fix(ci): close the governance gate — SPDX, permissions, SHA pins, reusable bump - #62
Merged
Merged
Conversation
…sable bump The governance gate is all-jobs-must-pass, so these ship as one commit; individually none of them turns the repo green. * SPDX line-1 header and a top-level `permissions:` block on every workflow file (the two `Workflow security linter` checks). * Every `uses:` tag reference resolved to a full 40-hex commit SHA. This satisfies the linter and also the repository's own `sha_pinning_required` Actions policy, which refuses `@v4` at parse time — a refusal that produces no check run at all. * `hypatia-scan.yml` now grants `security-events: write`. This is not cosmetic and is not separable from the pin bump below: at HEAD the reusable declares `security-events: write` where the old pin declared `read`, and a called workflow cannot escalate beyond its caller's grant. Bumping the pin without this would fail at parse time. * The three reusables watched by the staleness gate (governance, hypatia-scan, scorecard) advanced to standards HEAD, which is 62 commits ahead of the false-green cache fix and includes the deny-list-negative fix from standards#524. `mirror-reusable` and `secret-scanner-reusable` are deliberately left on their current pins: the staleness gate does not watch them, so they are not holding anything red, and bumping them carries unrelated risk. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
hyperpolymath
marked this pull request as ready for review
July 21, 2026 20:50
hyperpolymath
added
cicd
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The governance gate is all-jobs-must-pass, so these ship as one commit;
individually none of them turns the repo green.
permissions:block on everyworkflow file (the two
Workflow security linterchecks).uses:tag reference resolved to a full 40-hex commit SHA. Thissatisfies the linter and also the repository's own
sha_pinning_requiredActions policy, which refuses@v4at parsetime — a refusal that produces no check run at all.
hypatia-scan.ymlnow grantssecurity-events: write. This is notcosmetic and is not separable from the pin bump below: at HEAD the
reusable declares
security-events: writewhere the old pin declaredread, and a called workflow cannot escalate beyond its caller'sgrant. Bumping the pin without this would fail at parse time.
hypatia-scan, scorecard) advanced to standards HEAD, which is 62
commits ahead of the false-green cache fix and includes the
deny-list-negative fix from standards#524.
mirror-reusableandsecret-scanner-reusableare deliberately left ontheir current pins: the staleness gate does not watch them, so they are
not holding anything red, and bumping them carries unrelated risk.
Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com