From edfdc8c5efd761d860005127e3aad797cffe26a0 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 9 Sep 2026 02:19:42 +0100
Subject: [PATCH] fix(ci): pin standards reusables to main HEAD 8f2ee508

This repo's standards reusable pins are re-pointed at the standards default-branch HEAD, resolved live at sweep time. The prior refs are recorded in the verification line below. Three kinds of drift are repaired together and the body does not claim which one this repo had: an UNREACHABLE sha kills the run at workflow STARTUP, so GitHub reports no check at all rather than a failing one and the gate disappears instead of going red; a FLOATING ref (@main) is unpinned supply chain; a merely STALE but reachable sha silently reintroduces every bug fixed since it. files=6 pins=6 perms=3 permlines=3 from=092dedada188f56c5915f74a5fd40aac093742c3,412a7031577112b31ee287cc6060179d638d6500,81dbf2dd854b1444fd6236fa2352474383b2c2b9,d135b05bfc647d0c0fbfedc7e80f37ea50f49236 target=8f2ee508

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB
---
 .github/workflows/governance.yml     | 2 +-
 .github/workflows/hypatia-scan.yml   | 3 ++-
 .github/workflows/mirror.yml         | 3 ++-
 .github/workflows/rust-ci.yml        | 2 +-
 .github/workflows/scorecard.yml      | 3 ++-
 .github/workflows/secret-scanner.yml | 2 +-
 6 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 25a3fd6..7b52515 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -28,4 +28,4 @@ permissions:
   contents: read
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 739da74..71c54c5 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -17,10 +17,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
   security-events: write
   pull-requests: write
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c
     secrets: inherit
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 46961e0..42884ab 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -6,8 +6,9 @@ on:
     branches: [main]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c
     secrets: inherit
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index 0469dd2..f73f3ee 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -12,7 +12,7 @@ permissions:
   contents: read
 jobs:
   rust-ci:
-    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@412a7031577112b31ee287cc6060179d638d6500
+    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c
     with:
       enable_audit: true
       enable_coverage: true
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 5731d7f..14154c4 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -9,7 +9,8 @@ permissions: read-all
 jobs:
   analysis:
     permissions:
+      contents: read
       security-events: write
       id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c
     secrets: inherit
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 6fbe484..86bb860 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -14,5 +14,5 @@ jobs:
   scan:
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c
     secrets: inherit