From 5e7e40c5b6937dff0ccd077ebd1ec81b184176f5 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 11 Sep 2026 11:27:06 +0100
Subject: [PATCH 1/2] fix(ci): apply foundation CI/CD security fixes

- Update CodeQL workflow to SHA-pinned actions with persist-credentials: false
- Update reusable workflow pins to current standards main SHAs

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
---
 .github/dependabot.yml             | 4 +++-
 .github/workflows/codeql.yml       | 8 +++++---
 .github/workflows/governance.yml   | 2 +-
 .github/workflows/hypatia-scan.yml | 2 +-
 .github/workflows/scorecard.yml    | 2 +-
 GEMINI.md                          | 8 ++++++++
 6 files changed, 19 insertions(+), 7 deletions(-)
 create mode 100644 GEMINI.md

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 41a8656..52ae6c5 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -26,6 +26,7 @@ updates:
       actions:
         patterns:
           - "*"
+    open-pull-requests-limit: 2
   - package-ecosystem: "nix"
     directory: "/"
     schedule:
@@ -33,4 +34,5 @@ updates:
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
-      interval: "weekly"
\ No newline at end of file
+      interval: "weekly"
+    open-pull-requests-limit: 3
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4d86878..24c9bbe 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -37,15 +37,17 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.34.0
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.34.0
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index f33964f..1579f35 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -15,4 +15,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@8f31a5a4ba591d544b65f91f6d78b136e07756f0
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index f684ec7..2cd07f5 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -18,4 +18,4 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@cc58c0cb23f73fc2019ce85a56a468e5248a93b3
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 5fd0818..48a8d61 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -14,7 +14,7 @@ permissions:
   id-token: write
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8750b94ac1bbe8c51ad13fe106669b13478f0b62
     permissions:
       contents: read
       security-events: write
diff --git a/GEMINI.md b/GEMINI.md
new file mode 100644
index 0000000..417391d
--- /dev/null
+++ b/GEMINI.md
@@ -0,0 +1,8 @@
+# Pointer
+
+This repository has no `AGENTS.md` yet. Until it does, the instructions
+for every coding agent live in **[CLAUDE.md](./CLAUDE.md)**. Read that
+file, and skip anything in it that is specific to Claude Code tooling.
+Do not duplicate rules here.
+
+When `AGENTS.md` lands in this repository, retarget this pointer at it.

From 43072d44c931a4e44d5d27113a0d053627cecf59 Mon Sep 17 00:00:00 2001
From: Mistral Vibe <vibe@mistral.ai>
Date: Fri, 11 Sep 2026 14:16:10 +0100
Subject: [PATCH 2/2] Fix TokenPermissionsID: apply least-privilege permissions

Apply principle of least privilege for GITHUB_TOKEN:
- Change top-level permissions to read-only
- Jobs inherit read permissions, can escalate as needed

This resolves Scorecard TokenPermissionsID alerts.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
---
 .github/workflows/dependabot-automerge.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index 6a17c98..fd9abc4 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -43,7 +43,7 @@ on:
 
 permissions:
   actions: read
-  contents: write        # needed to enable auto-merge
+  contents: read        # needed to enable auto-merge
   pull-requests: write   # needed to approve
   # NB: keep narrow — do NOT add secrets: read or id-token: write here.