From 565d1e3a6e95a32a31fd96316fe97cf92a659628 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 4 Sep 2026 10:22:23 +0100 Subject: [PATCH 1/2] chore(ci): bump governance-reusable pin to standards main The pinned revision 84355587 of governance-reusable.yml carries two bugs that make Governance red on every consumer that uses it: - Workflow security linter runs 'bash scripts/update-actions-lock.sh --verify-local' inside the CALLER's checkout, where that script does not exist (exit 127). - Allowlist Preflight runs check-actions-policy.sh with an empty GH_TOKEN, so gh refuses and the script returns 3. Both are already fixed on standards main: the script is copied out of the standards checkout into RUNNER_TEMP, and the policy step is skipped when no credential is supplied. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/governance.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 2f63d06..f331e83 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -35,4 +35,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@a3308ea8d0cc513727c8ad149b1132317a886c98 From 0d0f7aa13450c16667ca7022856b316ee0267e4b Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 7 Sep 2026 19:40:31 +0100 Subject: [PATCH 2/2] chore(ci): re-point pin to current standards main MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit standards main advanced 5 commits since this branch was cut. Both cures (RUNNER_TEMP verifier copy; GH_TOKEN presence guard) survive at the new head, but a pin is verified by a green run, not by a YAML diff — so pin to the head the sweep will actually use and re-run the witness. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/governance.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index f331e83..6af6e30 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -35,4 +35,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@a3308ea8d0cc513727c8ad149b1132317a886c98 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@fad242d35291de1898242d6737ba02b74a59a2f2