From ac2edb24bb0287d5595bd4f19e53179947a04821 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 9 Oct 2026 01:40:23 +0100 Subject: [PATCH] ci: pin the standards reusable workflows to #1209's merge (2e12b312) #73 restored block YAML so the actions-lock gate can read the pins, but it merged with the pins still at 900c42c7. At that SHA the gate step runs under `bash -e`, so the gate's exit 3 (missing-lock debt) kills the step before `rc=$?` is read, and the ledger that excuses jaffascript never runs. `governance / Actions lockfile verify` is red on main (809e521) for that reason. hyperpolymath/standards#1209 (merge 2e12b312, on standards main) reads the exit code with `|| rc=$?`. Between 900c42c7 and 2e12b312 only governance-reusable.yml changed among the four callees; the mirror, scorecard and secret-scanner reusables are byte-identical, so all four pins move together and the mirror.yml contract comment is updated to match. The workflows stay in block YAML (see #73). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01GpUzjdhWFi26k6s7AWxYcf --- .github/workflows/governance.yml | 2 +- .github/workflows/mirror.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 53c097f..0b12e8d 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -18,4 +18,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@900c42c70b968e11a2bca04bf0ce050be5c286dc + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@2e12b312b529c51f095ce3b22cd35968f5aba898 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 8cd4783..9bc3115 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -17,10 +17,10 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@900c42c70b968e11a2bca04bf0ce050be5c286dc + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@2e12b312b529c51f095ce3b22cd35968f5aba898 # Each forge job is still gated on vars._MIRROR_ENABLED, inside the # callee. Explicit secrets map, no secrets: inherit; these seven are the - # callee's complete optional contract at 900c42c70b968e11a2bca04bf0ce050be5c286dc. + # callee's complete optional contract at 2e12b312b529c51f095ce3b22cd35968f5aba898. secrets: GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 83e700e..6e3bf2a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -11,7 +11,7 @@ permissions: jobs: analysis: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@900c42c70b968e11a2bca04bf0ce050be5c286dc + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@2e12b312b529c51f095ce3b22cd35968f5aba898 # A job-level map replaces the workflow-level one, so every scope the # callee's jobs request must be listed here. actions: read is new in the # callee since 81dbf2dd. No secrets: the callee declares and reads none. diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 57740e8..66b72fc 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -24,4 +24,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@900c42c70b968e11a2bca04bf0ce050be5c286dc + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@2e12b312b529c51f095ce3b22cd35968f5aba898