From 80749dacebded6f98a4c71568f37fef4280be596 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 15 Sep 2026 09:03:12 +0100 Subject: [PATCH 1/3] fix(ci): repin governance-reusable off a phantom SHA 8f31a5a4ba591d544b65f91f6d78b136e07756f0 does not exist in hyperpolymath/standards: compare/main...8f31a5a4 returns 404, not "behind". A caller pinned to a nonexistent ref cannot start. The run is created with jobs.total_count == 0 and emits NO check run, so the required context "governance / Code quality + docs" never reports and the repo reads GREENER than a healthy one. Repinned to da2c748aad55c1a1dcba00b60fe4a35017bc6540 (standards main, 2026-09-14T20:13:37Z). Owner ruling R-U 2026-09-15: fix the workflow, not the rule (plan C8). No ruleset was edited; the required status check is unchanged. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01TCKh98NmUmfvgpuGyJbNu8 --- .github/workflows/governance.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 4e887a4..973aafe 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -16,4 +16,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@8f31a5a4ba591d544b65f91f6d78b136e07756f0 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 From 7914f1f5a9caed8122d1c91139c1bb916d64c9b1 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 15 Sep 2026 10:33:40 +0100 Subject: [PATCH 2/3] fix(ci): resolve committed conflict markers and repin two dead reusables MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This branch carried unresolved conflict markers committed into .github/workflows/hypatia-scan.yml and .github/workflows/secret-scanner.yml. An unparseable workflow is rejected before any job is created, so both ran as `failure` with total_count 0 and emitted no check — which reads as a phantom-pin failure and hides the real cause. Two of the five standards reusable pins on this branch were also dead refs that resolve to no commit in hyperpolymath/standards: hypatia-scan-reusable.yml @cc58c0cb -> da2c748a scorecard-reusable.yml @8750b94a -> da2c748a Resolutions: - hypatia-scan.yml: conflict sides were byte-identical; collapsed to one `uses:` and repinned off the dead cc58c0cb. - secret-scanner.yml: the sides pinned two different live commits (7fdc2705, 84355587) holding distinct blobs of the reusable; resolved to da2c748a, the newest and the commit this branch already uses for governance. - scorecard.yml: repinned off the dead 8750b94a. - Dropped the duplicated "managed by gh actions-lock" header the merge left. mirror.yml is left at 84355587 — a live commit, not a dead pin. actions.lock is unchanged and does not need to change: reusable-WORKFLOW refs are not keyed in the lockfile (the three touched files key no actions at all), so this is not the class of repin that must move a lock key in the same commit. Verified: all 5 remaining standards pins resolve to real commits, all 13 workflow files parse under `yq -e`, and a negative control confirms yq rejects markers. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_014QN8x5x4kNKY8EYCFsCmWB --- .github/workflows/hypatia-scan.yml | 7 +------ .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 8 +------- 3 files changed, 3 insertions(+), 14 deletions(-) diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index eaa6a8f..5d7280e 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# This workflow is managed by gh actions-lock. name: Hypatia Security Scan on: @@ -19,8 +18,4 @@ permissions: jobs: scan: -<<<<<<< HEAD - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@cc58c0cb23f73fc2019ce85a56a468e5248a93b3 -======= - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@cc58c0cb23f73fc2019ce85a56a468e5248a93b3 ->>>>>>> 2399bc4f2fc8d20628afe2166d4cc0c7ca7378bf + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 6f86cda..0ec8b33 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -15,7 +15,7 @@ permissions: id-token: write jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8750b94ac1bbe8c51ad13fe106669b13478f0b62 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 permissions: contents: read security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index b8c2469..5fbe025 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# This workflow is managed by gh actions-lock. name: Secret Scanner on: @@ -22,10 +21,5 @@ jobs: contents: read pull-requests: write actions: read -<<<<<<< HEAD - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 - secrets: inherit -======= - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 secrets: inherit ->>>>>>> 2399bc4f2fc8d20628afe2166d4cc0c7ca7378bf From b67fbfc5a6bbc2be99d132e6e461ecd664d14d1c Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 15 Sep 2026 10:45:37 +0100 Subject: [PATCH 3/3] fix(ci): re-key actions.lock codeql entry to the commit the workflow uses MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `governance / Actions lockfile verify` was red with `valid: false`. The sole blocking finding was `stale`: the lockfile pinned `github/codeql-action@v4.37.7` (commit ff2f1c62) while codeql.yml actually uses `github/codeql-action/{init,analyze}@cdf488f5`, which is v4.37.9. No `uses:` referenced the locked entry, so the tool reported it stale and the gate propagated exit 1. This is PRE-EXISTING, not caused by the pin repair in the parent commit: codeql.yml is untouched by this branch. It only became visible because `governance-reusable.yml` was pinned to a dead SHA, so the gate had never executed. (The `# v3` comment beside the codeql-action pin is stale and wrong — cdf488f5 is v4.37.9. Comment left alone; it is not the gate's input.) Hand-written rather than regenerated. `gh actions-lock` v0.1.6 in update mode computes the correct lock entry but also rewrites workflow bytes: it DE-PINS SHAs back to tags (`@3d3c42e5… # v7.0.1` -> `@v7.0.1`, `@cdf488f5… # v3` -> `@v4.37.9`) and prepends another "# This workflow is managed by gh actions-lock." header to all 13 files on every run — which is where the duplicated headers resolved in the parent commit came from. Taking its lock output and discarding its workflow output. Verified with the real gate, matched pair, same tool version CI uses (v0.1.6): original workflow bytes + old lock -> valid:false, rc 1 original workflow bytes + new lock -> valid:true, rc 0 (3 sha-as-ref advisories) All 13 workflow files byte-identical after the verifier run. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_014QN8x5x4kNKY8EYCFsCmWB --- .github/workflows/actions.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index e3a8755..06aace2 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -14,7 +14,7 @@ workflows: - 'haskell-actions/setup@v2.12.0' '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - - 'github/codeql-action@v4.37.7' + - 'github/codeql-action@v4.37.9' '.github/workflows/dogfood-gate.yml': - 'actions/checkout@v7.0.1' - 'hyperpolymath/a2ml-ecosystem@main' @@ -63,9 +63,9 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' - 'github/codeql-action@v4.37.7': - ref: 'v4.37.7' - commit: 'sha1-ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd' + 'github/codeql-action@v4.37.9': + ref: 'v4.37.9' + commit: 'sha1-cdf488f595d80d6e07e03d4674febd5ab45fa938' owner_id: 9919 repo_id: 259445878 'haskell-actions/setup@v2.12.0':