ci(pipeline): re-pin ci-pipeline.yml to standards f95130bb

[hyperpolymath]

What

Re-pins this repository's standards-pipeline.yml caller from 2eb9bb19 to
f95130bb — the squash merge of hyperpolymath/standards#985.

Why

2eb9bb19 predates #985, which fixed the ci-pipeline detect gate. Every caller
still on the old pin runs the pre-fix gate. The workflow is pull_request-triggered
only, so the failure is latent: it does not manifest until the next PR is opened here.

What moves

Two lines, together:

Line	From	To
provenance comment	@ 2eb9bb19 — ci-pipeline.yml blob d2583657.	@ f95130bb — ci-pipeline.yml blob 8bcdeaf2.
uses: ref	...ci-pipeline.yml@2eb9bb19...	...ci-pipeline.yml@f95130bb...

A SHA bump that leaves the blob comment behind is a phantom pin — it names a tree
it can no longer be checked against — so both change or neither does.

Why f95130bb and not current main

main has since moved to d1bd7f42 (#988, a changelog fix). f95130bb was chosen
deliberately:

• ci-pipeline.yml is byte-identical at both — blob 8bcdeaf2 either way.
• f95130bb is the reviewed revision: the commit #985 was merged as.
• Its only failing checks are SonarCloud Code Analysis and the mirror trio
  (mirror-gitea, mirror-disroot, mirror-codeberg) — all four are listed in
  standards' own config/rulesets/gates.json under never_required_workflows.
  Nothing ci-pipeline-related is red there.

ci-pipeline.yml pins its own sub-reusables fully-qualified at 571cc734 rather than
./, so this pin selects only which ci-pipeline.yml is read — not its dependencies.

Verification

• Pre-flight refused to edit unless the exact pre-fix SHA and the expected
  provenance-comment shape were both present.
• Post-flight asserted exactly 2/2 changed lines, no residue of 2eb9bb19 or
  d2583657, and the new SHA present.
• Commit is SSH-signed (%G? = G).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: be251cfa-4a9b-4414-a3ba-c081c4180d00

📥 Commits

Reviewing files that changed from the base of the PR and between 20a76c3 and 6364fd6.

📒 Files selected for processing (1)

• .github/workflows/standards-pipeline.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (20)

• GitHub Check: pipeline / Secret scanning / shell-secrets
• GitHub Check: pipeline / Secret scanning / rust-secrets
• GitHub Check: pipeline / Secret scanning / gitleaks
• GitHub Check: pipeline / SAST (semgrep)
• GitHub Check: pipeline / Detect ecosystems
• GitHub Check: pipeline / Secret scanning / shell-secrets
• GitHub Check: pipeline / Secret scanning / gitleaks
• GitHub Check: pipeline / SAST (semgrep)
• GitHub Check: scan / rust-secrets
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Guix primary / Nix fallback policy
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: Julia 1.10 - ubuntu-latest
• GitHub Check: Julia 1.11 - macos-latest
• GitHub Check: Julia 1.11 - ubuntu-latest

⚠️ CI failures not shown inline (9)

GitHub Actions: Governance / 2_governance _ Well-Known (RFC 9116 + RSR).txt: ci(pipeline): re-pin ci-pipeline.yml to standards f95130bb

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

---

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): ci(pipeline): re-pin ci-pipeline.yml to standards f95130bb

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

---

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): ci(pipeline): re-pin ci-pipeline.yml to standards f95130bb

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m

---

GitHub Actions: Governance / 3_governance _ Code quality + docs.txt: ci(pipeline): re-pin ci-pipeline.yml to standards f95130bb

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
 with:
   github-***REDACTED_SECRET_ASSIGNMENT***
   version: latest
 ##[endgroup]
 Find 'latest' release
 ##[error]Error: The binary 'ec-linux-amd64*' not found

---

GitHub Actions: Governance / governance _ Code quality + docs: ci(pipeline): re-pin ci-pipeline.yml to standards f95130bb

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
 with:
   github-***REDACTED_SECRET_ASSIGNMENT***
   version: latest
 ##[endgroup]
 Find 'latest' release
 ##[error]Error: The binary 'ec-linux-amd64*' not found

---

GitHub Actions: Governance / 6_governance _ Security policy checks.txt: ci(pipeline): re-pin ci-pipeline.yml to standards f95130bb

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

---

GitHub Actions: Governance / governance _ Security policy checks: ci(pipeline): re-pin ci-pipeline.yml to standards f95130bb

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

---

GitHub Actions: Governance / 9_governance _ Guix primary _ Nix fallback policy.txt: ci(pipeline): re-pin ci-pipeline.yml to standards f95130bb

Conclusion: failure

View job details

##[group]Run # Move the checker OUT of the scanned tree and delete the standards
 �[36;1m# Move the checker OUT of the scanned tree and delete the standards�[0m
 �[36;1m# checkout before scanning: the gate walks the whole caller tree, so�[0m
 �[36;1m# a packaging file shipped inside .standards-checkout/ would satisfy�[0m
 �[36;1m# the policy on the caller's behalf (same trap as the baseline job).�[0m
 �[36;1mcp .standards-checkout/scripts/check-package-policy.sh "$RUNNER_TEMP/"�[0m
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-package-policy.sh" .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ##[error]Package policy violation: no packaging found.

---

GitHub Actions: Governance / governance _ Guix primary _ Nix fallback policy: ci(pipeline): re-pin ci-pipeline.yml to standards f95130bb

Conclusion: failure

View job details

##[group]Run # Move the checker OUT of the scanned tree and delete the standards
 �[36;1m# Move the checker OUT of the scanned tree and delete the standards�[0m
 �[36;1m# checkout before scanning: the gate walks the whole caller tree, so�[0m
 �[36;1m# a packaging file shipped inside .standards-checkout/ would satisfy�[0m
 �[36;1m# the policy on the caller's behalf (same trap as the baseline job).�[0m
 �[36;1mcp .standards-checkout/scripts/check-package-policy.sh "$RUNNER_TEMP/"�[0m
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-package-policy.sh" .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ##[error]Package policy violation: no packaging found.

🔇 Additional comments (1)

.github/workflows/standards-pipeline.yml (1)

36-36: LGTM!

Also applies to: 42-42

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the reusable standards pipeline reference to a fixed, immutable revision for more consistent workflow execution.

Walkthrough

The standards pipeline reference changed to a newer immutable commit. The existing no-secrets configuration and explanatory comments remain unchanged.

Changes

Standards pipeline

Layer / File(s)	Summary
Update standards workflow pin .github/workflows/standards-pipeline.yml	The reusable hyperpolymath/standards workflow now uses commit ed5e3f651305dd1ce0d0b5d2d08b97a963634632. The no-secrets configuration and explanatory comments remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 6364f

The standards workflow pin update is narrowly scoped and ready to merge.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title describes a re-pin of the CI pipeline, but it names f95130bb. The pull request objectives state that the actual target is ed5e3f65, so the title is misleading about the main change.	Update the title to identify ed5e3f65 and the standards#989 re-pin, for example: ci(pipeline): re-pin standards pipeline to ed5e3f65.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The description is related to the workflow pin update and explains the provenance comment and CI rationale. However, it describes f95130bb, while the final change targets ed5e3f65.

🤖 Coding task started

✨ Finishing Touches

🛠️ Fix failing CI checks

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the pipeline pin
A newer commit now settles in
No secrets block is added today
The comments remain in place
The workflow hops along its way}

_{Comment @coderabbitai help to get the list of available commands.}

[hyperpolymath]

⛔ Do not merge — superseded by hyperpolymath/standards#989

Converted to draft to keep it out of the merge queue. This is reversible:
gh pr ready <N> restores it.

This PR re-pins ci-pipeline.yml to f95130bb, which predates #989 and carries
both defects #989 cures. Measured, not assumed:

$ gh api repos/hyperpolymath/standards/contents/.github/workflows/ci-pipeline.yml \
    ?ref=f95130bbcbc8917bfec8f8875fa810ad93b08871 --jq .content | base64 -d \
  | grep -nE '^\s+ref:|exit 1|refused'
949:          ref: a2ff696a      # unfetchable abbreviated SHA — the ledger checkout fails
270:              exit 1         # detect's own hard refusal — two judges, not one
(refused: 0 occurrences — no `refused` output at this SHA)

Merging this would move the caller from a stale-but-latent 2eb9bb19 pin to a callee
where the exemption ledger fetch fails, is swallowed by continue-on-error, is
treated as empty, and then fails closed — while detect exits 1 regardless. The
refusing pilots go red again, for no gain, in either merge order.

Correct sequence: merge #989 first, then retarget this PR to #989's squash SHA
(tracked as the re-pin wave, one caller first so the squash SHA is exercised before
the other four follow).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

[coderabbitai]

✅ Coding Agent task started: View task and status

The task will inspect the CI failures, validate its fix, and commit the fix to this branch automatically.

Note: Fixing CI failures is a beta feature and may encounter errors. Expect some limitations and changes as we gather feedback and continue to improve it.

⏭️ 1 check(s) skipped — already failing on `main` (not caused by this PR)

• GitHub Actions: Governance / 5_governance _ Security policy checks.txt

[hyperpolymath]

⛔ Superseded by #40 (merged) — do not merge; kept as draft

main now pins ed5e3f65. This PR still pins f95130bb, so merging it would
regress the pin backwards onto the callee that carries both defects
hyperpolymath/standards#989 cures.

#40 landed the correct pin and was verified green before merging — run
35770740241
printed ledger read at 'ed5e3f651305dd1ce0d0b5d2d08b97a963634632'.

A new branch was used rather than retargeting this one because this branch carries an
unsigned commit that trips require_extra_approval_for_unattributed_changes; #40's
history is fully signature-verified.

This PR should be closed — I do not have permission to close it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

[hyperpolymath]

Superseded and now empty — converted to draft; recommend closing

Measured just now:

gh pr view 39 --json changedFiles        -> changedFiles=0
gh api compare/main...secqual/repin-ci-pipeline-f95130bb
                                         -> status=ahead ahead=3 behind=0 files=0

The 3 commits are ahead of main but produce zero net diff: main already carries the re-pin this PR proposed, landed by #40. Verified on the default branch in .github/workflows/standards-pipeline.yml:

36:    # hyperpolymath/standards @ ed5e3f65 — ci-pipeline.yml blob ea87c43a.
42:    uses: hyperpolymath/standards/.github/workflows/ci-pipeline.yml@ed5e3f651305dd1ce0d0b5d2d08b97a963634632

Both the uses: SHA and the load-bearing provenance comment above it are current, so there is nothing left for this PR to do.

Worth stating plainly, because the branch name invites the opposite reading: this PR targets f95130bb, which predates the ed5e3f65 now live — but it does not regress the pin, because it no longer proposes any change at all. Merging it would be a no-op rather than a revert. It is noise, not a hazard.

Converted to draft to take it out of the review queue (re-measured after: draft=true — a previous conversion on this PR did not hold). It needs an owner to close it; I'm not closing PRs unprompted.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

[coderabbitai]

✅ Coding task complete — no changes needed