From f74a4e2210d527dc7d2a3c3632ec4a1a26bcee64 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 27 Jun 2026 16:47:05 +0100
Subject: [PATCH 1/3] ci: re-pin governance reusable to standards HEAD d7c2271
 (hypatia#464)

---
 .github/workflows/governance.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 297d965..99d39de 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -27,5 +27,5 @@ permissions:
   contents: read
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
-    timeout-minutes: 10
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
+    timeout-minutes: 10
\ No newline at end of file

From d040d9b7708be8f2e9b1a2ae018f9d8aaa56c1a2 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 27 Jun 2026 16:47:07 +0100
Subject: [PATCH 2/3] ci: re-pin scorecard reusable to standards HEAD d7c2271
 (hypatia#464)

---
 .github/workflows/scorecard.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 8ba6367..4ba7e9f 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -13,6 +13,6 @@ jobs:
     permissions:
       security-events: write
       id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
     timeout-minutes: 10
-    secrets: inherit
+    secrets: inherit
\ No newline at end of file

From f9f8d485bb6eb91a4e5abc47224627c785d3fa3f Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 27 Jun 2026 16:47:08 +0100
Subject: [PATCH 3/3] ci: remove retired scorecard-enforcer.yml (hypatia#464)

---
 .github/workflows/scorecard-enforcer.yml | 75 ------------------------
 1 file changed, 75 deletions(-)
 delete mode 100644 .github/workflows/scorecard-enforcer.yml

diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml
deleted file mode 100644
index b695f41..0000000
--- a/.github/workflows/scorecard-enforcer.yml
+++ /dev/null
@@ -1,75 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-# Prevention workflow - runs OpenSSF Scorecard and fails on low scores
-name: OpenSSF Scorecard Enforcer
-on:
-  push:
-    branches: [main]
-  schedule:
-    - cron: '0 6 * * 1' # Weekly on Monday
-  workflow_dispatch:
-# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
-# updates do not pile up queued runs against the shared account-wide
-# Actions concurrency pool. Applied only to read-only check workflows
-# (no publish/mutation), so cancelling a superseded run is always safe.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-permissions:
-  contents: read
-jobs:
-  scorecard:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      security-events: write
-      id-token: write # For OIDC
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      - name: Run Scorecard
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          publish_results: true
-      - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4
-        with:
-          sarif_file: results.sarif
-      - name: Upload results artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: scorecard-sarif
-          path: results.sarif
-          retention-days: 1
-  # The score gate runs the check via a local composite action so this
-  # scorecard-publishing workflow file contains no run: steps (the publish job
-  # holds the OIDC id-token; run logic lives in .github/actions/*).
-  score-gate:
-    needs: scorecard
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      - name: Download results artifact
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: scorecard-sarif
-      - name: Gate on minimum score
-        uses: ./.github/actions/scorecard-gate
-        with:
-          sarif: results.sarif
-          min-score: "5"
-  # Check specific high-priority items (run logic in a local composite action).
-  check-critical:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Repository security checks
-        uses: ./.github/actions/repo-security-checks