From a20220621a46a215dac4b9ea5adfb58b3bf263f1 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 1 Jun 2026 21:58:27 +0100 Subject: [PATCH] ci(security): SHA-pin standards/governance-reusable.yml from @main Two governance.yml files invoke a reusable workflow via the floating @main ref. SHA-pin to 1376eb6251fa9beeaea75241739b1d00dd6b4028 (standards main as of 2026-06-01) to prevent supply-chain drift. Per estate [SHA-pin discipline] convention; the comment includes the upstream branch name + date for human-readable bump reference. Salvaged from the M1 foreign-WIP triage (where the same fix was queued against an older SHA 861b5e911...). Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/governance.yml | 2 +- alkahest-shell-transmuter/.github/workflows/governance.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 653ef982..92ab9844 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -31,4 +31,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@1376eb6251fa9beeaea75241739b1d00dd6b4028 # standards main 2026-06-01 diff --git a/alkahest-shell-transmuter/.github/workflows/governance.yml b/alkahest-shell-transmuter/.github/workflows/governance.yml index b0b1ed6d..4bf656f2 100644 --- a/alkahest-shell-transmuter/.github/workflows/governance.yml +++ b/alkahest-shell-transmuter/.github/workflows/governance.yml @@ -23,4 +23,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@1376eb6251fa9beeaea75241739b1d00dd6b4028 # standards main 2026-06-01