From 4c869e77e7af64fd47ecdf14a810446db1c55cf9 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 09:57:46 +0100 Subject: [PATCH 1/2] chore: update workflow SHAs to @7fdc2705 Estate-wide SHA update per hyperpolymath/standards#426 Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/secret-scanner.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index ee6e8e12..80479208 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -16,5 +16,5 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 secrets: inherit From e8e3bced95e666da9f650483c24f8c19a4efd488 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 22:53:02 +0100 Subject: [PATCH 2/2] fix(ci): pin actions to SHAs and fix K9 formats --- .github/workflows/codeql.yml | 2 +- .github/workflows/dependabot-automerge.yml | 2 +- .github/workflows/dogfood-gate.yml | 10 +++++----- .github/workflows/guix-nix-policy.yml | 2 +- .github/workflows/index-freshness.yml | 2 +- .github/workflows/ingest.yml | 2 +- .github/workflows/instant-sync.yml | 2 +- .github/workflows/jekyll-gh-pages.yml | 10 +++++----- .github/workflows/jekyll.yml | 10 +++++----- .github/workflows/push-email-notify.yml | 2 +- .github/workflows/quality.yml | 6 +++--- .github/workflows/rsr-antipattern.yml | 2 +- .github/workflows/runtime-policy.yml | 2 +- .github/workflows/security-policy.yml | 2 +- .github/workflows/wellknown-enforcement.yml | 2 +- .github/workflows/workflow-linter.yml | 2 +- .github/workflows/zig-ffi.yml | 2 +- .../svc/k9/burble-metadata.k9.ncl | 4 +++- .../svc/k9/examples/ci-config.k9.ncl | 18 ++++++++++-------- .../svc/k9/examples/project-metadata.k9.ncl | 8 +++++--- .../svc/k9/examples/setup-repo.k9.ncl | 4 +++- .machine_readable/svc/k9/template-hunt.k9.ncl | 4 +++- .../svc/k9/template-kennel.k9.ncl | 4 +++- .machine_readable/svc/k9/template-yard.k9.ncl | 4 +++- 24 files changed, 61 insertions(+), 47 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9019e927..5d1a5b3e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -26,7 +26,7 @@ jobs: build-mode: none steps: - name: Checkout - uses: actions/checkout@v6.0.1 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: Initialize CodeQL uses: github/codeql-action/init@v4.31.10 diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 394f1b3e..409ffd6b 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -55,7 +55,7 @@ jobs: steps: - name: Fetch Dependabot metadata id: meta - uses: dependabot/fetch-metadata@v2.2.0 + uses: dependabot/fetch-metadata@dbb049abf0d677abbd7f7eee0375145b417fdd34 # v2.2.0 with: github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index a4ed6ced..886da9da 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.3.1 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Check for A2ML files id: detect @@ -70,7 +70,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.3.1 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Check for K9 files id: detect @@ -119,7 +119,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.3.1 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Scan for invisible characters id: lint @@ -183,7 +183,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.3.1 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Check for Groove manifest id: groove @@ -243,7 +243,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.3.1 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Generate dogfooding scorecard run: | diff --git a/.github/workflows/guix-nix-policy.yml b/.github/workflows/guix-nix-policy.yml index c4ff56da..f2e84dd6 100644 --- a/.github/workflows/guix-nix-policy.yml +++ b/.github/workflows/guix-nix-policy.yml @@ -20,7 +20,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v6.0.1 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: Enforce Guix primary / Nix fallback run: | # Check for package manager files diff --git a/.github/workflows/index-freshness.yml b/.github/workflows/index-freshness.yml index 9c7feee6..cfaaa1e8 100644 --- a/.github/workflows/index-freshness.yml +++ b/.github/workflows/index-freshness.yml @@ -35,7 +35,7 @@ jobs: timeout-minutes: 5 steps: - name: Checkout (with history; regen-index needs git log on scans/) - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 diff --git a/.github/workflows/ingest.yml b/.github/workflows/ingest.yml index d926e856..c00898ee 100644 --- a/.github/workflows/ingest.yml +++ b/.github/workflows/ingest.yml @@ -28,7 +28,7 @@ jobs: ingest: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4.3.1 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 1eada03d..2aef6afe 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Trigger Propagation - uses: peter-evans/repository-dispatch@v4.0.1 + uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 with: token: ${{ secrets.FARM_DISPATCH_TOKEN }} repository: hyperpolymath/.git-private-farm diff --git a/.github/workflows/jekyll-gh-pages.yml b/.github/workflows/jekyll-gh-pages.yml index 7d2d1e8b..498a1746 100644 --- a/.github/workflows/jekyll-gh-pages.yml +++ b/.github/workflows/jekyll-gh-pages.yml @@ -29,16 +29,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Pages - uses: actions/configure-pages@v5.0.0 + uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0 - name: Build with Jekyll - uses: actions/jekyll-build-pages@v1.0.13 + uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697 # v1.0.13 with: source: ./ destination: ./_site - name: Upload artifact - uses: actions/upload-pages-artifact@v3.0.1 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 # Deployment job deploy: @@ -50,4 +50,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4.0.5 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 diff --git a/.github/workflows/jekyll.yml b/.github/workflows/jekyll.yml index 498473fb..32ab789d 100644 --- a/.github/workflows/jekyll.yml +++ b/.github/workflows/jekyll.yml @@ -34,17 +34,17 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Ruby # https://github.com/ruby/setup-ruby/releases/tag/v1.207.0 - uses: ruby/setup-ruby@v1.283.0 + uses: ruby/setup-ruby@708024e6c902387ab41de36e1669e43b5ee7085e # v1.283.0 with: ruby-version: '3.1' # Not needed with a .ruby-version file bundler-cache: true # runs 'bundle install' and caches installed gems automatically cache-version: 0 # Increment this number if you need to re-download cached gems - name: Setup Pages id: pages - uses: actions/configure-pages@v5.0.0 + uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0 - name: Build with Jekyll # Outputs to the './_site' directory by default run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}" @@ -52,7 +52,7 @@ jobs: JEKYLL_ENV: production - name: Upload artifact # Automatically uploads an artifact from the './_site' directory by default - uses: actions/upload-pages-artifact@v3.0.1 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 # Deployment job deploy: @@ -64,4 +64,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4.0.5 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index b69c87f3..b89ced93 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Send push notification email - uses: dawidd6/action-send-mail@v3.12.0 + uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index fab0fc09..bd846d3a 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -21,7 +21,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v6.0.1 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: Check file permissions run: | @@ -37,7 +37,7 @@ jobs: find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files" - name: EditorConfig check - uses: editorconfig-checker/action-editorconfig-checker@v2.1.0 + uses: editorconfig-checker/action-editorconfig-checker@4b6cd6190d435e7e084fb35e36a096e98506f7b9 # v2.1.0 continue-on-error: true docs: @@ -45,7 +45,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v6.0.1 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: Check documentation run: | MISSING="" diff --git a/.github/workflows/rsr-antipattern.yml b/.github/workflows/rsr-antipattern.yml index e97147b2..68f74d31 100644 --- a/.github/workflows/rsr-antipattern.yml +++ b/.github/workflows/rsr-antipattern.yml @@ -22,7 +22,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v6.0.1 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: Check for TypeScript run: | diff --git a/.github/workflows/runtime-policy.yml b/.github/workflows/runtime-policy.yml index bb83716c..7d77033f 100644 --- a/.github/workflows/runtime-policy.yml +++ b/.github/workflows/runtime-policy.yml @@ -37,7 +37,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Report runtime tier and reject mixed toolchains run: | diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml index 1df43f14..4935cb30 100644 --- a/.github/workflows/security-policy.yml +++ b/.github/workflows/security-policy.yml @@ -20,7 +20,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v6.0.1 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: Security checks run: | FAILED=false diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml index 43cb95b2..e46c8204 100644 --- a/.github/workflows/wellknown-enforcement.yml +++ b/.github/workflows/wellknown-enforcement.yml @@ -24,7 +24,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v6.0.1 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: RFC 9116 security.txt validation run: | diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 1780aa7f..65126561 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -24,7 +24,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Check SPDX Headers run: | diff --git a/.github/workflows/zig-ffi.yml b/.github/workflows/zig-ffi.yml index 0df6d7c3..b7f0b412 100644 --- a/.github/workflows/zig-ffi.yml +++ b/.github/workflows/zig-ffi.yml @@ -36,7 +36,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.3.1 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install Zig ${{ env.ZIG_VERSION }} (sha256-pinned) run: | diff --git a/.machine_readable/svc/k9/burble-metadata.k9.ncl b/.machine_readable/svc/k9/burble-metadata.k9.ncl index a15f9994..dded5c7e 100644 --- a/.machine_readable/svc/k9/burble-metadata.k9.ncl +++ b/.machine_readable/svc/k9/burble-metadata.k9.ncl @@ -7,6 +7,8 @@ K9! { pedigree = { + name = "burble-metadata.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "comms-platform-metadata", security = { @@ -17,7 +19,7 @@ K9! allow_subprocess = false, }, metadata = { - name = "burble-metadata", + version = "0.1.0", description = "Burble: self-hostable WebRTC communications platform — project invariants", author = "Jonathan D.A. Jewell ", diff --git a/.machine_readable/svc/k9/examples/ci-config.k9.ncl b/.machine_readable/svc/k9/examples/ci-config.k9.ncl index 1f38e2dc..04ba4282 100644 --- a/.machine_readable/svc/k9/examples/ci-config.k9.ncl +++ b/.machine_readable/svc/k9/examples/ci-config.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "ci-config.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "ci-configuration", security = { @@ -16,7 +18,7 @@ K9! allow_subprocess = false, }, metadata = { - name = "ci-config", + version = "1.0.0", description = "CI/CD configuration with runtime validation", author = "{{AUTHOR}} <{{AUTHOR_EMAIL}}>", @@ -48,21 +50,21 @@ K9! # Workflow steps with validation steps = [ { - name = "Checkout", + action = "actions/checkout@v4", # Version must be SHA-pinned for security sha | String | std.string.NonEmpty = "b4ffde65f46336ab88eb53be808477a3936bae11", }, { - name = "Build", + run = "just build", }, { - name = "Test", + run = "just test", }, { - name = "Lint", + run = "just lint", }, ], @@ -87,15 +89,15 @@ K9! scanners = [ { - name = "CodeQL", + languages = ["rust", "javascript"], }, { - name = "OSSF Scorecard", + enabled = true, }, { - name = "TruffleHog", + scan_for = "secrets", }, ], diff --git a/.machine_readable/svc/k9/examples/project-metadata.k9.ncl b/.machine_readable/svc/k9/examples/project-metadata.k9.ncl index 7bc6941d..225bd5e9 100644 --- a/.machine_readable/svc/k9/examples/project-metadata.k9.ncl +++ b/.machine_readable/svc/k9/examples/project-metadata.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "project-metadata.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "project-metadata", security = { @@ -16,7 +18,7 @@ K9! allow_subprocess = false, }, metadata = { - name = "project-metadata", + version = "1.0.0", description = "Pure data configuration for project metadata", author = "{{AUTHOR}} <{{AUTHOR_EMAIL}}>", @@ -25,7 +27,7 @@ K9! # Project configuration project = { - name = "my-project", + version = "0.1.0", description = "A project following Rhodium Standard Repositories", @@ -35,7 +37,7 @@ K9! }, author = { - name = "{{AUTHOR}}", + email = "{{AUTHOR_EMAIL}}", organization = "{{AUTHOR_ORG}}", }, diff --git a/.machine_readable/svc/k9/examples/setup-repo.k9.ncl b/.machine_readable/svc/k9/examples/setup-repo.k9.ncl index 523e8176..42b57473 100644 --- a/.machine_readable/svc/k9/examples/setup-repo.k9.ncl +++ b/.machine_readable/svc/k9/examples/setup-repo.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "setup-repo.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "repository-setup", security = { @@ -17,7 +19,7 @@ K9! signature_required = true, }, metadata = { - name = "setup-repo", + version = "1.0.0", description = "Automated repository setup with RSR standards", author = "{{AUTHOR}} <{{AUTHOR_EMAIL}}>", diff --git a/.machine_readable/svc/k9/template-hunt.k9.ncl b/.machine_readable/svc/k9/template-hunt.k9.ncl index a9cc350e..68444fc0 100644 --- a/.machine_readable/svc/k9/template-hunt.k9.ncl +++ b/.machine_readable/svc/k9/template-hunt.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "template-hunt.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "TODO: describe component type (e.g., 'deployment', 'setup-script')", security = { @@ -17,7 +19,7 @@ K9! signature_required = true, }, metadata = { - name = "TODO: component-name", + version = "1.0.0", description = "TODO: Detailed description of what this component does", author = "{{AUTHOR}} <{{AUTHOR_EMAIL}}>", diff --git a/.machine_readable/svc/k9/template-kennel.k9.ncl b/.machine_readable/svc/k9/template-kennel.k9.ncl index fa7e3f35..79328e79 100644 --- a/.machine_readable/svc/k9/template-kennel.k9.ncl +++ b/.machine_readable/svc/k9/template-kennel.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "template-kennel.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "TODO: describe component type (e.g., 'build-config', 'metadata')", security = { @@ -16,7 +18,7 @@ K9! allow_subprocess = false, }, metadata = { - name = "TODO: component-name", + version = "1.0.0", description = "TODO: Brief description of what this component contains", author = "{{AUTHOR}} <{{AUTHOR_EMAIL}}>", diff --git a/.machine_readable/svc/k9/template-yard.k9.ncl b/.machine_readable/svc/k9/template-yard.k9.ncl index 358671cf..e9857b50 100644 --- a/.machine_readable/svc/k9/template-yard.k9.ncl +++ b/.machine_readable/svc/k9/template-yard.k9.ncl @@ -6,6 +6,8 @@ K9! { pedigree = { + name = "template-yard.k9.ncl", + security = { leash = 'Yard }, schema_version = "1.0.0", component_type = "TODO: describe component type (e.g., 'validated-config', 'schema')", security = { @@ -16,7 +18,7 @@ K9! allow_subprocess = false, }, metadata = { - name = "TODO: component-name", + version = "1.0.0", description = "TODO: Brief description with validation details", author = "{{AUTHOR}} <{{AUTHOR_EMAIL}}>",