From e361afc7acf8b47ae1c83fa3a244530cd00c3703 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 21 Jun 2026 01:00:34 +0100
Subject: [PATCH 1/3] ci: adopt standards reusable workflows for Scorecard,
 Hypatia, and Governance

---
 .github/workflows/governance.yml         | 16 ++++
 .github/workflows/hypatia-scan.yml       | 21 ++---
 .github/workflows/scorecard-enforcer.yml | 99 ------------------------
 .github/workflows/scorecard.yml          | 27 ++++---
 4 files changed, 36 insertions(+), 127 deletions(-)
 create mode 100644 .github/workflows/governance.yml
 delete mode 100644 .github/workflows/scorecard-enforcer.yml

diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
new file mode 100644
index 0000000..2674263
--- /dev/null
+++ b/.github/workflows/governance.yml
@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+name: Governance
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  governance:
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@b89b2ef1e98928fce53a85e83c37f23a1d99f6d3
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 0776fac..736b63f 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -1,8 +1,6 @@
-# SPDX-License-Identifier: MPL-2.0
-# Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml.
-# See standards#191 for the reusable's purpose and design.
-
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: Hypatia Security Scan
+
 on:
   push:
     branches: [main, master, develop]
@@ -11,16 +9,11 @@ on:
   schedule:
     - cron: '0 0 * * 0'
   workflow_dispatch:
-# Estate guardrail: cancel superseded runs so re-pushes don't pile up.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+
 permissions:
   contents: read
-  security-events: write
-  pull-requests: write
+  security-events: read
+
 jobs:
-  hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242
-    timeout-minutes: 10
-    secrets: inherit
+  scan:
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@b89b2ef1e98928fce53a85e83c37f23a1d99f6d3
diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml
deleted file mode 100644
index 109b1eb..0000000
--- a/.github/workflows/scorecard-enforcer.yml
+++ /dev/null
@@ -1,99 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-# Prevention workflow - runs OpenSSF Scorecard and fails on low scores
-name: OpenSSF Scorecard Enforcer
-on:
-  push:
-    branches: [main]
-  schedule:
-    - cron: '0 6 * * 1' # Weekly on Monday
-  workflow_dispatch:
-# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
-# updates do not pile up queued runs against the shared account-wide
-# Actions concurrency pool. Applied only to read-only check workflows
-# (no publish/mutation), so cancelling a superseded run is always safe.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-permissions:
-  contents: read
-jobs:
-  # The OSSF Scorecard publish endpoint enforces a hard contract: the job that
-  # runs `ossf/scorecard-action` with `publish_results: true` must contain
-  # ONLY steps with `uses:` (no `run:` steps in the same job). If a `run:`
-  # step is present, the publish step fails with:
-  #   "webapp: scorecard job must only have steps with uses"
-  # (49 estate repos hit this; see ROADMAP audit 2026-05-30.)
-  #
-  # Fix: split the threshold check into a downstream job that depends on
-  # `scorecard` and consumes the SARIF artifact. The `scorecard` job stays
-  # uses-only; `check-score` is the gating job that emits the error.
-  scorecard:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      security-events: write
-      id-token: write # For OIDC
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      - name: Run Scorecard
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          publish_results: true
-      - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4
-        with:
-          sarif_file: results.sarif
-      - name: Persist SARIF for downstream score-gate job
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
-        with:
-          name: scorecard-results
-          path: results.sarif
-          retention-days: 1
-  check-score:
-    needs: scorecard
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: read
-    steps:
-      - name: Download SARIF from scorecard job
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v5.0.0
-        with:
-          name: scorecard-results
-      - name: Check minimum score
-        run: |
-          SCORE=$(jq -r '.runs[0].tool.driver.properties.score // 0' results.sarif 2>/dev/null || echo "0")
-
-          echo "OpenSSF Scorecard Score: $SCORE"
-
-          # Minimum acceptable score (0-10 scale)
-          MIN_SCORE=5
-
-          if [ "$(echo "$SCORE < $MIN_SCORE" | bc -l)" = "1" ]; then
-            echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE"
-            exit 1
-          fi
-  # Check specific high-priority items
-  check-critical:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Check SECURITY.md exists
-        run: |
-          if [ ! -f "SECURITY.md" ]; then
-            echo "::error::SECURITY.md is required"
-            exit 1
-          fi
-      - name: Check for pinned dependencies
-        run: |
-          # Check workflows for unpinned actions
-          unpinned=$(grep -r "uses:.*@v[0-9]" .github/workflows/*.yml 2>/dev/null | grep -v "#" | head -5 || true)
-          if [ -n "$unpinned" ]; then
-            echo "::warning::Found unpinned actions:"
-            echo "$unpinned"
-          fi
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index b67a16e..0c31a3e 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -1,17 +1,16 @@
-# SPDX-License-Identifier: MPL-2.0
-name: Scorecards supply-chain security
+# SPDX-License-Identifier: PMPL-1.0-or-later
+name: OSSF Scorecard
+
 on:
-  branch_protection_rule:
-  schedule:
-    - cron: '23 4 * * 1'
   push:
-    branches: [main]
-permissions: read-all
+    branches: [main, master]
+  schedule:
+    - cron: '0 4 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
 jobs:
-  analysis:
-    permissions:
-      security-events: write
-      id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e0caf11508a3989574713c78f5f444f2ce5e33ef
-    timeout-minutes: 10
-    secrets: inherit
+  scorecard:
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@b89b2ef1e98928fce53a85e83c37f23a1d99f6d3

From b2f6a70c183e0a06b8fc91b8e21a203a94ec497d Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 21 Jun 2026 01:15:21 +0100
Subject: [PATCH 2/3] ci: adopt standards reusable workflows for Scorecard,
 Hypatia, and Governance

---
 .github/workflows/governance.yml   | 2 +-
 .github/workflows/hypatia-scan.yml | 2 +-
 .github/workflows/scorecard.yml    | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 2674263..31d497f 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -13,4 +13,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@b89b2ef1e98928fce53a85e83c37f23a1d99f6d3
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5a93d9da1bbf6ca9eb4eec89e900c733f114c995
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 736b63f..ce9ce4c 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -16,4 +16,4 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@b89b2ef1e98928fce53a85e83c37f23a1d99f6d3
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5a93d9da1bbf6ca9eb4eec89e900c733f114c995
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 0c31a3e..987033d 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -13,4 +13,4 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@b89b2ef1e98928fce53a85e83c37f23a1d99f6d3
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5a93d9da1bbf6ca9eb4eec89e900c733f114c995

From 3f6ef534677e73ca4d046a779490dd54792c7397 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 21 Jun 2026 01:20:24 +0100
Subject: [PATCH 3/3] ci: adopt standards reusable workflows for Scorecard,
 Hypatia, and Governance

---
 .github/workflows/governance.yml   | 2 +-
 .github/workflows/hypatia-scan.yml | 2 +-
 .github/workflows/scorecard.yml    | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 31d497f..8161ec2 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -13,4 +13,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5a93d9da1bbf6ca9eb4eec89e900c733f114c995
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5a93d9d57cc04de4002d6d0ecd336fc7a8698910
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index ce9ce4c..e715848 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -16,4 +16,4 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5a93d9da1bbf6ca9eb4eec89e900c733f114c995
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5a93d9d57cc04de4002d6d0ecd336fc7a8698910
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 987033d..47acbb5 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -13,4 +13,4 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5a93d9da1bbf6ca9eb4eec89e900c733f114c995
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5a93d9d57cc04de4002d6d0ecd336fc7a8698910