chore(ci): bump governance-reusable pin to standards main

[hyperpolymath]

Pinned revision 84355587 of governance-reusable.yml carries two bugs that make Governance red on every consumer:

1. Workflow security linter runs bash scripts/update-actions-lock.sh --verify-local in the caller's checkout, where the script does not exist — exit 127.
2. Allowlist Preflight runs check-actions-policy.sh with an empty GH_TOKEN — gh refuses, exit 3.

Both are cured on standards main (a3308ea8d0cc513727c8ad149b1132317a886c98): the script is copied from the standards checkout into $RUNNER_TEMP, and the policy step is skipped when no credential is supplied.

Pilot for an estate-wide pin bump. Pass criterion is the set difference against this repo's own baseline (run 33820393808: Allowlist Preflight + Workflow security linter red) — both gone, no new red job.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: e8305368-252f-4fe4-9856-745c8865950b

📥 Commits

Reviewing files that changed from the base of the PR and between 565d1e3 and 0d0f7aa.

📒 Files selected for processing (1)

• .github/workflows/governance.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⚠️ CI failures not shown inline (4)

GitHub Actions: CI / 0_extension-build.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run if [[ -z $toolchain ]]; then
�[36;1mif [[ -z $toolchain ]]; then�[0m
�[36;1m # GitHub does not enforce `required: true` inputs itself. https://github.com/actions/runner/issues/1070�[0m
�[36;1m echo "'toolchain' is a required input" >&2�[0m
�[36;1m exit 1�[0m
�[36;1melif [[ $toolchain =~ ^stable' '[0-9]+' '(year|month|week|day)s?' 'ago$ ]]; then�[0m
�[36;1m if [[ Linux == macOS ]]; then�[0m
�[36;1m echo "toolchain=1.$((($(date -v-$(sed 's/stable \([0-9]*\) \(.\).*/\1\2/' <<< $toolchain) +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
�[36;1m else�[0m
�[36;1m echo "toolchain=1.$((($(date --date "${toolchain#stable }" +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
�[36;1m fi�[0m
�[36;1melif [[ $toolchain =~ ^stable' 'minus' '[0-9]+' 'releases?$ ]]; then�[0m
�[36;1m echo "toolchain=1.$((($(date +%s)/60/60/24-16569)/7/6-${toolchain//[^0-9]/}))" >> $GITHUB_OUTPUT�[0m
�[36;1melif [[ $toolchain =~ ^1\.[0-9]+$ ]]; then�[0m
�[36;1m echo "toolchain=1.$((i=${toolchain#1.}, c=($(date +%s)/60/60/24-16569)/7/6, i+9*i*(10*i<=c)+90*i*(100*i<=c)))" >> $GITHUB_OUTPUT�[0m
�[36;1melse�[0m
�[36;1m echo "toolchain=$toolchain" >> $GITHUB_OUTPUT�[0m
�[36;1mfi�[0m
shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
env:
toolchain:
##[endgroup]
'toolchain' is a required input
##[error]Process completed with exit code 1.

---

GitHub Actions: CI / extension-build: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run if [[ -z $toolchain ]]; then
�[36;1mif [[ -z $toolchain ]]; then�[0m
�[36;1m # GitHub does not enforce `required: true` inputs itself. https://github.com/actions/runner/issues/1070�[0m
�[36;1m echo "'toolchain' is a required input" >&2�[0m
�[36;1m exit 1�[0m
�[36;1melif [[ $toolchain =~ ^stable' '[0-9]+' '(year|month|week|day)s?' 'ago$ ]]; then�[0m
�[36;1m if [[ Linux == macOS ]]; then�[0m
�[36;1m echo "toolchain=1.$((($(date -v-$(sed 's/stable \([0-9]*\) \(.\).*/\1\2/' <<< $toolchain) +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
�[36;1m else�[0m
�[36;1m echo "toolchain=1.$((($(date --date "${toolchain#stable }" +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
�[36;1m fi�[0m
�[36;1melif [[ $toolchain =~ ^stable' 'minus' '[0-9]+' 'releases?$ ]]; then�[0m
�[36;1m echo "toolchain=1.$((($(date +%s)/60/60/24-16569)/7/6-${toolchain//[^0-9]/}))" >> $GITHUB_OUTPUT�[0m
�[36;1melif [[ $toolchain =~ ^1\.[0-9]+$ ]]; then�[0m
�[36;1m echo "toolchain=1.$((i=${toolchain#1.}, c=($(date +%s)/60/60/24-16569)/7/6, i+9*i*(10*i<=c)+90*i*(100*i<=c)))" >> $GITHUB_OUTPUT�[0m
�[36;1melse�[0m
�[36;1m echo "toolchain=$toolchain" >> $GITHUB_OUTPUT�[0m
�[36;1mfi�[0m
shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
env:
toolchain:
##[endgroup]
'toolchain' is a required input
##[error]Process completed with exit code 1.

---

GitHub Actions: CI / 1_core-fill-tests.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run if [[ -z $toolchain ]]; then
�[36;1mif [[ -z $toolchain ]]; then�[0m
�[36;1m # GitHub does not enforce `required: true` inputs itself. https://github.com/actions/runner/issues/1070�[0m
�[36;1m echo "'toolchain' is a required input" >&2�[0m
�[36;1m exit 1�[0m
�[36;1melif [[ $toolchain =~ ^stable' '[0-9]+' '(year|month|week|day)s?' 'ago$ ]]; then�[0m
�[36;1m if [[ Linux == macOS ]]; then�[0m
�[36;1m echo "toolchain=1.$((($(date -v-$(sed 's/stable \([0-9]*\) \(.\).*/\1\2/' <<< $toolchain) +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
�[36;1m else�[0m
�[36;1m echo "toolchain=1.$((($(date --date "${toolchain#stable }" +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
�[36;1m fi�[0m
�[36;1melif [[ $toolchain =~ ^stable' 'minus' '[0-9]+' 'releases?$ ]]; then�[0m
�[36;1m echo "toolchain=1.$((($(date +%s)/60/60/24-16569)/7/6-${toolchain//[^0-9]/}))" >> $GITHUB_OUTPUT�[0m
�[36;1melif [[ $toolchain =~ ^1\.[0-9]+$ ]]; then�[0m
�[36;1m echo "toolchain=1.$((i=${toolchain#1.}, c=($(date +%s)/60/60/24-16569)/7/6, i+9*i*(10*i<=c)+90*i*(100*i<=c)))" >> $GITHUB_OUTPUT�[0m
�[36;1melse�[0m
�[36;1m echo "toolchain=$toolchain" >> $GITHUB_OUTPUT�[0m
�[36;1mfi�[0m
shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
env:
toolchain:
##[endgroup]
'toolchain' is a required input
##[error]Process completed with exit code 1.

---

GitHub Actions: CI / core-fill-tests: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run if [[ -z $toolchain ]]; then
�[36;1mif [[ -z $toolchain ]]; then�[0m
�[36;1m # GitHub does not enforce `required: true` inputs itself. https://github.com/actions/runner/issues/1070�[0m
�[36;1m echo "'toolchain' is a required input" >&2�[0m
�[36;1m exit 1�[0m
�[36;1melif [[ $toolchain =~ ^stable' '[0-9]+' '(year|month|week|day)s?' 'ago$ ]]; then�[0m
�[36;1m if [[ Linux == macOS ]]; then�[0m
�[36;1m echo "toolchain=1.$((($(date -v-$(sed 's/stable \([0-9]*\) \(.\).*/\1\2/' <<< $toolchain) +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
�[36;1m else�[0m
�[36;1m echo "toolchain=1.$((($(date --date "${toolchain#stable }" +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
�[36;1m fi�[0m
�[36;1melif [[ $toolchain =~ ^stable' 'minus' '[0-9]+' 'releases?$ ]]; then�[0m
�[36;1m echo "toolchain=1.$((($(date +%s)/60/60/24-16569)/7/6-${toolchain//[^0-9]/}))" >> $GITHUB_OUTPUT�[0m
�[36;1melif [[ $toolchain =~ ^1\.[0-9]+$ ]]; then�[0m
�[36;1m echo "toolchain=1.$((i=${toolchain#1.}, c=($(date +%s)/60/60/24-16569)/7/6, i+9*i*(10*i<=c)+90*i*(100*i<=c)))" >> $GITHUB_OUTPUT�[0m
�[36;1melse�[0m
�[36;1m echo "toolchain=$toolchain" >> $GITHUB_OUTPUT�[0m
�[36;1mfi�[0m
shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
env:
toolchain:
##[endgroup]
'toolchain' is a required input
##[error]Process completed with exit code 1.

🔇 Additional comments (1)

.github/workflows/governance.yml (1)

38-38: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated governance automation to reference a newer shared governance configuration.
  • Governance checks will continue to run using the updated shared standards.
  • No changes to product functionality or the end-user experience.

Walkthrough

The GitHub Actions governance job now references a newer commit of the shared reusable governance workflow.

Changes

Governance workflow

Layer / File(s)	Summary
Update reusable workflow reference .github/workflows/governance.yml	The governance job now references commit fad242d35291de1898242d6737ba02b74a59a2f2 of the shared governance workflow.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk:⚪ Minimal · up to 0d0f7

The governance workflow now uses an updated pinned shared workflow revision intended to fix baseline governance failures. No current merge-blocking risk is identified.

Poem

A rabbit checks the workflow line
A newer governance commit will shine
The job points to standards anew
With one small change in view
Hop, hop, the update is through

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the governance pin update, which is the main change in the pull request.
Description check	✅ Passed	The description accurately explains the governance workflow failures, the pin update, and the expected validation outcome.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 Hypatia Security Scan

Findings: 58 issues detected

Severity	Count
🔴 Critical	6
🟠 High	28
🟡 Medium	24

⚠️Action Required: Critical security issues found!

View findings

[
{
"reason": "Issue in scorecard.yml",
"type": "missing_workflow",
"file": "scorecard.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
"type": "codeql_language_matrix_mismatch",
"file": "codeql.yml",
"action": "switch_codeql_matrix_to_actions",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in boj-build.yml",
"type": "missing_timeout_minutes",
"file": "boj-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in ci.yml",
"type": "missing_timeout_minutes",
"file": "ci.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in ci.yml",
"type": "missing_timeout_minutes",
"file": "ci.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in codeql.yml",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in hypatia-scan.yml",
"type": "missing_timeout_minutes",
"file": "hypatia-scan.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in instant-sync.yml",
"type": "missing_timeout_minutes",
"file": "instant-sync.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
}
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[github-actions]

🔍 Hypatia Security Scan

Findings: 59 issues detected

Severity	Count
🔴 Critical	6
🟠 High	29
🟡 Medium	24

⚠️Action Required: Critical security issues found!

View findings

[
{
"reason": "Issue in scorecard.yml",
"type": "missing_workflow",
"file": "scorecard.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
"type": "codeql_language_matrix_mismatch",
"file": "codeql.yml",
"action": "switch_codeql_matrix_to_actions",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in boj-build.yml",
"type": "missing_timeout_minutes",
"file": "boj-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in ci.yml",
"type": "missing_timeout_minutes",
"file": "ci.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in ci.yml",
"type": "missing_timeout_minutes",
"file": "ci.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in codeql.yml",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in hypatia-scan.yml",
"type": "missing_timeout_minutes",
"file": "hypatia-scan.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in instant-sync.yml",
"type": "missing_timeout_minutes",
"file": "instant-sync.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
}
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence