From 5d2f76858776df98d83b3002053bf3d32b9410e5 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 7 Sep 2026 19:43:44 +0100 Subject: [PATCH 1/2] chore(ci): bump governance-reusable pin to standards main The pinned revision carries bugs that make Governance red on every consumer: the Workflow security linter runs update-actions-lock.sh from the CALLER's checkout where it does not exist (exit 127), and Allowlist Preflight runs check-actions-policy.sh with an empty GH_TOKEN (exit 3). Both are fixed on standards main. Witnessed green on hyperpolymath/blocky-writer at this exact SHA: governance run completed/success, 15/15 jobs. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/governance.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index ef57260..fe69528 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -31,4 +31,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@fad242d35291de1898242d6737ba02b74a59a2f2 From e3050a955ef75f7c8ca06b8c1aeb206241e38edf Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 8 Sep 2026 07:40:25 +0100 Subject: [PATCH 2/2] fix(ci): grant actions: read so the bumped reusable can start The governance-reusable at standards HEAD requests `actions: read`. A caller granting only `contents: read` fails at startup after the pin bump, reporting no check at all. This grants the missing scope in the same PR as the bump. Co-Authored-By: Claude Opus 5 --- .github/workflows/governance.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index fe69528..026822a 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -27,6 +27,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: