fix(ci): pin standards reusables to default-branch HEAD

[hyperpolymath]

Re-points this repo's hyperpolymath/standards reusable-workflow pins at the standards default-branch HEAD, 257869d3061d5a8ed1529bf34225d90a2416d51a.

This PR makes two changes, not one. It also widens the top-level permissions: block of 1 workflow file(s). A caller that grants a reusable less than the reusable's own permissions: request is rejected at workflow startup — the exact failure this PR exists to cure — so bumping the pin without this would move the repo from one silent disappearance to another. The scopes added are not hardcoded: each reusable's request is read from 257869d3at sweep time and only the genuinely missing scopes are added, at the indent the file already uses. Only read-level scopes are added this way; anything needing write is held for review instead.

Why this is not a routine version bump.uses: org/repo/.github/workflows/x.yml@<ref> is resolved at workflow startup, so a bad ref is not a failing job — it is no job at all. This campaign repairs three kinds of drift and does not assume which one this repo had:

• an unreachable sha kills the run before any job is created, so GitHub reports no check at all rather than a failing one: the gate does not go red, it disappears, and gh pr checks simply lists fewer rows. A repo in this state looks greener than one with working gates;
• a floating ref such as @main runs, but unpinned — the supply-chain property the estate pins for is absent;
• a stale but reachable sha runs the reusable as it was, silently reintroducing every bug fixed since it.

The refs this repo was actually pinned to, before this PR: 092dedada188f56c5915f74a5fd40aac093742c3 892497fe373744874316710966b81ae6f0ea9e66.

Expect this PR to surface failures that main does not show. Those failures are revealed, not introduced — they are the gates resuming work after being silently absent. The honest comparison is the set of check names emitted here versus on main, not pass/fail counts. On the canary (hyperpolymath/empty-linter#79) the governance suite was absent on main and emitted 25 checks once repaired.

The target is default-branch HEAD resolved at sweep time, never a sha copied from a plan: a reachable but non-HEAD sha silently reintroduces every bug fixed since it.

Engine: .git-private-farm/scripts/smtp-notify-sweep.sh --campaign campaigns/pin-repair.sh. Verification for this repo: files=3 pins=3 perms=1 permlines=1 from=092dedada188f56c5915f74a5fd40aac093742c3,892497fe373744874316710966b81ae6f0ea9e66 target=257869d3 sig=G 13d5da6 canon=393d9db5fa79 base=main

🤖 Generated with Claude Code

https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 55a8c1c1-b253-46a8-8940-b4eb6d01bacd

📥 Commits

Reviewing files that changed from the base of the PR and between a25a93a and 13d5da6.

📒 Files selected for processing (3)

• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/secret-scanner.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🔇 Additional comments (3)

.github/workflows/governance.yml (1)

34-34: LGTM!

.github/workflows/hypatia-scan.yml (1)

22-22: LGTM!

Also applies to: 29-29

.github/workflows/secret-scanner.yml (1)

20-20: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the automated governance, security scanning and secret-scanning workflows to use newer pinned workflow versions.
  • Adjusted security scan permissions to support required read access.
  • These maintenance updates improve the reliability and security of automated repository checks without changing end-user functionality.

Walkthrough

The pull request updates pinned reusable GitHub Actions workflows for governance, Hypatia scanning, and secret scanning. It also adds actions: read to the Hypatia workflow permissions.

Changes

Workflow updates

Layer / File(s)	Summary
Pinned workflow and permission updates .github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/secret-scanner.yml	The workflows use newer pinned reusable workflow commits. The Hypatia workflow adds actions: read permission.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk:⚪ Minimal · up to 13d5d

This updates pinned governance and security-scanning workflows and adds the read access needed by the Hypatia scan. The workflow references remain commit-pinned and no merge-blocking risk is currently identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: pinning CI reusable workflows to the default-branch HEAD.
Description check	✅ Passed	The description directly explains the updated workflow pins, the permissions change, the affected references, and the expected effect on checks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow trail
Fresh pins hop into place
Hypatia reads its actions
Scanners guard the space
Governance runs with steady pace}

_{Comment @coderabbitai help to get the list of available commands.}