From bfd0ef16d673dbbc99efbc005843b81ec76f0449 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 26 Jul 2026 14:49:46 +0100
Subject: [PATCH 1/4] chore: estate-wide security compliance

---
 .github/workflows/boj-build.yml            | 1 +
 .github/workflows/casket-pages.yml         | 1 +
 .github/workflows/codeql.yml               | 1 +
 .github/workflows/dependabot-automerge.yml | 1 +
 .github/workflows/dogfood-gate.yml         | 1 +
 .github/workflows/governance.yml           | 1 +
 .github/workflows/hypatia-scan.yml         | 1 +
 .github/workflows/instant-sync.yml         | 1 +
 .github/workflows/mirror.yml               | 1 +
 .github/workflows/pages.yml                | 1 +
 .github/workflows/php-lint.yml             | 1 +
 .github/workflows/php-security.yml         | 1 +
 .github/workflows/push-email-notify.yml    | 1 +
 .github/workflows/scorecard.yml            | 1 +
 .github/workflows/secret-scanner.yml       | 1 +
 .github/workflows/workflow-linter.yml      | 1 +
 16 files changed, 16 insertions(+)

diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index 550717b..6c50439 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -16,4 +16,5 @@ jobs:
           curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke"             -H "Content-Type: application/json"             -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"}
         continue-on-error: true
 permissions:
+  actions: read
   contents: read
diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index a9ef4f5..b4a3b1f 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -7,6 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   pages: write
   id-token: write
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 2c23bc9..e7a20e6 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,6 +18,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index ca86baa..ef640a5 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -41,6 +41,7 @@ on:
     types: [opened, reopened, synchronize]
 
 permissions:
+  actions: read
   contents: write        # needed to enable auto-merge
   pull-requests: write   # needed to approve
   # NB: keep narrow — do NOT add secrets: read or id-token: write here.
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index 8d71e45..452e1ea 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -13,6 +13,7 @@ on:
     branches: [main, master]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 62bbc98..906741d 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -27,6 +27,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 2e7e939..013c95a 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -19,6 +19,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
   security-events: write
   pull-requests: write
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index 228dc43..0f86f6c 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -9,6 +9,7 @@ on:
     types: [published]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 81e9903..c25d3bc 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -7,6 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index a1a1aa3..31f3ddc 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -5,6 +5,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
   pages: write
   id-token: write
diff --git a/.github/workflows/php-lint.yml b/.github/workflows/php-lint.yml
index cbafcac..9d6a3ef 100644
--- a/.github/workflows/php-lint.yml
+++ b/.github/workflows/php-lint.yml
@@ -25,6 +25,7 @@ on:
       - '.github/workflows/php-lint.yml'
 
 permissions:
+  actions: read
   contents: read
 
 env:
diff --git a/.github/workflows/php-security.yml b/.github/workflows/php-security.yml
index aa0ff42..22abb01 100644
--- a/.github/workflows/php-security.yml
+++ b/.github/workflows/php-security.yml
@@ -13,6 +13,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 2a95f5d..c08ea16 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -7,6 +7,7 @@ name: Push email notification
 on:
   push: {}
 permissions:
+  actions: read
   contents: read
 jobs:
   notify:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 64ac2ac..f0c8699 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -9,6 +9,7 @@ on:
     branches: [main]
 
 permissions: read-all
+  actions: read
 
 jobs:
   analysis:
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index b3486fc..4839d60 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -11,6 +11,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
index 5844dfb..a387345 100644
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -11,6 +11,7 @@ on:
       - '.github/workflows/**'
 
 permissions: read-all
+  actions: read
 
 jobs:
   lint-workflows:

From 859c3a02b40c195599eae4c54b43c5f1fbe9a0c7 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 26 Jul 2026 15:44:08 +0100
Subject: [PATCH 2/4] fix: update CodeQL actions to SHA-pinned v3 (29b1f65c)

---
 .github/workflows/codeql.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e7a20e6..951962b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -39,12 +39,12 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
+        uses: github/codeql-action/init@29b1f65c1f735799893313399435a59f54045865 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
+        uses: github/codeql-action/analyze@29b1f65c1f735799893313399435a59f54045865 # v3
         with:
           category: "/language:${{ matrix.language }}"

From 599d54294eab076fccaf3e750063dcdde7748859 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 26 Jul 2026 16:03:58 +0100
Subject: [PATCH 3/4] chore: update guix.scm from squisher-corpus

---
 guix.scm | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/guix.scm b/guix.scm
index ae81b1d..c6dd7be 100644
--- a/guix.scm
+++ b/guix.scm
@@ -1,5 +1,5 @@
 ; SPDX-License-Identifier: MPL-2.0
-;; guix.scm — GNU Guix package definition for php-aegis
+;; guix.scm — GNU Guix package definition for squisher-corpus
 ;; Usage: guix shell -f guix.scm
 
 (use-modules (guix packages)
@@ -7,12 +7,12 @@
              (guix licenses))
 
 (package
-  (name "php-aegis")
+  (name "squisher-corpus")
   (version "0.1.0")
   (source #f)
   (build-system gnu-build-system)
-  (synopsis "php-aegis")
-  (description "php-aegis — part of the hyperpolymath ecosystem.")
-  (home-page "https://github.com/hyperpolymath/php-aegis")
+  (synopsis "squisher-corpus")
+  (description "squisher-corpus — part of the hyperpolymath ecosystem.")
+  (home-page "https://github.com/hyperpolymath/squisher-corpus")
   (license ((@@ (guix licenses) license) "PMPL-1.0-or-later"
              "https://github.com/hyperpolymath/palimpsest-license")))

From 407d80cf573416de0b5402bec2ed1c1caf711e8f Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 27 Jul 2026 19:07:56 +0100
Subject: [PATCH 4/4] fix(ci): repoint codeql-action at a SHA that exists

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no
repository -- the GitHub API returns 422 for it. CodeQL therefore could
not start: the run graph fails to build and the job reports
startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3
tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA is pinned in
over 100 repositories, so CodeQL is dead across nearly all of them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .github/workflows/codeql.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 951962b..cb3a548 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -39,12 +39,12 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@29b1f65c1f735799893313399435a59f54045865 # v3
+        uses: github/codeql-action/init@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@29b1f65c1f735799893313399435a59f54045865 # v3
+        uses: github/codeql-action/analyze@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
         with:
           category: "/language:${{ matrix.language }}"