fix(ci): restore workflows from startup_failure — re-pin standards reusables to da2c748a and reconcile actions.lock

[arena-ai-coding-agent]

What broke

Every workflow on main has startup_failed since c0f409b (PR #93): zero jobs, no logs, no check runs — invisible to gh pr checks, visible only via gh run list --json conclusion. Two compounding causes:

1. Dead pin. governance.yml pinned governance-reusable.yml@28f7a2cb… — a SHA that does not exist in hyperpolymath/standards (PR Fix: repair config parse errors and unblock main-branch CI #93 followed issue B1: governance / Workflow security linter fails (exit 127) — pin predates standards #684/#686 #86's suggested SHA verbatim; it is unresolvable, which alone startup-fails Governance).
2. actions.lock drift. The five standards-reusable callers (governance, hypatia-scan, mirror, scorecard, secret-scanner) carried empty lock entries while their workflows uses: hyperpolymath/standards@… pins, and dependencies kept nine orphan entries from retired pins (including denoland/setup-deno). The estate enforces the lockfile natively, keyed by workflow path — a pin the lock does not vouch for is rejected before any job runs (startup_failure, no check run), per the enforcement semantics documented in labels.yml / label-triage.yml.

Fix — align with rsr-template-repo (the estate reference, green on these exact pins)

Workflow	Change
governance.yml	pin → da2c748a; concurrency block; keeps the HYPATIA_SCAN_PAT passthrough (optional secret declared by the reusable at that pin — enables the "Live Actions policy (credentialed advisory)" job when configured)
hypatia-scan.yml	pin → da2c748a; concurrency; keeps security-events: write (SARIF upload, standards#451)
mirror.yml	pin → da2c748a; explicit 7-secret map instead of secrets: inherit (Hypatia WH008); concurrency
scorecard.yml	pin → da2c748a; job-level permission cap (contents: read, security-events: write, id-token: write) per template
secret-scanner.yml	pin → da2c748a; keeps secrets: inherit (the callee's documented GITHUB_TOKEN contract)
actions.lock	declares the standards pin under the five callers; adds the standards@da2c748a dependency entry with its 11 transitive pins; drops the orphaned denoland/setup-deno entry; refreshes editorconfig-checker to the da2c748a closure (51f63319)

da2c748a is the single estate pin used by rsr-template-repo for all standards reusables; it postdates the standards fixes named in issue #86 (#684 consumer-side lock verifier, #686 native lock resolution) and the advisory live-policy split named in issue #87. Every pin added here was verified to resolve on GitHub, and the lock closure was verified locally: 16 workflows, 16 entries, 30 dependencies, no orphans, no undeclared pins.

Issue status

• Closes B1: governance / Workflow security linter fails (exit 127) — pin predates standards #684/#686 #86 (governance security-linter exit 127 — completed correctly: PR Fix: repair config parse errors and unblock main-branch CI #93's re-pin targeted a nonexistent SHA; this PR pins the real one)
• Closes B2: governance / Allowlist Preflight fails (exit 3) — live policy check runs fail-closed without HYPATIA_SCAN_PAT #87 (live-policy fail-closed — da2c748a has the advisory split; secrets passthrough preserved)
• Closes B3: scan / rust-secrets fails on a test fixture password (+ stale permissions comment in secret-scanner.yml) #88 (fixed by Fix: repair config parse errors and unblock main-branch CI #93 — scanner-allow pragma at crypto.rs:828 + rewritten secret-scanner comment, both verified in-tree)
• Closes B5: Codeac analyze results fails on every PR — analysis crash from A1 invalid JSON (+ commit processing timeout) #90 (Codeac green since Fix: repair config parse errors and unblock main-branch CI #93 — the A1 JSON fix removed the ESLint crash; "Codeac analyze results" passed on Fix: repair config parse errors and unblock main-branch CI #93 and Ci: promote project workflows to root + strip dead praxis manifest entries #94)
• Closes C5: praxis dashboard/swarm package.json reference sources deleted in the language purge (2966736) #91, C6: 104 workflow files under project .github/workflows/ folders are never run by GitHub #92 (fixed by Ci: promote project workflows to root + strip dead praxis manifest entries #94 — dead praxis manifests stripped; useful workflows promoted; issues left stale-open because commit-message closes don't trigger)
• B4: mirror / mirror-bitbucket, mirror-disroot, mirror-codeberg, mirror-gitea fail at the push step (config-side) #89 (mirror pushes) remains owner-side configuration: the public halves of BITBUCKET_SSH_KEY / DISROOT_SSH_KEY / CODEBERG_SSH_KEY / GITEA_SSH_KEY still need registering as write deploy keys on the target forges (or set the four *_MIRROR_ENABLED variables to false). The workflow side is now aligned with the estate contract (explicit secrets map).

Closes #86
Closes #87
Closes #88
Closes #90
Closes #91
Closes #92

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 7adcf854-ea1f-4e8b-a3d7-60425d044517

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}