ci: standards ci-pipeline dry-run caller (observation, not adoption)

[hyperpolymath]

What this is

A deliberate observation, not an adoption.

hyperpolymath/standards carries a reusable pipeline,
.github/workflows/ci-pipeline.yml, which as of today has zero callers
anywhere in the estate. Its exemption ledger,
.machine_readable/pipeline-allow.txt, is seeded empty on purpose. The
ledger's own text is explicit about how it may be filled:

An entry here must be EARNED BY OBSERVATION: the pipeline ran in that
repository and went red. It must never be seeded by inference.
[…] The honest seed is a dry-run wave: adopt the caller in a deliberate
sample, record the real verdict per repository, and add only what actually
went red.

This PR is one of five in that dry-run wave. Its purpose is to make the
real verdict observable here.

Expected verdict in this repository

detect counts ecosystem markers on the default branch. Measured today:

marker	count
Cargo.toml	5
*.ncl	27
ReScript / V / Haskell / Deno	0
TOTAL	32
unsupported-ecosystem markers	3

So the pipeline should run for real here, via the Rust arm.

Known defect, disclosed up front

⚠ hyperpolymath/standards#976 — detect counts *.ncl into its ecosystem
denominator, and the RSR template ships a six-file k9 Nickel set into every
seeded repository. TOTAL can therefore be lifted above zero by template
boilerplate alone, which silences the workflow's own zero-denominator refusal
while nothing meaningful has been checked. On a 24-repo sample, 9 would go
vacuously green that way.

This repository was chosen precisely because its verdict does not depend on
that contaminated signal. Cargo.toml = 5 carries TOTAL to 32 on its own,
so the verdict here is identical whether or not #976 is cured, and this
observation survives whichever cure is chosen.

Deliberate choices

• Pinned to an immutable commit (2eb9bb19, ci-pipeline.yml blob
  d2583657), never @main — following main would let one push in
  standards change the verdict of every already-pinned caller with no review
  here.
• No secrets: block at all. ci-pipeline.yml declares
  workflow_call.inputs only, has no secrets: block and references no
  secrets.* anywhere. secrets: inherit would hand the entire store to a
  workflow that consumes none of it.
• pull_request + workflow_dispatch only, so the PR itself is the
  observation.
• actions.lock edited by hand, never gh actions-lock rewrite mode
  (which previously de-pinned 24 SHAs and invented invalid refs).

Pre-existing condition — not caused by this PR

This repository is already red on the actions-lock gate at main,
independently of this change. Verified by running the estate's own verifier
against the unmodified main tree:

category: ref-changed, workflow: .github/workflows/dependabot-automerge.yml
  uses step-security/harden-runner@v2.16.0 but lockfile pins v2.9.1   → exit 1

That is a live violation predating this branch (see the existing
fix/actions-lock-desync branch). Do not attribute it to this PR.

Measured separately: adding a reusable-workflow caller produces no new
lockfile findings at all — gh actions-lock v0.1.6 does not recognise
reusable-workflow uses: paths. The ': []' key added here is for consistency
with what the tool would generate, and is not load-bearing.

Please do not merge yet

The verdict is the deliverable. Once the run completes, the result is recorded
against the ledger, and only repositories that actually went red are added
— in a commit carrying a column-0
Ratchet-exception: .machine_readable/pipeline-allow.txt — <why> trailer.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

[coderabbitai]

Warning

Review limit reached

Next included review available in 23 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 11b3e82a-0244-4a21-8a40-d88e5584b04c

📥 Commits

Reviewing files that changed from the base of the PR and between 9846169 and f543d7a.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• .github/workflows/standards-pipeline.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud