Merge branch 'main' into dependabot/cargo/bots/echidnabot/cargo-e5cdbc99ac

Author: hyperpolymath

.github/workflows/governance.yml

@@ -34,4 +34,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 # main 2026-06-27
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-06-27

.github/workflows/hypatia-scan.yml

@@ -30,7 +30,7 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
     secrets: inherit
     # Total caller-side wall-clock cap for the reusable. Matches
     # Hypatia's `missing_timeout_minutes` rule expectation. The scan is

.github/workflows/mirror.yml

@@ -14,5 +14,5 @@ permissions:
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
     secrets: inherit

.github/workflows/scorecard.yml

@@ -15,5 +15,5 @@ jobs:
     permissions:
       security-events: write
       id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
     secrets: inherit

.github/workflows/secret-scanner.yml

@@ -22,5 +22,5 @@ jobs:
       contents: read
       pull-requests: write
       actions: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
     secrets: inherit

bots/cipherbot/src/analyzers/infra.rs

@@ -186,7 +186,7 @@ mod tests {
     #[test]
     fn test_detect_hardcoded_cred() {
         let analyzer = InfraAnalyzer;
-        let content = r#"password = "SuperSecretPass123!""#;
+        let content = r#"password = "SuperSecretPass123!""#; // scanner-allow: rust-secrets
         let usages = analyzer.analyze_content(Path::new("infra/main.tf"), content);
         assert!(!usages.is_empty(), "Should detect hardcoded credential");
         assert_eq!(usages[0].status, CryptoStatus::Reject);
@@ -204,7 +204,7 @@ mod tests {
     #[test]
     fn test_skip_non_infra_file() {
         let analyzer = InfraAnalyzer;
-        let content = r#"password = "SuperSecretPass123!""#;
+        let content = r#"password = "SuperSecretPass123!""#; // scanner-allow: rust-secrets
         let usages = analyzer.analyze_content(Path::new("src/main.rs"), content);
         assert!(usages.is_empty(), "Should skip non-IaC files");
     }

robot-repo-automaton/src/fixer.rs

@@ -1,14 +1,12 @@
-@@
--        content
--            .replace("gitbot-fleet", repo_name)
--            .replace("{{LICENSE}}", "MPL-2.0")
--            .replace("{{YEAR}}", &year)
--            .replace("{{AUTHOR}}", "Jonathan D.A. Jewell")
--            .replace("{{EMAIL}}", "j.d.a.jewell@open.ac.uk");
-+        content
-+            .replace("gitbot-fleet", repo_name)
-+            .replace("{{LICENSE}}", "MPL-2.0")
-+            .replace("{{YEAR}}", &year)
-+            .replace("{{AUTHOR}}", "Jonathan D.A. Jewell")
-+            .replace("{{EMAIL}}", "j.d.a.jewell@open.ac.uk")
-@@
+       content
+           .replace("gitbot-fleet", repo_name)
+           .replace("{{LICENSE}}", "MPL-2.0")
+           .replace("{{YEAR}}", &year)
+           .replace("{{AUTHOR}}", "Jonathan D.A. Jewell")
+           .replace("{{EMAIL}}", "j.d.a.jewell@open.ac.uk");
+       content
+           .replace("gitbot-fleet", repo_name)
+           .replace("{{LICENSE}}", "MPL-2.0")
+           .replace("{{YEAR}}", &year)
+           .replace("{{AUTHOR}}", "Jonathan D.A. Jewell")
+           .replace("{{EMAIL}}", "j.d.a.jewell@open.ac.uk")