 10 / 10 | project is fuzzed |
| License | 9 / 10 | license file detected |
| Packaging | inconclusive | packaging workflow not detected |
| Pinned-Dependencies | 10 / 10 | all dependencies are pinned |
| SAST | 0 / 10 | no SAST tool detected |
| Security-Policy | 10 / 10 | security policy file detected |
| Token-Permissions | 10 / 10 | GitHub workflow tokens follow principle of least privilege |
| Vulnerabilities | 10 / 10 | 0 existing vulnerabilities detected |

Not run in local mode (they need a GitHub or GitLab API): Branch-Protection, CI-Tests, CII-Best-Practices, Code-Review, Contributors, Maintained, SBOM, Signed-Releases, Webhooks.

## scorecard-holger

OpenSSF Scorecard v5.6.0, local mode, on `holger` at `50cbe685`: **7.8 / 10** (the aggregate of the checks local mode runs).

| check | score | reason |
|---|---|---|
| Binary-Artifacts | 6 / 10 | binaries present in source code |
| Dangerous-Workflow | inconclusive | no workflows found |
| Dependency-Update-Tool | 10 / 10 | update tool detected |
| Fuzzing | 10 / 10 | project is fuzzed |
| License | 9 / 10 | license file detected |
| Packaging | inconclusive | packaging workflow not detected |
| Pinned-Dependencies | inconclusive | no dependencies found |
| SAST | 0 / 10 | no SAST tool detected |
| Security-Policy | 10 / 10 | security policy file detected |
| Token-Permissions | inconclusive | No tokens found |
| Vulnerabilities | 9 / 10 | 1 existing vulnerabilities detected |

Not run in local mode (they need a GitHub or GitLab API): Branch-Protection, CI-Tests, CII-Best-Practices, Code-Review, Contributors, Maintained, SBOM, Signed-Releases, Webhooks.

## scorecard-heimdall

OpenSSF Scorecard v5.6.0, local mode, on `heimdall` at `b8ff56c8`: **4.9 / 10** (the aggregate of the checks local mode runs).

| check | score | reason |
|---|---|---|
| Binary-Artifacts | 1 / 10 | binaries present in source code |
| Dangerous-Workflow | inconclusive | no workflows found |
| Dependency-Update-Tool | 0 / 10 | no update tool detected |
| Fuzzing | 10 / 10 | project is fuzzed |
| License | 9 / 10 | license file detected |
| Packaging | inconclusive | packaging workflow not detected |
| Pinned-Dependencies | inconclusive | no dependencies found |
| SAST | 0 / 10 | no SAST tool detected |
| Security-Policy | 10 / 10 | security policy file detected |
| Token-Permissions | inconclusive | No tokens found |
| Vulnerabilities | 9 / 10 | 1 existing vulnerabilities detected |

Not run in local mode (they need a GitHub or GitLab API): Branch-Protection, CI-Tests, CII-Best-Practices, Code-Review, Contributors, Maintained, SBOM, Signed-Releases, Webhooks.

## fuzz-gunnar

Fuzzing (libFuzzer through cargo-fuzz's layout, stable cargo) on `gunnar` at `c6c50dd6`: **8 of 8 targets clean**.

| target | result | runs | coverage | corpus | seconds |
|---|---|---|---|---|---|
| commit_signature | clean | 4879940 | 821 | 211 | 301 |
| crypt_files | clean | 57230408 | 666 | 909 | 301 |
| envelope_open | clean | 5779943 | 448 | 86 | 301 |
| object_decode | clean | 14517097 | 290 | 402 | 301 |
| pack_scan | clean | 12017872 | 417 | 577 | 301 |
| receive_preamble | clean | 29861031 | 458 | 302 | 301 |
| sshsig_event | clean | 9633011 | 999 | 586 | 301 |
| upload_request | clean | 31879221 | 425 | 511 | 301 |

## fuzz-holger

Fuzzing (libFuzzer through cargo-fuzz's layout, stable cargo) on `holger` at `50cbe685`: **6 of 6 targets clean**.

| target | result | runs | coverage | corpus | seconds |
|---|---|---|---|---|---|
| apk_index | clean | 10622904 | 825 | 434 | 301 |
| bundle_verify | clean | 474148 | 3089 | 449 | 301 |
| dsse_material | clean | 2222295 | 2627 | 1534 | 301 |
| intoto_statement | clean | 13298468 | 1290 | 1267 | 301 |
| package_metadata | clean | 8759673 | 6587 | 4522 | 301 |
| x509_cert | clean | 7900451 | 2335 | 655 | 301 |

## coverage-gunnar

Test coverage on `gunnar` at `c6c50dd6`: **not measured**: cargo llvm-cov exited exit status: 101: a test failed or it could not build; the step log says which

## coverage-holger

Test coverage (cargo llvm-cov) on `holger` at `50cbe685`: **81.6 %** of lines, 75.0 % of functions, 82.5 % of regions.

| crate | lines |
|---|---|
| errcode | 83.7 % (72 / 86) |
| provenance | 82.1 % (2204 / 2684) |
| server/inspect | 88.6 % (3751 / 4234) |
| server/lib | 80.1 % (39672 / 49528) |
| sync | 94.1 % (1439 / 1530) |
| traits | 86.7 % (1761 / 2030) |
| update-bundle | 86.4 % (2052 / 2374) |

## fuzz-monetize

Fuzzing on `monetize` at `95a34a0c`: **not run**: the fuzz build failed (exit status: 101); its errors are in the step log

## coverage-monetize

Test coverage on `monetize` at `95a34a0c`: **not measured**: cargo llvm-cov exited exit status: 101: a test failed or it could not build; the step log says which

## scorecard-monetize

OpenSSF Scorecard v5.6.0, local mode, on `monetize` at `95a34a0c`: **9.2 / 10** (the aggregate of the checks local mode runs).

| check | score | reason |
|---|---|---|
| Binary-Artifacts | 10 / 10 | no binaries found in the repo |
| Dangerous-Workflow | 10 / 10 | no dangerous workflow patterns detected |
| Dependency-Update-Tool | 10 / 10 | update tool detected |
| Fuzzing | 10 / 10 | project is fuzzed |
| License | 9 / 10 | license file detected |
| Packaging | inconclusive | packaging workflow not detected |
| Pinned-Dependencies | 10 / 10 | all dependencies are pinned |
| SAST | 0 / 10 | no SAST tool detected |
| Security-Policy | 10 / 10 | security policy file detected |
| Token-Permissions | 10 / 10 | GitHub workflow tokens follow principle of least privilege |
| Vulnerabilities | 10 / 10 | 0 existing vulnerabilities detected |

Not run in local mode (they need a GitHub or GitLab API): Branch-Protection, CI-Tests, CII-Best-Practices, Code-Review, Contributors, Maintained, SBOM, Signed-Releases, Webhooks.

## History

| finished (UTC) | pipeline | commit | trigger | result |
|---|---|---|---|---|
| 2026-11-01 22:52 | heimdall-ci | `d5be6fa9` | push | 🟢 green |
| 2026-11-01 22:05 | edda-ci | `1c537a38` | push | 🔴 red |
| 2026-11-01 21:53 | dwarves-ci | `6ddce5b8` | push | 🔴 red |
| 2026-11-01 21:50 | tunnr-drift | `211de030` | manual | 🟢 green |
| 2026-11-01 21:15 | holger-ui-ci | `2c7765fb` | push | 🔴 red |
| 2026-11-01 21:02 | dwarves-ci | `9a956f31` | push | 🔴 red |
| 2026-11-01 21:01 | holger-ci | `cd14cdee` | push | 🔴 red |
| 2026-11-01 20:48 | gunnar-ci | `5672ebad` | push | 🔴 red |
| 2026-11-01 20:07 | tunnr-drift | `383085d3` | manual | 🔴 red |
| 2026-11-01 19:39 | gunnar-ui-ci | `10f359b6` | push | 🔴 red |
| 2026-11-01 19:24 | gunnar-ci | `e5b180e3` | push | 🔴 red |
| 2026-11-01 18:19 | monetize-ci | `ecfdda28` | push | 🔴 red |
| 2026-11-01 17:50 | holger-ui-ci | `266d9cdd` | push | 🔴 red |
| 2026-11-01 17:35 | dwarves-ci | `fcc42f16` | push | 🔴 red |
| 2026-11-01 17:33 | holger-ci | `29c8242f` | push | 🔴 red |
| 2026-11-01 17:12 | gunnar-ci | `ea31b3c1` | push | 🔴 red |
| 2026-11-01 12:20 | dwarves-holger | `472a1eb7` | cron 20 */6 * * * | 🔴 red |
| 2026-11-01 11:03 | monetize-ci | `8f9e4105` | push | 🔴 red |
| 2026-11-01 10:48 | gunnar-ui-ci | `cc47079a` | push | 🔴 red |
| 2026-11-01 10:40 | holger-ci | `de14ed73` | push | 🔴 red |
| 2026-11-01 10:39 | monetize-ci | `42bfe1fc` | push | 🔴 red |
| 2026-11-01 10:18 | holger-ci | `4cfc055f` | push | 🔴 red |
| 2026-11-01 10:18 | holger-ui-ci | `06b2f3c4` | push | 🔴 red |
| 2026-11-01 10:12 | gunnar-ui-ci | `0cf16525` | push | 🔴 red |
| 2026-11-01 09:56 | holger-ci | `bf17f87b` | push | 🔴 red |

The files of a run (the forge's step log, the repository's own `receipt.json` and step logs) are in this repository under `runs/<pipeline>/`; clone it with `git clone ssh://anonymous@git.gunnar.rs:2222/nordisk/ci-status.git`.