fix(ci): pin standards reusables to default-branch HEAD

[hyperpolymath]

Re-points this repo's hyperpolymath/standards reusable-workflow pins at the standards default-branch HEAD, 257869d3061d5a8ed1529bf34225d90a2416d51a.

This PR makes two changes, not one. It also widens the top-level permissions: block of 2 workflow file(s). A caller that grants a reusable less than the reusable's own permissions: request is rejected at workflow startup — the exact failure this PR exists to cure — so bumping the pin without this would move the repo from one silent disappearance to another. The scopes added are not hardcoded: each reusable's request is read from 257869d3at sweep time and only the genuinely missing scopes are added, at the indent the file already uses. Only read-level scopes are added this way; anything needing write is held for review instead.

Why this is not a routine version bump.uses: org/repo/.github/workflows/x.yml@<ref> is resolved at workflow startup, so a bad ref is not a failing job — it is no job at all. This campaign repairs three kinds of drift and does not assume which one this repo had:

• an unreachable sha kills the run before any job is created, so GitHub reports no check at all rather than a failing one: the gate does not go red, it disappears, and gh pr checks simply lists fewer rows. A repo in this state looks greener than one with working gates;
• a floating ref such as @main runs, but unpinned — the supply-chain property the estate pins for is absent;
• a stale but reachable sha runs the reusable as it was, silently reintroducing every bug fixed since it.

The refs this repo was actually pinned to, before this PR: 092dedada188f56c5915f74a5fd40aac093742c3.

Expect this PR to surface failures that main does not show. Those failures are revealed, not introduced — they are the gates resuming work after being silently absent. The honest comparison is the set of check names emitted here versus on main, not pass/fail counts. On the canary (hyperpolymath/empty-linter#79) the governance suite was absent on main and emitted 25 checks once repaired.

The target is default-branch HEAD resolved at sweep time, never a sha copied from a plan: a reachable but non-HEAD sha silently reintroduces every bug fixed since it.

Engine: .git-private-farm/scripts/smtp-notify-sweep.sh --campaign campaigns/pin-repair.sh. Verification for this repo: files=5 pins=5 perms=2 permlines=2 from=092dedada188f56c5915f74a5fd40aac093742c3 target=257869d3 sig=G 7e0348c canon=393d9db5fa79 base=main

🤖 Generated with Claude Code

https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 741e83d3-9767-4748-b95e-ed937b1ea830

📥 Commits

Reviewing files that changed from the base of the PR and between 7e0348c and 70db461.

📒 Files selected for processing (1)

• .github/workflows/governance.yml

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated automated governance, security scanning, mirroring and scorecard checks.
  • Refreshed the workflow configurations supporting repository maintenance and compliance checks.
  • Granted the read access required for selected automated workflow operations.
  • These updates keep repository checks aligned with the latest automation standards without changing end-user functionality.

Walkthrough

The pull request updates pinned reusable workflow references in five GitHub Actions workflows. It also adds actions: read permission to the Hypatia scan and mirror workflows.

Changes

Workflow maintenance

Layer / File(s)	Summary
Workflow pins and permissions .github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/mirror.yml, .github/workflows/scorecard.yml, .github/workflows/secret-scanner.yml	The reusable workflow references now use commit 257869d3061d5a8ed1529bf34225d90a2416d51a. The Hypatia scan and mirror workflows add actions: read permission.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk:⚪ Minimal · up to 7e034

This updates reusable GitHub Actions workflow pins and grants the two affected workflows the required read-only Actions permission. No concrete merge-blocking risk remains.

Suggested reviewers:metadatastician

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI change: it pins the standards reusable workflows to the default-branch HEAD.
Description check	✅ Passed	The description is directly related to the changes. It explains the reusable-workflow pin updates, permission changes, rationale, and verification details.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks each workflow pin
New hashes hop where old ones have been
Actions read with careful grace
Five paths now share a steadier pace
The burrow builds, the checks begin}

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud