From 72de1bd6bd7b470584cce27bb304aac6a694fc48 Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Fri, 13 Nov 2026 22:18:46 +0800
Subject: [PATCH] chore(ci): pin pr-governance to i18n allowlist

Pick up the configuration-secret-value allowlist for message catalogs
so token.* i18n keys stop failing secret scan.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/codex-nudge.yml      | 4 ++--
 .github/workflows/gitleaks.yml         | 4 ++--
 .github/workflows/pr-review-signal.yml | 2 +-
 .github/workflows/risk-gate.yml        | 6 +++---
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/codex-nudge.yml b/.github/workflows/codex-nudge.yml
index 27e5c28..3a3ef67 100644
--- a/.github/workflows/codex-nudge.yml
+++ b/.github/workflows/codex-nudge.yml
@@ -1,4 +1,4 @@
-# Shared governance action: GdeiAssistant/.github/pr-governance@b25f3dd3e5c78905c2302b342af984f6ef186466.
+# Shared governance action: GdeiAssistant/.github/pr-governance@4c296692ae2efbce09bc21b6641299f368435c40.
 # Keep the job names; they are required status check contexts.
 
 name: Review request
@@ -24,6 +24,6 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Request
-        uses: GdeiAssistant/.github/pr-governance@b25f3dd3e5c78905c2302b342af984f6ef186466
+        uses: GdeiAssistant/.github/pr-governance@4c296692ae2efbce09bc21b6641299f368435c40
         with:
           mode: nudge
diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
index 24a6d0c..077e162 100644
--- a/.github/workflows/gitleaks.yml
+++ b/.github/workflows/gitleaks.yml
@@ -1,4 +1,4 @@
-# Shared governance action: GdeiAssistant/.github/pr-governance@b25f3dd3e5c78905c2302b342af984f6ef186466.
+# Shared governance action: GdeiAssistant/.github/pr-governance@4c296692ae2efbce09bc21b6641299f368435c40.
 # Keep the job names; they are required status check contexts.
 
 name: Secret scan
@@ -22,6 +22,6 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Scan added commits
-        uses: GdeiAssistant/.github/pr-governance@b25f3dd3e5c78905c2302b342af984f6ef186466
+        uses: GdeiAssistant/.github/pr-governance@4c296692ae2efbce09bc21b6641299f368435c40
         with:
           mode: scan
diff --git a/.github/workflows/pr-review-signal.yml b/.github/workflows/pr-review-signal.yml
index 55e94af..1703632 100644
--- a/.github/workflows/pr-review-signal.yml
+++ b/.github/workflows/pr-review-signal.yml
@@ -1,4 +1,4 @@
-# Shared governance action: GdeiAssistant/.github/pr-governance@b25f3dd3e5c78905c2302b342af984f6ef186466.
+# Shared governance action: GdeiAssistant/.github/pr-governance@4c296692ae2efbce09bc21b6641299f368435c40.
 # Keep the job names; they are required status check contexts.
 
 name: PR review signal
diff --git a/.github/workflows/risk-gate.yml b/.github/workflows/risk-gate.yml
index a7e339e..3a50163 100644
--- a/.github/workflows/risk-gate.yml
+++ b/.github/workflows/risk-gate.yml
@@ -1,4 +1,4 @@
-# Shared governance action: GdeiAssistant/.github/pr-governance@6cb40f70602acf28587a66bc2a07181af9a46cb4.
+# Shared governance action: GdeiAssistant/.github/pr-governance@4c296692ae2efbce09bc21b6641299f368435c40.
 # Keep the job names; they are required status check contexts.
 
 name: PR risk gate
@@ -50,7 +50,7 @@ jobs:
       statuses: write
     steps:
       - name: Record label head
-        uses: GdeiAssistant/.github/pr-governance@6cb40f70602acf28587a66bc2a07181af9a46cb4
+        uses: GdeiAssistant/.github/pr-governance@4c296692ae2efbce09bc21b6641299f368435c40
         env:
           GOVERNANCE_OWNER_ID: ${{ vars.RISK_GATE_OWNER_ID }}
           GOVERNANCE_OWNER_LOGIN: ${{ vars.RISK_GATE_OWNER }}
@@ -83,7 +83,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Evaluate
-        uses: GdeiAssistant/.github/pr-governance@6cb40f70602acf28587a66bc2a07181af9a46cb4
+        uses: GdeiAssistant/.github/pr-governance@4c296692ae2efbce09bc21b6641299f368435c40
         env:
           GOVERNANCE_OWNER_ID: ${{ vars.RISK_GATE_OWNER_ID }}
           GOVERNANCE_OWNER_LOGIN: ${{ vars.RISK_GATE_OWNER }}