chore(ci): bump governance-reusable pin to standards main - #77

Merged

hyperpolymath merged 1 commit into

mainfrom

chore/bump-governance-pin-to-standards-main

Sep 8, 2026

hyperpolymath commented Sep 7, 2026

Owner

Pinned revision 84355587 of governance-reusable.yml carries two bugs that make Governance red on every consumer:

Workflow security linter runs bash scripts/update-actions-lock.sh --verify-local in the caller's checkout, where the script does not exist — exit 127.
Allowlist Preflight runs check-actions-policy.sh with an empty GH_TOKEN — gh refuses, exit 3.

Both are cured on standards main (fad242d35291de1898242d6737ba02b74a59a2f2): the verifier is copied into \$RUNNER_TEMP, and the policy step is skipped when no credential is supplied.

Witness: verified green on hyperpolymath/blocky-writer#55 at this exact SHA — governance run completed/success, 15/15 jobs, including the two jobs that were red on that repo's default branch.

Judge this PR by the set difference against your own default branch (which governance jobs are newly red), not by overall check colour — unrelated build failures may pre-date it.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

chore(ci): bump governance-reusable pin to standards main

ee3e78a

The pinned revision carries bugs that make Governance red on every
consumer: the Workflow security linter runs update-actions-lock.sh from
the CALLER's checkout where it does not exist (exit 127), and Allowlist
Preflight runs check-actions-policy.sh with an empty GH_TOKEN (exit 3).
Both are fixed on standards main. Witnessed green on hyperpolymath/blocky-writer
at this exact SHA: governance run completed/success, 15/15 jobs.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

coderabbitaiBot commented Sep 7, 2026•
edited
Loading

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: ebfbbdc1-fa9d-48d6-8615-63db366c3a08

📥 Commits

Reviewing files that changed from the base of the PR and between 6c1591c and ee3e78a.

📒 Files selected for processing (1)

.github/workflows/governance.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
GitHub Check: analyze (rust, none)

⚠️ CI failures not shown inline (25)

GitHub Actions: Central Estate CI/CD Audit / 0_estate-audit.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run # Presence-only checking rewards filler. This gate previously demanded
�[36;1m# Presence-only checking rewards filler. This gate previously demanded�[0m
�[36;1m# ARCHITECTURE.md / MAINTAINERS.adoc / GOVERNANCE.md and checked only�[0m
�[36;1m# that the paths existed — so the cheapest way to pass was to commit�[0m
�[36;1m# template boilerplate. That happened: an estate repo acquired an�[0m
�[36;1m# ARCHITECTURE.md describing a directory layout it does not have, a�[0m
�[36;1m# MAINTAINERS naming a different account as owner, and a mise.toml�[0m
�[36;1m# pinning `zig = "latest"` against that repo's own .tool-versions.�[0m
�[36;1m# All three would have passed. So: presence, THEN format, THEN substance.�[0m
�[36;1m#�[0m
�[36;1m# Format policy (estate):�[0m
�[36;1m# .adoc documentation (default)�[0m
�[36;1m# .md wiki content only — plus a transitional allowance for the�[0m
�[36;1m# GitHub-mandated files, which are migrating to berrywiki format�[0m
�[36;1m# .txt licence texts�[0m
�[36;1m# fixed names GitHub or convention dictates (CODEOWNERS, funding.yml,�[0m
�[36;1m# NOTICE, AUTHORS, MAINTAINERS) keep their form�[0m
�[36;1mset -uo pipefail�[0m
�[36;1mfail=0�[0m
�[36;1m�[0m
�[36;1m# --- presence, accepting every policy-legal form -------------------�[0m
�[36;1m# "name:form1,form2,..." — first existing form wins.�[0m
�[36;1mdeclare -a required=(�[0m
�[36;1m ".editorconfig:.editorconfig"�[0m
�[36;1m ".gitignore:.gitignore"�[0m
�[36;1m ".gitattributes:.gitattributes"�[0m
�[36;1m "CODEOWNERS:CODEOWNERS,.github/CODEOWNERS,docs/CODEOWNERS"�[0m
�[36;1m "GOVERNANCE:GOVERNANCE.adoc,GOVERNANCE.md"�[0m
�[36;1m "ARCHITECTURE:ARCHITECTURE.adoc,ARCHITECTURE.md,docs/architecture/README.adoc,TOPOLOGY.adoc,TOPOLOGY.md"�[0m
�[36;1m "MAINTAINERS:MAINTAINERS,MAINTAINERS.adoc,MAINTAINERS.md"�[0m
�[36;1m "toolchain:.tool-versions,mise.toml"�[0m
�[36;1m)�[0m
�[36;1m�[0m
�[36;1mdeclare -A found=()�[0m
�[36;1...

GitHub Actions: Central Estate CI/CD Audit / estate-audit: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run # Presence-only checking rewards filler. This gate previously demanded
�[36;1m# Presence-only checking rewards filler. This gate previously demanded�[0m
�[36;1m# ARCHITECTURE.md / MAINTAINERS.adoc / GOVERNANCE.md and checked only�[0m
�[36;1m# that the paths existed — so the cheapest way to pass was to commit�[0m
�[36;1m# template boilerplate. That happened: an estate repo acquired an�[0m
�[36;1m# ARCHITECTURE.md describing a directory layout it does not have, a�[0m
�[36;1m# MAINTAINERS naming a different account as owner, and a mise.toml�[0m
�[36;1m# pinning `zig = "latest"` against that repo's own .tool-versions.�[0m
�[36;1m# All three would have passed. So: presence, THEN format, THEN substance.�[0m
�[36;1m#�[0m
�[36;1m# Format policy (estate):�[0m
�[36;1m# .adoc documentation (default)�[0m
�[36;1m# .md wiki content only — plus a transitional allowance for the�[0m
�[36;1m# GitHub-mandated files, which are migrating to berrywiki format�[0m
�[36;1m# .txt licence texts�[0m
�[36;1m# fixed names GitHub or convention dictates (CODEOWNERS, funding.yml,�[0m
�[36;1m# NOTICE, AUTHORS, MAINTAINERS) keep their form�[0m
�[36;1mset -uo pipefail�[0m
�[36;1mfail=0�[0m
�[36;1m�[0m
�[36;1m# --- presence, accepting every policy-legal form -------------------�[0m
�[36;1m# "name:form1,form2,..." — first existing form wins.�[0m
�[36;1mdeclare -a required=(�[0m
�[36;1m ".editorconfig:.editorconfig"�[0m
�[36;1m ".gitignore:.gitignore"�[0m
�[36;1m ".gitattributes:.gitattributes"�[0m
�[36;1m "CODEOWNERS:CODEOWNERS,.github/CODEOWNERS,docs/CODEOWNERS"�[0m
�[36;1m "GOVERNANCE:GOVERNANCE.adoc,GOVERNANCE.md"�[0m
�[36;1m "ARCHITECTURE:ARCHITECTURE.adoc,ARCHITECTURE.md,docs/architecture/README.adoc,TOPOLOGY.adoc,TOPOLOGY.md"�[0m
�[36;1m "MAINTAINERS:MAINTAINERS,MAINTAINERS.adoc,MAINTAINERS.md"�[0m
�[36;1m "toolchain:.tool-versions,mise.toml"�[0m
�[36;1m)�[0m
�[36;1m�[0m
�[36;1mdeclare -A found=()�[0m
�[36;1...

GitHub Actions: Dogfood Gate / 1_Groove manifest check.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
�[36;1m# Check for static or dynamic Groove endpoints�[0m
�[36;1mHAS_MANIFEST="false"�[0m
�[36;1mHAS_GROOVE_CODE="false"�[0m
�[36;1m�[0m
�[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
�[36;1m HAS_MANIFEST="true"�[0m
�[36;1m # Validate the manifest JSON�[0m
�[36;1m if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
�[36;1m echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Dogfood Gate / Groove manifest check: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
�[36;1m# Check for static or dynamic Groove endpoints�[0m
�[36;1mHAS_MANIFEST="false"�[0m
�[36;1mHAS_GROOVE_CODE="false"�[0m
�[36;1m�[0m
�[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
�[36;1m HAS_MANIFEST="true"�[0m
�[36;1m # Validate the manifest JSON�[0m
�[36;1m if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
�[36;1m echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Dogfood Gate / 2_Validate A2ML manifests.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]A2ML Manifest Validation
Scanning . for .a2ml files...
Found 131 .a2ml file(s)
Validating: ./.machine_readable/6a2/AGENTIC.a2ml
Validating: ./.machine_readable/6a2/ECOSYSTEM.a2ml
Validating: ./.machine_readable/6a2/META.a2ml
Validating: ./.machine_readable/6a2/NEUROSYM.a2ml
Validating: ./.machine_readable/6a2/PLAYBOOK.a2ml
Validating: ./.machine_readable/6a2/STATE.a2ml
Validating: ./.machine_readable/CLADE.a2ml
Validating: ./.machine_readable/agent_instructions/coverage.a2ml
Validating: ./.machine_readable/agent_instructions/debt.a2ml
Validating: ./.machine_readable/agent_instructions/methodology.a2ml
Validating: ./.machine_readable/anchors/ANCHOR.a2ml
##[warning]Missing SPDX-License-Identifier in first 10 lines
Validating: ./.machine_readable/contractiles/bust/Bustfile.a2ml
Validating: ./.machine_readable/contractiles/dust/Dustfile.a2ml
Validating: ./.machine_readable/contractiles/trust/Trustfile.a2ml
Validating: ./.machine_readable/integrations/feedback-o-tron.a2ml
Validating: ./.machine_readable/integrations/proven.a2ml
Validating: ./.machine_readable/integrations/verisimdb.a2ml
Validating: ./.machine_readable/integrations/vexometer.a2ml
Validating: ./.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml
##[warning]Missing SPDX-License-Identifier in first 10 lines
Validating: ./0-AI-MANIFEST.a2ml
Validating: ./asdf-acceleration-middleware/.machine_readable/6a2/AGENTIC.a2ml
Validating: ./asdf-acceleration-middleware/.machine_readable/6a2/ECOSYSTEM.a2ml
Validating: ./asdf-acceleration-middleware/.machine_readable/6a2/META.a2ml
Validating: ./asdf-acceleration-middleware/.machine_readable/6a2/NEUROSYM.a2ml
Validating: ./asdf-acceleration-middleware/.machine_readable/6a2/PLAYBOOK.a2ml
Validating: ./asdf-acceleration-middleware/.machine_readable/6a2/STATE.a2ml
Validating: ./asdf-augmenters/.machine_readable/6a2/AGENTIC.a2ml
Validating: ./asdf-augmenters/.machine_readable...

GitHub Actions: Dogfood Gate / Validate A2ML manifests: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]A2ML Manifest Validation
Scanning . for .a2ml files...
Found 131 .a2ml file(s)
Validating: ./.machine_readable/6a2/AGENTIC.a2ml
Validating: ./.machine_readable/6a2/ECOSYSTEM.a2ml
Validating: ./.machine_readable/6a2/META.a2ml
Validating: ./.machine_readable/6a2/NEUROSYM.a2ml
Validating: ./.machine_readable/6a2/PLAYBOOK.a2ml
Validating: ./.machine_readable/6a2/STATE.a2ml
Validating: ./.machine_readable/CLADE.a2ml
Validating: ./.machine_readable/agent_instructions/coverage.a2ml
Validating: ./.machine_readable/agent_instructions/debt.a2ml
Validating: ./.machine_readable/agent_instructions/methodology.a2ml
Validating: ./.machine_readable/anchors/ANCHOR.a2ml
##[warning]Missing SPDX-License-Identifier in first 10 lines
Validating: ./.machine_readable/contractiles/bust/Bustfile.a2ml
Validating: ./.machine_readable/contractiles/dust/Dustfile.a2ml
Validating: ./.machine_readable/contractiles/trust/Trustfile.a2ml
Validating: ./.machine_readable/integrations/feedback-o-tron.a2ml
Validating: ./.machine_readable/integrations/proven.a2ml
Validating: ./.machine_readable/integrations/verisimdb.a2ml
Validating: ./.machine_readable/integrations/vexometer.a2ml
Validating: ./.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml
##[warning]Missing SPDX-License-Identifier in first 10 lines
Validating: ./0-AI-MANIFEST.a2ml
Validating: ./asdf-acceleration-middleware/.machine_readable/6a2/AGENTIC.a2ml
Validating: ./asdf-acceleration-middleware/.machine_readable/6a2/ECOSYSTEM.a2ml
Validating: ./asdf-acceleration-middleware/.machine_readable/6a2/META.a2ml
Validating: ./asdf-acceleration-middleware/.machine_readable/6a2/NEUROSYM.a2ml
Validating: ./asdf-acceleration-middleware/.machine_readable/6a2/PLAYBOOK.a2ml
Validating: ./asdf-acceleration-middleware/.machine_readable/6a2/STATE.a2ml
Validating: ./asdf-augmenters/.machine_readable/6a2/AGENTIC.a2ml
Validating: ./asdf-augmenters/.machine_readable...

GitHub Actions: Dogfood Gate / 4_Empty-linter (invisible characters).txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run # Inline invisible character detection (from empty-linter's core patterns).
�[36;1m# Inline invisible character detection (from empty-linter's core patterns).�[0m
�[36;1m# Checks for: zero-width spaces, zero-width joiners, BOM, soft hyphens,�[0m
�[36;1m# non-breaking spaces, null bytes, and other invisible Unicode in source files.�[0m
�[36;1mset +e�[0m
�[36;1mPATTERNS='(*UTF)[\x00-\x08\x0B\x0C\x0E-\x1F\x{a0}\x{ad}\x{200b}-\x{200f}\x{202a}-\x{202f}\x{2060}\x{2066}-\x{2069}\x{feff}]'�[0m
�[36;1mfind "$GITHUB_WORKSPACE" \�[0m
�[36;1m -not -path '*/.git/*' -not -path '*/node_modules/*' \�[0m
�[36;1m -not -path '*/.deno/*' -not -path '*/target/*' \�[0m
�[36;1m -not -path '*/_build/*' -not -path '*/deps/*' \�[0m
�[36;1m -not -path '*/external_corpora/*' -not -path '*/.lake/*' \�[0m
�[36;1m -type f \( -name '*.rs' -o -name '*.ex' -o -name '*.exs' -o -name '*.res' \�[0m
�[36;1m -o -name '*.js' -o -name '*.ts' -o -name '*.json' -o -name '*.toml' \�[0m
�[36;1m -o -name '*.yml' -o -name '*.yaml' -o -name '*.md' -o -name '*.adoc' \�[0m
�[36;1m -o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \�[0m
�[36;1m -o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \�[0m
�[36;1m -exec grep -aPrl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null�[0m
�[36;1mEL_EXIT=$?�[0m
�[36;1mset -e�[0m
�[36;1m�[0m
�[36;1mFINDINGS=$(wc -l < /tmp/empty-lint-results.txt 2>/dev/null || echo 0)�[0m
�[36;1mecho "findings=$FINDINGS" >> "$GITHUB_OUTPUT"�[0m
�[36;1mecho "exit_code=$EL_EXIT" >> "$GITHUB_OUTPUT"�[0m
�[36;1mecho "ready=true" >> "$GITHUB_OUTPUT"�[0m
�[36;1m�[0m
�[36;1m# Blocking subset: C0 controls and NUL only (owner ruling 2026-08-28).�[0m
�[36;1m# Invisible Unicode (NBSP/BOM/zero-width) stays ADVISORY - about 2,100�[0m
�[36;1m# estate files carry it as legitimate typography in prose.�[0m
�[36;1mblocking=0�[0m
�[36;1mwhile IFS= read -r bf; do�[0m
�[36;1m [ -z "$bf" ] && continue�[0m
�[36...

GitHub Actions: Dogfood Gate / Empty-linter (invisible characters): chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run # Inline invisible character detection (from empty-linter's core patterns).
�[36;1m# Inline invisible character detection (from empty-linter's core patterns).�[0m
�[36;1m# Checks for: zero-width spaces, zero-width joiners, BOM, soft hyphens,�[0m
�[36;1m# non-breaking spaces, null bytes, and other invisible Unicode in source files.�[0m
�[36;1mset +e�[0m
�[36;1mPATTERNS='(*UTF)[\x00-\x08\x0B\x0C\x0E-\x1F\x{a0}\x{ad}\x{200b}-\x{200f}\x{202a}-\x{202f}\x{2060}\x{2066}-\x{2069}\x{feff}]'�[0m
�[36;1mfind "$GITHUB_WORKSPACE" \�[0m
�[36;1m -not -path '*/.git/*' -not -path '*/node_modules/*' \�[0m
�[36;1m -not -path '*/.deno/*' -not -path '*/target/*' \�[0m
�[36;1m -not -path '*/_build/*' -not -path '*/deps/*' \�[0m
�[36;1m -not -path '*/external_corpora/*' -not -path '*/.lake/*' \�[0m
�[36;1m -type f \( -name '*.rs' -o -name '*.ex' -o -name '*.exs' -o -name '*.res' \�[0m
�[36;1m -o -name '*.js' -o -name '*.ts' -o -name '*.json' -o -name '*.toml' \�[0m
�[36;1m -o -name '*.yml' -o -name '*.yaml' -o -name '*.md' -o -name '*.adoc' \�[0m
�[36;1m -o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \�[0m
�[36;1m -o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \�[0m
�[36;1m -exec grep -aPrl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null�[0m
�[36;1mEL_EXIT=$?�[0m
�[36;1mset -e�[0m
�[36;1m�[0m
�[36;1mFINDINGS=$(wc -l < /tmp/empty-lint-results.txt 2>/dev/null || echo 0)�[0m
�[36;1mecho "findings=$FINDINGS" >> "$GITHUB_OUTPUT"�[0m
�[36;1mecho "exit_code=$EL_EXIT" >> "$GITHUB_OUTPUT"�[0m
�[36;1mecho "ready=true" >> "$GITHUB_OUTPUT"�[0m
�[36;1m�[0m
�[36;1m# Blocking subset: C0 controls and NUL only (owner ruling 2026-08-28).�[0m
�[36;1m# Invisible Unicode (NBSP/BOM/zero-width) stays ADVISORY - about 2,100�[0m
�[36;1m# estate files carry it as legitimate typography in prose.�[0m
�[36;1mblocking=0�[0m
�[36;1mwhile IFS= read -r bf; do�[0m
�[36;1m [ -z "$bf" ] && continue�[0m
�[36...

GitHub Actions: Governance / 1_governance _ Language _ package anti-pattern policy.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
�[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
�[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
�[36;1m && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
�[36;1m SCRIPT="scripts/check-ts-allowlist.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-check)."�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
�[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
�[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
�[36;1m && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
�[36;1m SCRIPT="scripts/check-ts-allowlist.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-check)."�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"
�[36;1mSCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"�[0m
�[36;1mif [ ! -f "$SCRIPT" ] && [ -f tools/policy/check-language-policy.sh ]; then�[0m
�[36;1m SCRIPT="tools/policy/check-language-policy.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-check)."�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::language-policy gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / 2_governance _ Security policy checks.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run FAILED=false
�[36;1mFAILED=false�[0m
�[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
�[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
�[36;1m echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
�[36;1m echo "$WEAK_CRYPTO"�[0m
�[36;1mfi�[0m
�[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
�[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
�[36;1m echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
�[36;1m echo "$HTTP_URLS"�[0m
�[36;1mfi�[0m
�[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
�[36;1mif [ -n "$SECRETS" ]; then�[0m
�[36;1m echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

GitHub Actions: Governance / governance _ Security policy checks: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run FAILED=false
�[36;1mFAILED=false�[0m
�[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
�[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
�[36;1m echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
�[36;1m echo "$WEAK_CRYPTO"�[0m
�[36;1mfi�[0m
�[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
�[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
�[36;1m echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
�[36;1m echo "$HTTP_URLS"�[0m
�[36;1mfi�[0m
�[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
�[36;1mif [ -n "$SECRETS" ]; then�[0m
�[36;1m echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

GitHub Actions: Governance / governance _ Security policy checks: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run set -uo pipefail
�[36;1mset -uo pipefail�[0m
�[36;1mDIR=.github/canonical-references�[0m
�[36;1mif [ ! -d "$DIR" ]; then�[0m
�[36;1m echo "ℹ️ [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
�[36;1m echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
�[36;1m exit 2�[0m
�[36;1mfi�[0m
�[36;1mpython3 - <<'PY'�[0m
�[36;1mimport os, sys, glob, subprocess�[0m
�[36;1mtry:�[0m
�[36;1m import yaml�[0m
�[36;1mexcept ImportError:�[0m
�[36;1m sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
�[36;1m�[0m
�[36;1mdir_ = ".github/canonical-references"�[0m
�[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
�[36;1mif not files:�[0m
�[36;1m print(f"ℹ️ [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
�[36;1m sys.exit(0)�[0m
�[36;1m�[0m
�[36;1mtotal = 0�[0m
�[36;1mfor rf in files:�[0m
�[36;1m with open(rf, encoding="utf-8") as fh:�[0m
�[36;1m cfg = yaml.safe_load(fh)�[0m
�[36;1m if not isinstance(cfg, dict):�[0m
�[36;1m print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
�[36;1m rid = cfg.get("id", os.path.basename(rf))�[0m
�[36;1m desc = cfg.get("description", "")�[0m
�[36;1m pats = cfg.get("patterns") or []�[0m
�[36;1m canon = cfg.get("canonical_pointer", "")�[0m
�[36;1m scope = (cfg.get("scope") or {})�[0m
�[36;1m includes = scope.get("include") or []�[0m
�[36;1m if not pats or not includes:�[0m
�[36;1m print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
�[36;1m total += 1; continue�[0m
�[36;1m # exclude self-references�[0m
�[36;1m skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
�[36;1m if canon: skip.add(canon)�[0m
�[36;1m rule_hits = 0�[0m
�[36;1m for f_ in includes:�[0m
�[36;1m if f_ in skip or not os...

GitHub Actions: Governance / 4_governance _ Actions lockfile verify.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run set -uo pipefail
�[36;1mset -uo pipefail�[0m
�[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
�[36;1m SRC=scripts�[0m
�[36;1m echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
�[36;1melse�[0m
�[36;1m SRC=.standards-lock/scripts�[0m
�[36;1mfi�[0m
�[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
�[36;1m if [ ! -f "$SRC/$f" ]; then�[0m
�[36;1m echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at job.workflow_sha failed?)"�[0m

GitHub Actions: Governance / governance _ Actions lockfile verify: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run set -uo pipefail
�[36;1mset -uo pipefail�[0m
�[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
�[36;1m SRC=scripts�[0m
�[36;1m echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
�[36;1melse�[0m
�[36;1m SRC=.standards-lock/scripts�[0m
�[36;1mfi�[0m
�[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
�[36;1m if [ ! -f "$SRC/$f" ]; then�[0m
�[36;1m echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at job.workflow_sha failed?)"�[0m

GitHub Actions: Governance / 6_governance _ Workflow security linter.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
�[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
�[36;1m SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-lint)."�[0m
�[36;1melse�[0m
�[36;1m SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

GitHub Actions: Governance / governance _ Workflow security linter: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
�[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
�[36;1m SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-lint)."�[0m
�[36;1melse�[0m
�[36;1m SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

GitHub Actions: Governance / governance _ Workflow security linter: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
�[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
�[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
�[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
�[36;1m# duplicate and reports success — so the file "parses" and every�[0m
�[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
�[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
�[36;1m# successful runs in its entire lifetime.�[0m
�[36;1mset -euo pipefail�[0m
�[36;1m# Standards exercises its pull-request scripts; every consumer uses�[0m
�[36;1m# the canonical scripts fetched from this workflow's immutable�[0m
�[36;1m# Standards revision.�[0m
�[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
�[36;1m SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-lint)."�[0m
�[36;1melse�[0m
�[36;1m SCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / governance _ Workflow security linter: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run failed=0
�[36;1mfailed=0�[0m
�[36;1mfor file in .github/workflows/*.yml .github/workflows/*.yaml; do�[0m
�[36;1m [ -f "$file" ] || continue�[0m
�[36;1m # ⚠ SCAN THE HEADER BLOCK, NOT LINE 1. REUSE places the identifier�[0m
�[36;1m # anywhere in a file's leading comment block, and `gh actions-lock`�[0m
�[36;1m # INSERTS `# This workflow is managed by gh actions-lock.` at line 1�[0m
�[36;1m # whenever it mints a lockfile — so a line-1 test fights the estate's�[0m
�[36;1m # own tool and re-fails every time a lockfile is refreshed.�[0m
�[36;1m #�[0m
�[36;1m # Measured 2026-08-07: it reported 27 hypatia workflows and 13 more�[0m
�[36;1m # elsewhere as missing a header they all had, and "fixing" that by�[0m
�[36;1m # prepending a default MIS-LICENSED three files (PMPL-1.0-or-later�[0m
�[36;1m # shadowed by MPL-2.0) before it was caught.�[0m
�[36;1m #�[0m
�[36;1m # The leading run of comment lines is read, tolerating a YAML�[0m
�[36;1m # document marker. A licence declared there is declared.�[0m
�[36;1m if ! awk '/^---[[:space:]]*$/ { next } /^`#/` { print; next } { exit }' "$file" \�[0m
�[36;1m | grep -q "^# SPDX-License-Identifier:"; then�[0m
�[36;1m echo "ERROR: $file has no SPDX-License-Identifier in its header comment block"; failed=1�[0m
�[36;1m fi�[0m
�[36;1m if ! grep -q "^permissions:" "$file"; then�[0m
�[36;1m echo "ERROR: $file missing top-level 'permissions:' declaration"; failed=1�[0m
�[36;1m fi�[0m
�[36;1mdone�[0m
�[36;1m[ $failed -eq 1 ] && { echo "Add SPDX header + permissions:"; exit 1; }�[0m
�[36;1mecho "All workflows have SPDX headers + permissions"�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
ERROR: .github/workflows/main-estate-audit.yml missing top-level 'permissions:' declaration
Add SPDX header + permissions:
##[error]Process completed with exit code 1.

GitHub Actions: Governance / 9_governance _ Code quality + docs.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
with:
github-***REDACTED_SECRET_ASSIGNMENT***
version: latest
##[endgroup]
Find 'latest' release
##[error]Error: The binary 'ec-linux-amd64*' not found

GitHub Actions: Governance / governance _ Code quality + docs: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
with:
github-***REDACTED_SECRET_ASSIGNMENT***
version: latest
##[endgroup]
Find 'latest' release
##[error]Error: The binary 'ec-linux-amd64*' not found

GitHub Actions: Governance / 13_governance _ Well-Known (RFC 9116 + RSR).txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SECTXT=""
�[36;1mSECTXT=""�[0m
�[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
�[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
�[36;1mif [ -z "$SECTXT" ]; then�[0m
�[36;1m echo "::warning::No security.txt found."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SECTXT=""
�[36;1mSECTXT=""�[0m
�[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
�[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
�[36;1mif [ -z "$SECTXT" ]; then�[0m
�[36;1m echo "::warning::No security.txt found."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
�[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
�[36;1mif [ -n "$MIXED" ]; then�[0m
�[36;1m echo "::error::Mixed content (HTTP in HTML)"�[0m

🔇 Additional comments (1)

.github/workflows/governance.yml (1)
36-36: LGTM!

📝 Summary

Summary by CodeRabbit

Chores
- Updated the governance workflow to use a newer pinned revision, ensuring governance checks run with the latest shared configuration.

Walkthrough

The governance workflow now references a newer pinned commit for the shared reusable governance workflow.

Changes

Governance workflow

Layer / File(s)	Summary
Update governance workflow pin `.github/workflows/governance.yml`	The `governance` job now uses commit `fad242d35291de1898242d6737ba02b74a59a2f2` instead of `84355587cb2a1f86e6882de83514a32db2646e7a`.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk:⚪ Minimal · up to ee3e7

The governance workflow now uses the updated pinned reusable workflow revision. No current merge-blocking risk remains.

Suggested reviewers:metadatastician

Poem

A rabbit checks the workflow line
A newer pin now fits just fine
The governance path stays clear
One small update lands here
Hop, hop, the checks draw near

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: updating the pinned governance reusable workflow revision.
Description check	✅ Passed	The description directly explains the workflow failures, the corrective revision, and the successful witness run. It is clearly related to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitaiBot approved these changes

View reviewed changes

hyperpolymath merged commit fc062d6 into main

29 of 32 checks passed

hyperpolymath deleted the chore/bump-governance-pin-to-standards-main branch

September 8, 2026 06:49

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment