ci: standards ci-pipeline dry-run caller (observation, not adoption)

[hyperpolymath]

What this is

A deliberate observation, not an adoption.

hyperpolymath/standards carries a reusable pipeline,
.github/workflows/ci-pipeline.yml, which as of today has zero callers
anywhere in the estate. Its exemption ledger,
.machine_readable/pipeline-allow.txt, is seeded empty on purpose. The
ledger's own text is explicit about how it may be filled:

An entry here must be EARNED BY OBSERVATION: the pipeline ran in that
repository and went red. It must never be seeded by inference.
[…] The honest seed is a dry-run wave: adopt the caller in a deliberate
sample, record the real verdict per repository, and add only what actually
went red.

This PR is one of five in that dry-run wave.

Expected verdict in this repository

detect counts ecosystem markers on the default branch. Measured today
across 32 tracked files:

ecosystem	markers
Rust / Nickel / ReScript / V / Haskell / Deno (supported)	0
Unsupported-ecosystem markers (Julia, Zig, Lean, Ruby, Bun, …)	0
TOTAL (supported)	0

So the pipeline is expected to REFUSE on a zero denominator: there is no
supported ecosystem here, and no unsupported one either. Rather than pass
vacuously, the workflow refuses and says nothing was checked. The workflow's
own reasoning:

a vacuous gate is worse than an honest blind spot: the blind spot reports
nothing, the vacuous gate reports success.

A red run here is the correct outcome and is exactly what this wave is for.

Known defect, disclosed up front

⚠ hyperpolymath/standards#976 — detect counts *.ncl into its ecosystem
denominator, and the RSR template ships a six-file k9 Nickel set into every
seeded repository. TOTAL can therefore be lifted above zero by template
boilerplate alone, which silences the zero-denominator refusal while nothing
meaningful has been checked. On a 24-repo sample, 9 would go vacuously
green that way.

This repository was chosen precisely because its verdict does not depend on
that contaminated signal. It has zero .ncl files and zero markers of any kind, so TOTAL is 0 whether or not the Nickel probe is corrected. The observation therefore survives
whichever cure for #976 is chosen.

Deliberate choices

• Pinned to an immutable commit (2eb9bb19, ci-pipeline.yml blob
  d2583657), never @main — following main would let one push in
  standards change the verdict of every already-pinned caller with no review
  here.
• No secrets: block at all. ci-pipeline.yml declares
  workflow_call.inputs only, has no secrets: block and references no
  secrets.* anywhere. secrets: inherit would hand the entire store to a
  workflow that consumes none of it.
• pull_request + workflow_dispatch only, so the PR itself is the
  observation.
• No actions.lock in this repository, so nothing to hand-edit. Measured separately: a reusable-workflow caller produces no lockfile findings at all — gh actions-lock v0.1.6 does not recognise reusable-workflow uses: paths.

Please do not merge yet

The verdict is the deliverable. Once the run completes, the result is recorded
against the ledger, and only repositories that actually went red are added
— in a commit carrying a column-0
Ratchet-exception: .machine_readable/pipeline-allow.txt — <why> trailer.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a90efe36-d495-43fc-a25a-f70d614d2737

📥 Commits

Reviewing files that changed from the base of the PR and between 43e1b9c and f2b8333.

📒 Files selected for processing (1)

• .github/workflows/standards-pipeline.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (9)

• GitHub Check: pipeline / Secret scanning / shell-secrets
• GitHub Check: secret-scan / rust-secrets
• GitHub Check: secret-scan / gitleaks
• GitHub Check: secret-scan / shell-secrets
• GitHub Check: pipeline / Secret scanning / rust-secrets
• GitHub Check: pipeline / Secret scanning / gitleaks
• GitHub Check: pipeline / SAST (semgrep)
• GitHub Check: pipeline / Detect ecosystems
• GitHub Check: test

🔇 Additional comments (1)

.github/workflows/standards-pipeline.yml (1)

25-42: LGTM!

---

📝 Summary

Summary by CodeRabbit

• New Features
  • Added an automated standards pipeline that runs for pull requests.
  • Added the option to manually trigger the standards pipeline when needed.
  • The pipeline operates with read-only repository access for improved security.

Walkthrough

The pull request adds a GitHub Actions workflow. It runs on pull requests and manual dispatches. It calls the pinned hyperpolymath/standards reusable workflow with read-only contents permission and no secrets.

Changes

Standards pipeline integration

Layer / File(s)	Summary
Reusable workflow caller .github/workflows/standards-pipeline.yml	Adds a workflow that calls ci-pipeline.yml at an immutable commit. It supports pull_request and workflow_dispatch events, grants contents: read, and omits secrets. Comments document the dry-run purpose and the disclosed detect job defect.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to f2b83

The change adds a pinned, read-only standards check for pull requests and manual runs without exposing secrets. It is mergeable.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the change as a standards CI pipeline dry-run caller and states that it is for observation, not adoption.
Description check	✅ Passed	The description directly explains the workflow, its dry-run purpose, expected result, known defect, and merge conditions. It is clearly related to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow gate
The standards path now runs on cue
Pull requests and dispatches wait
Read-only rights guide the queue
No secrets cross the burrow too}

_{Comment @coderabbitai help to get the list of available commands.}