From 2d229efbd8ba470740b8a8d4aeaa51a457dfb072 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 4 Aug 2026 05:18:29 +0100 Subject: [PATCH 1/3] fix(ci): bump standards re-pin to bd0df9e (lockfile-aware governance lint) Co-Authored-By: Claude Fable 5 --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 363aff8..d4ea6f2 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -14,4 +14,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 \ No newline at end of file diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 06cbae9..e7fb14b 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -17,5 +17,5 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 secrets: inherit \ No newline at end of file diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 5c47fd9..2b7049f 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -9,5 +9,5 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 secrets: inherit diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 71a3448..044f0f6 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -12,7 +12,7 @@ permissions: contents: read jobs: scan: - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 secrets: inherit trufflehog: runs-on: ubuntu-latest From 91c05307368b9bcc138f52c1ff9c7a249e06b44c Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 4 Aug 2026 05:32:14 +0100 Subject: [PATCH 2/3] fix(ci): grant wrappers the permission union their reusables demand MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit At standards >= fcb8669 the governance/hypatia/mirror/scorecard reusables declare actions: read (hypatia adds security-events: write; scorecard adds id-token/security-events write). A reusable requesting more than its caller grants is a startup_failure — the third enforcement layer after the lockfile and the caller entries. Co-Authored-By: Claude Fable 5 --- .github/workflows/governance.yml | 3 ++- .github/workflows/hypatia-scan.yml | 4 +++- .github/workflows/mirror.yml | 1 + 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index d4ea6f2..9906c2a 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -10,8 +10,9 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index e7fb14b..fe3cfe5 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -12,10 +12,12 @@ on: workflow_dispatch: permissions: + actions: read contents: read security-events: read + security-events: write jobs: hypatia: uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 - secrets: inherit \ No newline at end of file + secrets: inherit diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 2b7049f..bd1d7e1 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -6,6 +6,7 @@ on: branches: [main] workflow_dispatch: permissions: + actions: read contents: read jobs: mirror: From 4361e87c165e65f049829e274c735ebb79774f3a Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 4 Aug 2026 11:08:09 +0100 Subject: [PATCH 3/3] fix(ci): pin the secret-scanner reusable's internal checkout in the caller lockfile Hybrid caller (reusable job + inline job): enforcement validates the called reusable's SHA-keyed deps against the CALLER's lockfile ('lockfile missing pin for actions/checkout@3d3c42e...'). Entry copied from standards' own actions.lock at bd0df9e. Co-Authored-By: Claude Fable 5 --- .github/workflows/actions.lock | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 6b484d8..3763de4 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -20,9 +20,15 @@ workflows: '.github/workflows/push-email-notify.yml': - 'dawidd6/action-send-mail@v3.12.0' '.github/workflows/secret-scanner.yml': + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/checkout@v4.4.0' - 'trufflesecurity/trufflehog@main' dependencies: + 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 'actions/cache@v4.3.0': ref: 'v4.3.0' commit: 'sha1-0057852bfaa89a56745cba8c7296529d2fc39830'