fix(ci): pin standards reusables to default-branch HEAD

[hyperpolymath]

Re-points this repo's hyperpolymath/standards reusable-workflow pins at the standards default-branch HEAD, 8f2ee50841e216cd8c192eeb68953118190f105c.

Why this is not a routine version bump.uses: org/repo/.github/workflows/x.yml@<ref> is resolved at workflow startup, so a bad ref is not a failing job — it is no job at all. This campaign repairs three kinds of drift and does not assume which one this repo had:

• an unreachable sha kills the run before any job is created, so GitHub reports no check at all rather than a failing one: the gate does not go red, it disappears, and gh pr checks simply lists fewer rows. A repo in this state looks greener than one with working gates;
• a floating ref such as @main runs, but unpinned — the supply-chain property the estate pins for is absent;
• a stale but reachable sha runs the reusable as it was, silently reintroducing every bug fixed since it.

The refs this repo was actually pinned to, before this PR: 257869d3061d5a8ed1529bf34225d90a2416d51a.

Expect this PR to surface failures that main does not show. Those failures are revealed, not introduced — they are the gates resuming work after being silently absent. The honest comparison is the set of check names emitted here versus on main, not pass/fail counts. On the canary (hyperpolymath/empty-linter#79) the governance suite was absent on main and emitted 25 checks once repaired.

The target is default-branch HEAD resolved at sweep time, never a sha copied from a plan: a reachable but non-HEAD sha silently reintroduces every bug fixed since it.

Engine: .git-private-farm/scripts/smtp-notify-sweep.sh --campaign campaigns/pin-repair.sh. Verification for this repo: files=3 pins=3 perms=0 permlines=0 from=257869d3061d5a8ed1529bf34225d90a2416d51a target=8f2ee508 sig=G 72ffc67 canon=a7325fbdc356 base=main

🤖 Generated with Claude Code

https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 739cfd17-33d2-4719-94c4-9399e731d9cd

📥 Commits

Reviewing files that changed from the base of the PR and between 480ca8e and 72ffc67.

📒 Files selected for processing (3)

• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/secret-scanner.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: governance / Trusted-base reduction policy

🔇 Additional comments (3)

.github/workflows/governance.yml (1)

34-34: LGTM!

.github/workflows/hypatia-scan.yml (1)

29-29: LGTM!

.github/workflows/secret-scanner.yml (1)

20-20: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated pinned versions of shared governance, security scanning, and secret-scanning workflows.
  • Maintains automated repository checks using newer workflow revisions.

Walkthrough

Three GitHub Actions workflows now reference commit 8f2ee50841e216cd8c192eeb68953118190f105c of the shared reusable workflow bundle.

Changes

Reusable workflow pin updates

Layer / File(s)	Summary
Update shared workflow pins .github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/secret-scanner.yml	The governance, Hypatia scan, and secret scanner workflows use the updated shared workflow commit.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk:⚪ Minimal · up to 72ffc

This updates governance, security-scan, and secret-scanner workflows to a newer immutable shared-workflow commit. No current merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the update to the three pinned reusable workflows and the reason for the change.
Title check	✅ Passed	The title clearly summarises the main change: updating CI standards reusable-workflow pins to the default-branch HEAD.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow line
Three pins now point to one design
Governance hops along
Scans keep their steady song
Secure paths run right on time}

_{Comment @coderabbitai help to get the list of available commands.}