From 82c581ed028eace1cb1e6bf12123b14eae12f2a5 Mon Sep 17 00:00:00 2001
From: mdheller <21163552+mdheller@users.noreply.github.com>
Date: Fri, 31 Jul 2026 17:09:00 -0400
Subject: [PATCH 1/4] ci: adopt git-ops-standards pr-merge-gate

Calls the reusable workflow (unpinned cross-repo path deps, unresolved
review threads, conflicting mergeable state) as a check on every PR.
Not yet required in branch protection -- that's a separate, deliberate
step (see SocioProphet/git-ops-standards bindings/claude-code.md #5).
---
 .github/workflows/git-ops-standards.yml | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 .github/workflows/git-ops-standards.yml

diff --git a/.github/workflows/git-ops-standards.yml b/.github/workflows/git-ops-standards.yml
new file mode 100644
index 0000000..0988b45
--- /dev/null
+++ b/.github/workflows/git-ops-standards.yml
@@ -0,0 +1,8 @@
+name: git-ops-standards
+
+on:
+  pull_request:
+
+jobs:
+  gate:
+    uses: SocioProphet/git-ops-standards/.github/workflows/pr-merge-gate.yml@main

From f084e21172a867fdf959c0f192addfb7c5e71144 Mon Sep 17 00:00:00 2001
From: mdheller <21163552+mdheller@users.noreply.github.com>
Date: Fri, 31 Jul 2026 17:22:09 -0400
Subject: [PATCH 2/4] fix: grant matching permissions at the calling job level

Without this, GitHub rejects the reusable-workflow call before it ever
queues (conclusion: startup_failure) since the reusable workflow declares
permissions the caller wasn't explicitly granting. Root-caused and fixed
in sociosphere#508 first; see git-ops-standards' pr-merge-gate.yml header
comment for the full explanation.
---
 .github/workflows/git-ops-standards.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/git-ops-standards.yml b/.github/workflows/git-ops-standards.yml
index 0988b45..b543d70 100644
--- a/.github/workflows/git-ops-standards.yml
+++ b/.github/workflows/git-ops-standards.yml
@@ -5,4 +5,7 @@ on:
 
 jobs:
   gate:
+    permissions:
+      contents: read
+      pull-requests: read
     uses: SocioProphet/git-ops-standards/.github/workflows/pr-merge-gate.yml@main

From 539753c255102dce63ccc4d266a61951dc430b65 Mon Sep 17 00:00:00 2001
From: mdheller <21163552+mdheller@users.noreply.github.com>
Date: Fri, 31 Jul 2026 17:28:55 -0400
Subject: [PATCH 3/4] chore: retrigger CI now that SourceOS-Linux org Actions
 allowlist includes git-ops-standards


From 0f3550b584180b430be9266e1f56df959217396a Mon Sep 17 00:00:00 2001
From: mdheller <21163552+mdheller@users.noreply.github.com>
Date: Fri, 31 Jul 2026 17:38:20 -0400
Subject: [PATCH 4/4] chore: retrigger CI, longer propagation wait for org
 allowlist change