chore: update workflow SHAs to @7fdc2705

.github/workflows/codeql.yml

@@ -26,7 +26,7 @@ jobs:
             build-mode: none
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4.31.10

.github/workflows/dependabot-automerge.yml

@@ -55,7 +55,7 @@ jobs:
     steps:
       - name: Fetch Dependabot metadata
         id: meta
-        uses: dependabot/fetch-metadata@v2.2.0
+        uses: dependabot/fetch-metadata@dbb049abf0d677abbd7f7eee0375145b417fdd34 # v2.2.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/dogfood-gate.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Check for A2ML files
         id: detect
@@ -70,7 +70,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Check for K9 files
         id: detect
@@ -119,7 +119,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Scan for invisible characters
         id: lint
@@ -183,7 +183,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Check for Groove manifest
         id: groove
@@ -243,7 +243,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Generate dogfooding scorecard
         run: |

.github/workflows/guix-nix-policy.yml

@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6.0.1
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Enforce Guix primary / Nix fallback
         run: |
           # Check for package manager files

.github/workflows/index-freshness.yml

@@ -35,7 +35,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout (with history; regen-index needs git log on scans/)
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 

.github/workflows/ingest.yml

@@ -28,7 +28,7 @@ jobs:
   ingest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.3.1
+ uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/instant-sync.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Trigger Propagation
-        uses: peter-evans/repository-dispatch@v4.0.1
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.FARM_DISPATCH_TOKEN }}
           repository: hyperpolymath/.git-private-farm

.github/workflows/jekyll-gh-pages.yml

@@ -29,16 +29,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Pages
-        uses: actions/configure-pages@v5.0.0
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
       - name: Build with Jekyll
-        uses: actions/jekyll-build-pages@v1.0.13
+        uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697 # v1.0.13
         with:
           source: ./
           destination: ./_site
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3.0.1
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
 
   # Deployment job
   deploy:
@@ -50,4 +50,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4.0.5
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

.github/workflows/jekyll.yml

@@ -34,25 +34,25 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Ruby
         # https://github.com/ruby/setup-ruby/releases/tag/v1.207.0
-        uses: ruby/setup-ruby@v1.283.0
+        uses: ruby/setup-ruby@708024e6c902387ab41de36e1669e43b5ee7085e # v1.283.0
         with:
           ruby-version: '3.1' # Not needed with a .ruby-version file
           bundler-cache: true # runs 'bundle install' and caches installed gems automatically
           cache-version: 0 # Increment this number if you need to re-download cached gems
       - name: Setup Pages
         id: pages
-        uses: actions/configure-pages@v5.0.0
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
       - name: Build with Jekyll
         # Outputs to the './_site' directory by default
         run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}"
         env:
           JEKYLL_ENV: production
       - name: Upload artifact
         # Automatically uploads an artifact from the './_site' directory by default
-        uses: actions/upload-pages-artifact@v3.0.1
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
 
   # Deployment job
   deploy:
@@ -64,4 +64,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4.0.5
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

.github/workflows/push-email-notify.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send push notification email
-        uses: dawidd6/action-send-mail@v3.12.0
+        uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}

.github/workflows/quality.yml

@@ -21,7 +21,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6.0.1
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Check file permissions
         run: |
@@ -37,15 +37,15 @@ jobs:
           find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files"
 
       - name: EditorConfig check
-        uses: editorconfig-checker/action-editorconfig-checker@v2.1.0
+        uses: editorconfig-checker/action-editorconfig-checker@4b6cd6190d435e7e084fb35e36a096e98506f7b9 # v2.1.0
         continue-on-error: true
 
   docs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6.0.1
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Check documentation
         run: |
           MISSING=""

.github/workflows/rsr-antipattern.yml

@@ -22,7 +22,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6.0.1
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Check for TypeScript
         run: |

.github/workflows/runtime-policy.yml

@@ -37,7 +37,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6.0.2
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Report runtime tier and reject mixed toolchains
         run: |

.github/workflows/secret-scanner.yml

@@ -16,5 +16,5 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit

.github/workflows/security-policy.yml

@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6.0.1
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Security checks
         run: |
           FAILED=false

.github/workflows/wellknown-enforcement.yml

@@ -24,7 +24,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6.0.1
+ uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: RFC 9116 security.txt validation
         run: |

.github/workflows/workflow-linter.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check SPDX Headers
         run: |

.github/workflows/zig-ffi.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Install Zig ${{ env.ZIG_VERSION }} (sha256-pinned)
         run: |

.machine_readable/svc/k9/burble-metadata.k9.ncl

@@ -7,6 +7,8 @@ K9!
 
 {
   pedigree = {
+    name = "burble-metadata.k9.ncl",
+    security = { leash = 'Yard },
     schema_version = "1.0.0",
     component_type = "comms-platform-metadata",
     security = {
@@ -17,7 +19,7 @@ K9!
       allow_subprocess = false,
     },
     metadata = {
-      name = "burble-metadata",
+
       version = "0.1.0",
       description = "Burble: self-hostable WebRTC communications platform — project invariants",
       author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",

.machine_readable/svc/k9/examples/ci-config.k9.ncl

@@ -6,6 +6,8 @@ K9!
 
 {
   pedigree = {
+    name = "ci-config.k9.ncl",
+    security = { leash = 'Yard },
     schema_version = "1.0.0",
     component_type = "ci-configuration",
     security = {
@@ -16,7 +18,7 @@ K9!
       allow_subprocess = false,
     },
     metadata = {
-      name = "ci-config",
+
       version = "1.0.0",
       description = "CI/CD configuration with runtime validation",
       author = "{{AUTHOR}} <{{AUTHOR_EMAIL}}>",
@@ -48,21 +50,21 @@ K9!
     # Workflow steps with validation
     steps = [
       {
-        name = "Checkout",
+
         action = "actions/checkout@v4",
         # Version must be SHA-pinned for security
         sha | String | std.string.NonEmpty = "b4ffde65f46336ab88eb53be808477a3936bae11",
       },
       {
-        name = "Build",
+
         run = "just build",
       },
       {
-        name = "Test",
+
         run = "just test",
       },
       {
-        name = "Lint",
+
         run = "just lint",
       },
     ],
@@ -87,15 +89,15 @@ K9!
 
       scanners = [
         {
-          name = "CodeQL",
+
           languages = ["rust", "javascript"],
         },
         {
-          name = "OSSF Scorecard",
+
           enabled = true,
         },
         {
-          name = "TruffleHog",
+
           scan_for = "secrets",
         },
       ],

.machine_readable/svc/k9/examples/project-metadata.k9.ncl

@@ -6,6 +6,8 @@ K9!
 
 {
   pedigree = {
+    name = "project-metadata.k9.ncl",
+    security = { leash = 'Yard },
     schema_version = "1.0.0",
     component_type = "project-metadata",
     security = {
@@ -16,7 +18,7 @@ K9!
       allow_subprocess = false,
     },
     metadata = {
-      name = "project-metadata",
+
       version = "1.0.0",
       description = "Pure data configuration for project metadata",
       author = "{{AUTHOR}} <{{AUTHOR_EMAIL}}>",
@@ -25,7 +27,7 @@ K9!
 
   # Project configuration
   project = {
-    name = "my-project",
+
     version = "0.1.0",
     description = "A project following Rhodium Standard Repositories",
 
@@ -35,7 +37,7 @@ K9!
     },
 
     author = {
-      name = "{{AUTHOR}}",
+
       email = "{{AUTHOR_EMAIL}}",
       organization = "{{AUTHOR_ORG}}",
     },

.machine_readable/svc/k9/examples/setup-repo.k9.ncl

@@ -6,6 +6,8 @@ K9!
 
 {
   pedigree = {
+    name = "setup-repo.k9.ncl",
+    security = { leash = 'Yard },
     schema_version = "1.0.0",
     component_type = "repository-setup",
     security = {
@@ -17,7 +19,7 @@ K9!
       signature_required = true,
     },
     metadata = {
-      name = "setup-repo",
+
       version = "1.0.0",
       description = "Automated repository setup with RSR standards",
       author = "{{AUTHOR}} <{{AUTHOR_EMAIL}}>",