chore(ci): bump governance-reusable pin to standards main

[hyperpolymath]

Pinned revision 81dbf2dd of governance-reusable.yml carries two bugs that make Governance red on every consumer:

1. Workflow security linter runs bash scripts/update-actions-lock.sh --verify-local in the caller's checkout, where the script does not exist — exit 127.
2. Allowlist Preflight runs check-actions-policy.sh with an empty GH_TOKEN — gh refuses, exit 3.

Both are cured on standards main (fad242d35291de1898242d6737ba02b74a59a2f2): the verifier is copied into \$RUNNER_TEMP, and the policy step is skipped when no credential is supplied.

Witness: verified green on hyperpolymath/blocky-writer#55 at this exact SHA — governance run completed/success, 15/15 jobs, including the two jobs that were red on that repo's default branch.

Judge this PR by the set difference against your own default branch (which governance jobs are newly red), not by overall check colour — unrelated build failures may pre-date it.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: aa7cf7da-d4a7-45df-b605-5e13ab7fdeb7

📥 Commits

Reviewing files that changed from the base of the PR and between 6b85964 and e0c43c4.

📒 Files selected for processing (1)

• .github/workflows/governance.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: rust-ci / Coverage (tarpaulin + codecov)
• GitHub Check: rust-ci / Cargo audit (security)
• GitHub Check: analyze (javascript-typescript, none)

⚠️ CI failures not shown inline (24)

GitHub Actions: CI/CD Pipeline / 2_Test (3.11).txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run python -m pip install --upgrade pip
 �[36;1mpython -m pip install --upgrade pip�[0m
 �[36;1mpip install -r requirements.txt�[0m
 �[36;1mpip install -e .�[0m
 shell: /usr/bin/bash -e {0}
 env:
   pythonLocation: /opt/hostedtoolcache/Python/3.11.16/x64
   PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.11.16/x64/lib/pkgconfig
   Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.11.16/x64/lib
 ##[endgroup]
 Requirement already satisfied: pip in /opt/hostedtoolcache/Python/3.11.16/x64/lib/python3.11/site-packages (26.2.1)
 ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'
 ##[error]The operation was canceled.

---

GitHub Actions: CI/CD Pipeline / Test (3.11): chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run python -m pip install --upgrade pip
 �[36;1mpython -m pip install --upgrade pip�[0m
 �[36;1mpip install -r requirements.txt�[0m
 �[36;1mpip install -e .�[0m
 shell: /usr/bin/bash -e {0}
 env:
   pythonLocation: /opt/hostedtoolcache/Python/3.11.16/x64
   PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.11.16/x64/lib/pkgconfig
   Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.11.16/x64/lib
 ##[endgroup]
 Requirement already satisfied: pip in /opt/hostedtoolcache/Python/3.11.16/x64/lib/python3.11/site-packages (26.2.1)
 ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'
 ##[error]The operation was canceled.

---

GitHub Actions: CI/CD Pipeline / 3_Build Documentation.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run python -m pip install --upgrade pip
 �[36;1mpython -m pip install --upgrade pip�[0m
 �[36;1mpip install -r requirements.txt�[0m
 shell: /usr/bin/bash -e {0}
 env:
   pythonLocation: /opt/hostedtoolcache/Python/3.11.16/x64
   PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.11.16/x64/lib/pkgconfig
   Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.11.16/x64/lib
 ##[endgroup]
 Requirement already satisfied: pip in /opt/hostedtoolcache/Python/3.11.16/x64/lib/python3.11/site-packages (26.2.1)
 ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'
 ##[error]Process completed with exit code 1.

---

GitHub Actions: CI/CD Pipeline / Build Documentation: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run python -m pip install --upgrade pip
 �[36;1mpython -m pip install --upgrade pip�[0m
 �[36;1mpip install -r requirements.txt�[0m
 shell: /usr/bin/bash -e {0}
 env:
   pythonLocation: /opt/hostedtoolcache/Python/3.11.16/x64
   PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.11.16/x64/lib/pkgconfig
   Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.11.16/x64
   LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.11.16/x64/lib
 ##[endgroup]
 Requirement already satisfied: pip in /opt/hostedtoolcache/Python/3.11.16/x64/lib/python3.11/site-packages (26.2.1)
 ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'
 ##[error]Process completed with exit code 1.

---

GitHub Actions: CI/CD Pipeline / 5_Test (3.10).txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run python -m pip install --upgrade pip
 �[36;1mpython -m pip install --upgrade pip�[0m
 �[36;1mpip install -r requirements.txt�[0m
 �[36;1mpip install -e .�[0m
 shell: /usr/bin/bash -e {0}
 env:
   pythonLocation: /opt/hostedtoolcache/Python/3.10.21/x64
   PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.10.21/x64/lib/pkgconfig
   Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.10.21/x64
   Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.10.21/x64
   Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.10.21/x64
   LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.10.21/x64/lib
 ##[endgroup]
 Requirement already satisfied: pip in /opt/hostedtoolcache/Python/3.10.21/x64/lib/python3.10/site-packages (26.2.1)
 ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'
 ##[error]The operation was canceled.

---

GitHub Actions: CI/CD Pipeline / Test (3.10): chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run python -m pip install --upgrade pip
 �[36;1mpython -m pip install --upgrade pip�[0m
 �[36;1mpip install -r requirements.txt�[0m
 �[36;1mpip install -e .�[0m
 shell: /usr/bin/bash -e {0}
 env:
   pythonLocation: /opt/hostedtoolcache/Python/3.10.21/x64
   PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.10.21/x64/lib/pkgconfig
   Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.10.21/x64
   Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.10.21/x64
   Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.10.21/x64
   LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.10.21/x64/lib
 ##[endgroup]
 Requirement already satisfied: pip in /opt/hostedtoolcache/Python/3.10.21/x64/lib/python3.10/site-packages (26.2.1)
 ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'
 ##[error]The operation was canceled.

---

GitHub Actions: CI/CD Pipeline / 6_Test (3.12).txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run python -m pip install --upgrade pip
 �[36;1mpython -m pip install --upgrade pip�[0m
 �[36;1mpip install -r requirements.txt�[0m
 �[36;1mpip install -e .�[0m
 shell: /usr/bin/bash -e {0}
 env:
   pythonLocation: /opt/hostedtoolcache/Python/3.12.14/x64
   PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.12.14/x64/lib/pkgconfig
   Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.14/x64
   Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.14/x64
   Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.14/x64
   LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.12.14/x64/lib
 ##[endgroup]
 Requirement already satisfied: pip in /opt/hostedtoolcache/Python/3.12.14/x64/lib/python3.12/site-packages (26.2.1)
 ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'
 ##[error]Process completed with exit code 1.

---

GitHub Actions: CI/CD Pipeline / Test (3.12): chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run python -m pip install --upgrade pip
 �[36;1mpython -m pip install --upgrade pip�[0m
 �[36;1mpip install -r requirements.txt�[0m
 �[36;1mpip install -e .�[0m
 shell: /usr/bin/bash -e {0}
 env:
   pythonLocation: /opt/hostedtoolcache/Python/3.12.14/x64
   PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.12.14/x64/lib/pkgconfig
   Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.14/x64
   Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.14/x64
   Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.14/x64
   LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.12.14/x64/lib
 ##[endgroup]
 Requirement already satisfied: pip in /opt/hostedtoolcache/Python/3.12.14/x64/lib/python3.12/site-packages (26.2.1)
 ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'
 ##[error]Process completed with exit code 1.

---

GitHub Actions: Governance / 2_governance _ Code quality + docs.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
 with:
   github-***REDACTED_SECRET_ASSIGNMENT***
   version: latest
 ##[endgroup]
 Find 'latest' release
 ##[error]Error: The binary 'ec-linux-amd64*' not found

---

GitHub Actions: Governance / governance _ Code quality + docs: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
 with:
   github-***REDACTED_SECRET_ASSIGNMENT***
   version: latest
 ##[endgroup]
 Find 'latest' release
 ##[error]Error: The binary 'ec-linux-amd64*' not found

---

GitHub Actions: Governance / 3_governance _ Security policy checks.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run FAILED=false
 �[36;1mFAILED=false�[0m
 �[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
 �[36;1m  echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
 �[36;1m  echo "$WEAK_CRYPTO"�[0m
 �[36;1mfi�[0m
 �[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
 �[36;1m  echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
 �[36;1m  echo "$HTTP_URLS"�[0m
 �[36;1mfi�[0m
 �[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
 �[36;1mif [ -n "$SECRETS" ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

---

GitHub Actions: Governance / governance _ Security policy checks: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run FAILED=false
 �[36;1mFAILED=false�[0m
 �[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
 �[36;1m  echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
 �[36;1m  echo "$WEAK_CRYPTO"�[0m
 �[36;1mfi�[0m
 �[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
 �[36;1m  echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
 �[36;1m  echo "$HTTP_URLS"�[0m
 �[36;1mfi�[0m
 �[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
 �[36;1mif [ -n "$SECRETS" ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

---

GitHub Actions: Governance / governance _ Security policy checks: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

---

GitHub Actions: Governance / 5_governance _ Actions lockfile verify.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at job.workflow_sha failed?)"�[0m

---

GitHub Actions: Governance / governance _ Actions lockfile verify: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at job.workflow_sha failed?)"�[0m

---

GitHub Actions: Governance / 7_governance _ Workflow security linter.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

---

GitHub Actions: Governance / governance _ Workflow security linter: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

---

GitHub Actions: Governance / governance _ Workflow security linter: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1m# Standards exercises its pull-request scripts; every consumer uses�[0m
 �[36;1m# the canonical scripts fetched from this workflow's immutable�[0m
 �[36;1m# Standards revision.�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

---

GitHub Actions: Governance / 9_governance _ Language _ package anti-pattern policy.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
 �[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
 �[36;1m   && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-ts-allowlist.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

---

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
 �[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
 �[36;1m   && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-ts-allowlist.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

---

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"
 �[36;1mSCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f tools/policy/check-language-policy.sh ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-language-policy.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::language-policy gate not found in standards@main or locally"�[0m

---

GitHub Actions: Governance / 13_governance _ Well-Known (RFC 9116 + RSR).txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

---

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

---

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m

🔇 Additional comments (1)

.github/workflows/governance.yml (1)

17-17: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the project’s governance automation to use the latest approved workflow revision.
  • No changes to user-facing features or application behaviour.

Walkthrough

The governance job now references a newer pinned commit of the reusable governance workflow.

Changes

Governance workflow

Layer / File(s)	Summary
Update governance workflow reference .github/workflows/governance.yml	The uses: reference changes from commit 81dbf2dd854b1444fd6236fa2352474383b2c2b9 to commit fad242d35291de1898242d6737ba02b74a59a2f2.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to e0c43

The governance workflow now uses the updated pinned reusable workflow revision. No current merge-blocking risk is identified.

Poem

A rabbit checks the workflow pin
One newer commit hops in
The governance path stays clear
No tangled cables hide near
CI bounds forward with a grin

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the two governance failures, the corrective changes, and the verification result. It does not follow the repository template and omits required sections such as Type of Change…	Add the required template sections. Mark CI/CD improvement under Type of Change, list the revision change under Changes Made, document the test commands and results, complete the applicable checklists, state the performance and breaking-cha…

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI change: it updates the pinned governance reusable workflow revision.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the two governance failures, the corrective changes, and the verification result. It does not follow the repository template and omits required sections such as Type of Change, Changes Made, Testing, checklists, Performance Impact, Breaking Changes, and reviewer confirmations.

Resolution

Add the required template sections. Mark CI/CD improvement under Type of Change, list the revision change under Changes Made, document the test commands and results, complete the applicable checklists, state the performance and breaking-change impact, and provide the required confirmations. Retain the existing failure analysis and verification evidence.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud