Repository navigation
fix(ci): restore reachable standards workflow pins - #85
Closed
hyperpolymath wants to merge 1 commit into
Closed
hyperpolymath wants to merge 1 commit into
hyperpolymath wants to merge 1 commit into
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (5)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (13)
🔇 Additional comments (5)
📝 SummarySummary by CodeRabbit
WalkthroughFive GitHub Actions workflows now pin their reusable workflow references to commit ChangesReusable workflow pin updates
Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to This restores the five reusable CI workflow pins to the intended reachable revision while retaining immutable SHA pinning. No current merge-blocking risk remains. Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Owner
Author
|
Superseded by #88, which moves all five standards reusable pins to standards main HEAD (fad242d3) and pins the secret scanner's checkout@v7 to a sha. Closing so the two branches do not collide. |
hyperpolymath
added a commit
that referenced
this pull request
Sep 8, 2026
…ut (#88) Moves all five `hyperpolymath/standards` reusable-workflow pins (governance, hypatia-scan, mirror, scorecard, secret-scanner) from `7fdc2705`, which is not on standards `main`, to `fad242d35291de1898242d6737ba02b74a59a2f2`, the current standards `main` HEAD. Pins `actions/checkout@v7` in `secret-scanner.yml` to the `v7.0.1` sha already used by the other workflows, because `sha_pinning_required` rejects bare major tags at startup. **Root cause of the startup failures (second commit).** The pin bump alone still failed at startup for Governance and Hypatia, exactly as #86 did. At standards HEAD the governance, hypatia-scan and mirror reusables request `actions: read` at workflow level (hypatia since 2026-06-02, governance and mirror since 2026-07-26). A called workflow cannot request more than its caller grants, and this repo's callers granted only `contents: read`, so GitHub rejected each call before any job ran and reported no check. The secret-scanner reusable requests only `contents: read`, which is why it started and its three inner jobs went green under the same pin. The second commit grants `actions: read` on the three callers and adds `secrets: inherit` on governance, matching standards' own caller. Supersedes #85 (moves to the non-HEAD sha `092dedad`, which still carries the trufflehog repeated-`fail`-flag bug) and #86 (governance only). Remaining red after this: the repo's own `trufflehog` job in `secret-scanner.yml` (`flag 'fail' cannot be repeated`) is a separate defect in the caller-side step, not the reusable, and is left for its own PR. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replace the unreachable standards reusable-workflow commit 7fdc2705df74b4e352d2a1cde3e87a5923fdf329 with reachable standards main commit 092dedada188f56c5915f74a5fd40aac093742c3. The old SHA is an intermediate commit from squash-merged standards PR #596: it exists, but GitHub rejects it for cross-repository reusable workflows before creating jobs. This restores Hypatia/SARIF and the other affected workflows without weakening SHA pinning or branch protection. Estate incident: 251 active workflow files across 70 repositories in hyperpolymath and metadatastician.