ci(pipeline): re-pin ci-pipeline.yml to standards#989 squash SHA ed5e3f65

[hyperpolymath]

What

Re-pins this repository's standards-pipeline.yml caller from 2eb9bb19 to
f95130bb — the squash merge of hyperpolymath/standards#985.

Why

2eb9bb19 predates #985, which fixed the ci-pipeline detect gate. Every caller
still on the old pin runs the pre-fix gate. The workflow is pull_request-triggered
only, so the failure is latent: it does not manifest until the next PR is opened here.

What moves

Two lines, together:

Line	From	To
provenance comment	@ 2eb9bb19 — ci-pipeline.yml blob d2583657.	@ f95130bb — ci-pipeline.yml blob 8bcdeaf2.
uses: ref	...ci-pipeline.yml@2eb9bb19...	...ci-pipeline.yml@f95130bb...

A SHA bump that leaves the blob comment behind is a phantom pin — it names a tree
it can no longer be checked against — so both change or neither does.

Why f95130bb and not current main

main has since moved to d1bd7f42 (#988, a changelog fix). f95130bb was chosen
deliberately:

• ci-pipeline.yml is byte-identical at both — blob 8bcdeaf2 either way.
• f95130bb is the reviewed revision: the commit #985 was merged as.
• Its only failing checks are SonarCloud Code Analysis and the mirror trio
  (mirror-gitea, mirror-disroot, mirror-codeberg) — all four are listed in
  standards' own config/rulesets/gates.json under never_required_workflows.
  Nothing ci-pipeline-related is red there.

ci-pipeline.yml pins its own sub-reusables fully-qualified at 571cc734 rather than
./, so this pin selects only which ci-pipeline.yml is read — not its dependencies.

Verification

• Pre-flight refused to edit unless the exact pre-fix SHA and the expected
  provenance-comment shape were both present.
• Post-flight asserted exactly 2/2 changed lines, no residue of 2eb9bb19 or
  d2583657, and the new SHA present.
• Commit is SSH-signed (%G? = G).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ed723da5-9825-4a24-928f-aeecee80317b

📥 Commits

Reviewing files that changed from the base of the PR and between f2cb0ed and b69c36c.

📒 Files selected for processing (1)

• .github/workflows/standards-pipeline.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (10)

• GitHub Check: pipeline / Secret scanning / shell-secrets
• GitHub Check: pipeline / Secret scanning / gitleaks
• GitHub Check: pipeline / Detect ecosystems
• GitHub Check: pipeline / Secret scanning / rust-secrets
• GitHub Check: pipeline / SAST (semgrep)
• GitHub Check: secret-scan / shell-secrets
• GitHub Check: secret-scan / gitleaks
• GitHub Check: secret-scan / rust-secrets
• GitHub Check: test
• GitHub Check: GitGuardian Security Checks

🔇 Additional comments (1)

.github/workflows/standards-pipeline.yml (1)

36-36: LGTM!

Also applies to: 42-42

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the continuous integration workflow reference to use a newer standards pipeline version.

Walkthrough

The workflow now references the reusable hyperpolymath/standards pipeline at commit ed5e3f65. The accompanying blob comment was updated to ea87c43a.

Changes

Standards pipeline

Layer / File(s)	Summary
Update reusable workflow reference .github/workflows/standards-pipeline.yml	The pipeline job now uses commit ed5e3f65 of ci-pipeline.yml. The adjacent comment records blob ea87c43a.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to b69c3

No concrete code risk remains; the PR’s draft/superseded status should be handled operationally.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the workflow re-pin and names the updated standards#989 squash SHA, ed5e3f65. It matches the main change.
Description check	✅ Passed	The description explains the workflow re-pin and its purpose. However, it refers to f95130bb, while the changeset updates the reference to ed5e3f65. The description remains related to the changeset, s…

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the pipeline pin
The newer commit now flows in
The blob note matches the track
The workflow keeps its path intact
And standards hop forward on the stack}

_{Comment @coderabbitai help to get the list of available commands.}

[hyperpolymath]

⛔ Do not merge — superseded by hyperpolymath/standards#989

Converted to draft to keep it out of the merge queue. This is reversible:
gh pr ready <N> restores it.

This PR re-pins ci-pipeline.yml to f95130bb, which predates #989 and carries
both defects #989 cures. Measured, not assumed:

$ gh api repos/hyperpolymath/standards/contents/.github/workflows/ci-pipeline.yml \
    ?ref=f95130bbcbc8917bfec8f8875fa810ad93b08871 --jq .content | base64 -d \
  | grep -nE '^\s+ref:|exit 1|refused'
949:          ref: a2ff696a      # unfetchable abbreviated SHA — the ledger checkout fails
270:              exit 1         # detect's own hard refusal — two judges, not one
(refused: 0 occurrences — no `refused` output at this SHA)

Merging this would move the caller from a stale-but-latent 2eb9bb19 pin to a callee
where the exemption ledger fetch fails, is swallowed by continue-on-error, is
treated as empty, and then fails closed — while detect exits 1 regardless. The
refusing pilots go red again, for no gain, in either merge order.

Correct sequence: merge #989 first, then retarget this PR to #989's squash SHA
(tracked as the re-pin wave, one caller first so the squash SHA is exercised before
the other four follow).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR