From 6638db41949c4b4edd9aa555e3cbd6f311df1fce Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 15 Sep 2026 09:58:06 +0100 Subject: [PATCH] fix(ci): repin every dead standards ref to a self-consistent commit Every reusable-workflow ref in this repo pointed at a SHA that is not a commit. Six of the seven distinct dead refs across the estate are BLOB oids -- the generator that wrote them called `git hash-object` on the reusable workflow FILE where it needed `git rev-parse` on the commit. A caller pinned at a non-commit dies at workflow STARTUP: conclusion `failure` (not `startup_failure`), ZERO jobs, run name == run path, and neither REST nor GraphQL carries a reason -- only the run page does. A required context whose workflow dies that way never reports at all, so the gate reads as ABSENT rather than failing, and the branch looks clean. Repinned to da2c748aad55c1a1dcba00b60fe4a35017bc6540. That SHA is NOT the standards default-branch tip, deliberately. GitHub validates a reusable against the CALLEE repo own .github/workflows/ actions.lock as it exists at that SHA. Dependabot routinely bumps a `uses:` inside a reusable without regenerating that lock, which makes the newer commit startup-fatal for every caller. Measured across the last 84 standards commits: 43 POISON / 41 SELF-CONSISTENT, alternating. Capability is not monotonic in time, so "bump to HEAD" is the wrong reflex; the tip (317101e0) is itself POISON on four refs. da2c748aad55 is the newest commit that validates against its own lock, and all six reusables this estate calls exist there. Rows repaired in this repo: governance.yml -> governance-reusable.yml hypatia-scan.yml -> hypatia-scan-reusable.yml scorecard.yml -> scorecard-reusable.yml Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01WgqXnnNWBkiKMyUeLqzcuN --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/scorecard.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index b5ea41c..4a1afdb 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -15,6 +15,6 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@8f31a5a4ba591d544b65f91f6d78b136e07756f0 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 secrets: HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }} diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 8d8e4d8..64d6033 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -18,6 +18,6 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@cc58c0cb23f73fc2019ce85a56a468e5248a93b3 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 with: block-on-high: true diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index d4abbcf..a47623e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -19,4 +19,4 @@ jobs: security-events: write # Lets the reusable workflow request an OIDC token for signed provenance. id-token: write - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8750b94ac1bbe8c51ad13fe106669b13478f0b62 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540