From 6c60b3cd7711de7797d2f0e0be7a1799d841cb1e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 15 Sep 2026 09:58:02 +0100 Subject: [PATCH] fix(ci): repin every dead standards ref to a self-consistent commit Every reusable-workflow ref in this repo pointed at a SHA that is not a commit. Six of the seven distinct dead refs across the estate are BLOB oids -- the generator that wrote them called `git hash-object` on the reusable workflow FILE where it needed `git rev-parse` on the commit. A caller pinned at a non-commit dies at workflow STARTUP: conclusion `failure` (not `startup_failure`), ZERO jobs, run name == run path, and neither REST nor GraphQL carries a reason -- only the run page does. A required context whose workflow dies that way never reports at all, so the gate reads as ABSENT rather than failing, and the branch looks clean. Repinned to da2c748aad55c1a1dcba00b60fe4a35017bc6540. That SHA is NOT the standards default-branch tip, deliberately. GitHub validates a reusable against the CALLEE repo own .github/workflows/ actions.lock as it exists at that SHA. Dependabot routinely bumps a `uses:` inside a reusable without regenerating that lock, which makes the newer commit startup-fatal for every caller. Measured across the last 84 standards commits: 43 POISON / 41 SELF-CONSISTENT, alternating. Capability is not monotonic in time, so "bump to HEAD" is the wrong reflex; the tip (317101e0) is itself POISON on four refs. da2c748aad55 is the newest commit that validates against its own lock, and all six reusables this estate calls exist there. Rows repaired in this repo: mirror.yml -> mirror-reusable.yml scorecard.yml -> scorecard-reusable.yml Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01WgqXnnNWBkiKMyUeLqzcuN --- .github/workflows/mirror.yml | 2 +- .github/workflows/scorecard.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index c0c9631..5e64b6b 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -11,5 +11,5 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 secrets: inherit diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 11cf6c5..6b14d05 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -13,7 +13,7 @@ permissions: id-token: write jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 permissions: contents: read security-events: write