diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 51c1a36c..de1dd8dc 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -43,12 +43,15 @@ workflows: '.github/workflows/ghcr-publish.yml': - 'actions/attest-build-provenance@v4.1.1' - 'actions/checkout@v7.0.1' + '.github/workflows/governance.yml': [] + '.github/workflows/hypatia-scan.yml': [] '.github/workflows/idris2-abi-ci.yml': - 'actions/checkout@v7.0.1' '.github/workflows/live-provers.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@stable' - 'swatinem/rust-cache@v2.9.1' + '.github/workflows/mirror.yml': [] '.github/workflows/mvp-smoke.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@stable' @@ -58,15 +61,20 @@ workflows: - 'actions/checkout@v7.0.1' - 'actions/deploy-pages@v5.0.0' - 'actions/upload-pages-artifact@v5.0.0' + '.github/workflows/rust-ci.yml': [] '.github/workflows/s4-loop.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@stable' - 'swatinem/rust-cache@v2.9.1' - 'taiki-e/install-action@v2.85.3' + '.github/workflows/scorecard.yml': [] + '.github/workflows/secret-scanner.yml': [] + '.github/workflows/security-scan.yml': [] '.github/workflows/server-boot-gate.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@stable' - 'swatinem/rust-cache@v2.9.1' + '.github/workflows/spark-theatre-gate.yml': [] '.github/workflows/verification-proofs-cron.yml': - 'actions/checkout@v7.0.1' '.github/workflows/workflow-linter.yml': diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 513ad091..0d830b6c 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -10,8 +10,9 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 # main 2026-07-07 (baseline-gated hypatia — standards#455/#464/#466) + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 108fa11b..91443525 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -12,10 +12,11 @@ on: workflow_dispatch: permissions: + actions: read contents: read - security-events: read + security-events: write jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: inherit diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index b57dfa47..411141eb 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -16,9 +16,10 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 # main 2026-05-30 (Radicle + Instant-Sync secret-presence gating #305) + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: inherit diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 288393ba..d4980ca3 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -15,7 +15,7 @@ permissions: jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@7c9db0e5909aab77bf11a444ade3b95c1d2b702e # re-pinned 2026-07-01: toolchain-required-input fix (standards#439) # main 2026-05-31 (CI/CD campaigns C001-C005) + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) with: enable_audit: true enable_coverage: true diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 41e18794..a5f737e4 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -10,6 +10,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: @@ -21,5 +22,5 @@ jobs: security-events: write id-token: write contents: read - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 # main 2026-05-28 (SPDX bump #249) + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: inherit diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index a4d88925..7b38e6f8 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -19,5 +19,5 @@ jobs: # caller must grant at least that or the run startup-fails. permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586 # main 2026-05-28 (SPDX bump #249 + pragma/.shell-secrets-ignore fix #236) + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) secrets: inherit diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml index bd6bc072..8915f3b5 100644 --- a/.github/workflows/spark-theatre-gate.yml +++ b/.github/workflows/spark-theatre-gate.yml @@ -12,11 +12,12 @@ on: branches: [main, master] permissions: + actions: read contents: read jobs: spark-theatre-gate: - uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@e03686486e11b662834d7090dffae54c3e96fd59 # main 2026-05-28 (SPDX bump #249) + uses: hyperpolymath/standards/.github/workflows/spark-theatre-gate.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # main 2026-08-04 (lockfile-bearing ref: actions.lock required by caller-side enforcement, standards#570) with: paths: "." enforce_zero_contract: false