chore(ci): bump governance-reusable pin to standards main - #56

Merged

hyperpolymath merged 2 commits into

mainfrom

chore/bump-governance-pin-to-standards-main

Sep 8, 2026

hyperpolymath commented Sep 7, 2026

Owner

Pinned revision 7fdc2705 of governance-reusable.yml carries two bugs that make Governance red on every consumer:

Workflow security linter runs bash scripts/update-actions-lock.sh --verify-local in the caller's checkout, where the script does not exist — exit 127.
Allowlist Preflight runs check-actions-policy.sh with an empty GH_TOKEN — gh refuses, exit 3.

Both are cured on standards main (fad242d35291de1898242d6737ba02b74a59a2f2): the verifier is copied into \$RUNNER_TEMP, and the policy step is skipped when no credential is supplied.

Witness: verified green on hyperpolymath/blocky-writer#55 at this exact SHA — governance run completed/success, 15/15 jobs, including the two jobs that were red on that repo's default branch.

Judge this PR by the set difference against your own default branch (which governance jobs are newly red), not by overall check colour — unrelated build failures may pre-date it.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

chore(ci): bump governance-reusable pin to standards main

aa50060

The pinned revision carries bugs that make Governance red on every
consumer: the Workflow security linter runs update-actions-lock.sh from
the CALLER's checkout where it does not exist (exit 127), and Allowlist
Preflight runs check-actions-policy.sh with an empty GH_TOKEN (exit 3).
Both are fixed on standards main. Witnessed green on hyperpolymath/blocky-writer
at this exact SHA: governance run completed/success, 15/15 jobs.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

coderabbitaiBot commented Sep 7, 2026•
edited
Loading

Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 48394c27-7599-46cd-9b45-a5b4fc9a00de

📥 Commits

Reviewing files that changed from the base of the PR and between aa50060 and 87a8cb6.

📒 Files selected for processing (1)

.github/workflows/governance.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

GitHub Check: analyze (rust, none)

⚠️ CI failures not shown inline (20)

GitHub Actions: CI / 1_container.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run docker build -f Containerfile.alpine-fallback -t cloud-sync-tuner:test .
�[36;1mdocker build -f Containerfile.alpine-fallback -t cloud-sync-tuner:test .�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
`#0` building with "default" instance using docker driver
`#1` [internal] load build definition from Containerfile.alpine-fallback
`#1` transferring dockerfile: 1.31kB done
`#1` DONE 0.0s
`#2` [auth] library/alpine:pull token for registry-1.docker.io
`#2` DONE 0.0s
`#3` [internal] load metadata for cgr.dev/chainguard/wolfi-base:latest
`#3` ...
`#4` [internal] load metadata for docker.io/library/alpine:edge
`#4` DONE 0.4s
`#3` [internal] load metadata for cgr.dev/chainguard/wolfi-base:latest
`#3` DONE 0.5s
`#5` [internal] load .dockerignore
`#5` transferring context: 2B done
`#5` DONE 0.0s
`#6` [stage-1 1/6] FROM cgr.dev/chainguard/wolfi-base:latest@sha256:***REDACTED_HIGH_ENTROPY_STRING***
`#6` resolve cgr.dev/chainguard/wolfi-base:latest@sha256:***REDACTED_HIGH_ENTROPY_STRING*** done
`#6` ...
`#7` [internal] load build context
`#7` transferring context: 396.81kB 0.0s done
`#7` DONE 0.0s
`#6` [stage-1 1/6] FROM cgr.dev/chainguard/wolfi-base:latest@sha256:***REDACTED_HIGH_ENTROPY_STRING***
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 0B / 425.35kB 0.1s
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 1.14kB / 1.14kB done
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 2.50kB / 2.50kB done
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 0B / 3.36MB 0.1s
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 0B / 2.94MB 0.1s
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 2.86kB / 2.86kB done
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 425.35kB / 425.35kB 0.2s done
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 3.15MB / 3.36MB 0.2s
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 2.94MB / 2.94MB 0.2s done
`#6` extracting sha256:***REDACTED_HIGH_ENTROPY_STRING*** 0.0s done
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 0B / 97.91kB 0.2s
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 0B / 178.94kB 0.2...

GitHub Actions: CI / container: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run docker build -f Containerfile.alpine-fallback -t cloud-sync-tuner:test .
�[36;1mdocker build -f Containerfile.alpine-fallback -t cloud-sync-tuner:test .�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
`#0` building with "default" instance using docker driver
`#1` [internal] load build definition from Containerfile.alpine-fallback
`#1` transferring dockerfile: 1.31kB done
`#1` DONE 0.0s
`#2` [auth] library/alpine:pull token for registry-1.docker.io
`#2` DONE 0.0s
`#3` [internal] load metadata for cgr.dev/chainguard/wolfi-base:latest
`#3` ...
`#4` [internal] load metadata for docker.io/library/alpine:edge
`#4` DONE 0.4s
`#3` [internal] load metadata for cgr.dev/chainguard/wolfi-base:latest
`#3` DONE 0.5s
`#5` [internal] load .dockerignore
`#5` transferring context: 2B done
`#5` DONE 0.0s
`#6` [stage-1 1/6] FROM cgr.dev/chainguard/wolfi-base:latest@sha256:***REDACTED_HIGH_ENTROPY_STRING***
`#6` resolve cgr.dev/chainguard/wolfi-base:latest@sha256:***REDACTED_HIGH_ENTROPY_STRING*** done
`#6` ...
`#7` [internal] load build context
`#7` transferring context: 396.81kB 0.0s done
`#7` DONE 0.0s
`#6` [stage-1 1/6] FROM cgr.dev/chainguard/wolfi-base:latest@sha256:***REDACTED_HIGH_ENTROPY_STRING***
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 0B / 425.35kB 0.1s
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 1.14kB / 1.14kB done
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 2.50kB / 2.50kB done
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 0B / 3.36MB 0.1s
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 0B / 2.94MB 0.1s
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 2.86kB / 2.86kB done
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 425.35kB / 425.35kB 0.2s done
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 3.15MB / 3.36MB 0.2s
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 2.94MB / 2.94MB 0.2s done
`#6` extracting sha256:***REDACTED_HIGH_ENTROPY_STRING*** 0.0s done
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 0B / 97.91kB 0.2s
`#6` sha256:***REDACTED_HIGH_ENTROPY_STRING*** 0B / 178.94kB 0.2...

GitHub Actions: Governance / 3_governance _ Security policy checks.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run FAILED=false
�[36;1mFAILED=false�[0m
�[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
�[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
�[36;1m echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
�[36;1m echo "$WEAK_CRYPTO"�[0m
�[36;1mfi�[0m
�[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
�[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
�[36;1m echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
�[36;1m echo "$HTTP_URLS"�[0m
�[36;1mfi�[0m
�[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
�[36;1mif [ -n "$SECRETS" ]; then�[0m
�[36;1m echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

GitHub Actions: Governance / governance _ Security policy checks: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run FAILED=false
�[36;1mFAILED=false�[0m
�[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
�[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
�[36;1m echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
�[36;1m echo "$WEAK_CRYPTO"�[0m
�[36;1mfi�[0m
�[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
�[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
�[36;1m echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
�[36;1m echo "$HTTP_URLS"�[0m
�[36;1mfi�[0m
�[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
�[36;1mif [ -n "$SECRETS" ]; then�[0m
�[36;1m echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

GitHub Actions: Governance / governance _ Security policy checks: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run set -uo pipefail
�[36;1mset -uo pipefail�[0m
�[36;1mDIR=.github/canonical-references�[0m
�[36;1mif [ ! -d "$DIR" ]; then�[0m
�[36;1m echo "ℹ️ [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
�[36;1m echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
�[36;1m exit 2�[0m
�[36;1mfi�[0m
�[36;1mpython3 - <<'PY'�[0m
�[36;1mimport os, sys, glob, subprocess�[0m
�[36;1mtry:�[0m
�[36;1m import yaml�[0m
�[36;1mexcept ImportError:�[0m
�[36;1m sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
�[36;1m�[0m
�[36;1mdir_ = ".github/canonical-references"�[0m
�[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
�[36;1mif not files:�[0m
�[36;1m print(f"ℹ️ [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
�[36;1m sys.exit(0)�[0m
�[36;1m�[0m
�[36;1mtotal = 0�[0m
�[36;1mfor rf in files:�[0m
�[36;1m with open(rf, encoding="utf-8") as fh:�[0m
�[36;1m cfg = yaml.safe_load(fh)�[0m
�[36;1m if not isinstance(cfg, dict):�[0m
�[36;1m print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
�[36;1m rid = cfg.get("id", os.path.basename(rf))�[0m
�[36;1m desc = cfg.get("description", "")�[0m
�[36;1m pats = cfg.get("patterns") or []�[0m
�[36;1m canon = cfg.get("canonical_pointer", "")�[0m
�[36;1m scope = (cfg.get("scope") or {})�[0m
�[36;1m includes = scope.get("include") or []�[0m
�[36;1m if not pats or not includes:�[0m
�[36;1m print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
�[36;1m total += 1; continue�[0m
�[36;1m # exclude self-references�[0m
�[36;1m skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
�[36;1m if canon: skip.add(canon)�[0m
�[36;1m rule_hits = 0�[0m
�[36;1m for f_ in includes:�[0m
�[36;1m if f_ in skip or not os...

GitHub Actions: Governance / 5_governance _ Workflow security linter.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
�[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
�[36;1m SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-lint)."�[0m
�[36;1melse�[0m
�[36;1m SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

GitHub Actions: Governance / governance _ Workflow security linter: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
�[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
�[36;1m SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-lint)."�[0m
�[36;1melse�[0m
�[36;1m SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

GitHub Actions: Governance / governance _ Workflow security linter: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
�[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
�[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
�[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
�[36;1m# duplicate and reports success — so the file "parses" and every�[0m
�[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
�[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
�[36;1m# successful runs in its entire lifetime.�[0m
�[36;1mset -euo pipefail�[0m
�[36;1m# Standards exercises its pull-request scripts; every consumer uses�[0m
�[36;1m# the canonical scripts fetched from this workflow's immutable�[0m
�[36;1m# Standards revision.�[0m
�[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
�[36;1m SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-lint)."�[0m
�[36;1melse�[0m
�[36;1m SCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / 6_governance _ Well-Known (RFC 9116 + RSR).txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SECTXT=""
�[36;1mSECTXT=""�[0m
�[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
�[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
�[36;1mif [ -z "$SECTXT" ]; then�[0m
�[36;1m echo "::warning::No security.txt found."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SECTXT=""
�[36;1mSECTXT=""�[0m
�[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
�[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
�[36;1mif [ -z "$SECTXT" ]; then�[0m
�[36;1m echo "::warning::No security.txt found."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
�[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
�[36;1mif [ -n "$MIXED" ]; then�[0m
�[36;1m echo "::error::Mixed content (HTTP in HTML)"�[0m

GitHub Actions: Governance / 8_governance _ Actions lockfile verify.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run set -uo pipefail
�[36;1mset -uo pipefail�[0m
�[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
�[36;1m SRC=scripts�[0m
�[36;1m echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
�[36;1melse�[0m
�[36;1m SRC=.standards-lock/scripts�[0m
�[36;1mfi�[0m
�[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
�[36;1m if [ ! -f "$SRC/$f" ]; then�[0m
�[36;1m echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at job.workflow_sha failed?)"�[0m

GitHub Actions: Governance / governance _ Actions lockfile verify: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run set -uo pipefail
�[36;1mset -uo pipefail�[0m
�[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
�[36;1m SRC=scripts�[0m
�[36;1m echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
�[36;1melse�[0m
�[36;1m SRC=.standards-lock/scripts�[0m
�[36;1mfi�[0m
�[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
�[36;1m if [ ! -f "$SRC/$f" ]; then�[0m
�[36;1m echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at job.workflow_sha failed?)"�[0m

GitHub Actions: Governance / 10_governance _ Code quality + docs.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
with:
github-***REDACTED_SECRET_ASSIGNMENT***
version: latest
##[endgroup]
Find 'latest' release
##[error]Error: The binary 'ec-linux-amd64*' not found

GitHub Actions: Governance / governance _ Code quality + docs: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
with:
github-***REDACTED_SECRET_ASSIGNMENT***
version: latest
##[endgroup]
Find 'latest' release
##[error]Error: The binary 'ec-linux-amd64*' not found

GitHub Actions: Governance / 12_governance _ Language _ package anti-pattern policy.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
�[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
�[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
�[36;1m && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
�[36;1m SCRIPT="scripts/check-ts-allowlist.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-check)."�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
�[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
�[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
�[36;1m && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
�[36;1m SCRIPT="scripts/check-ts-allowlist.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-check)."�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"
�[36;1mSCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"�[0m
�[36;1mif [ ! -f "$SCRIPT" ] && [ -f tools/policy/check-language-policy.sh ]; then�[0m
�[36;1m SCRIPT="tools/policy/check-language-policy.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-check)."�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::language-policy gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / 13_governance _ Check Workflow Staleness.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run bash .standards-history/scripts/check-workflow-staleness.sh .
�[36;1mbash .standards-history/scripts/check-workflow-staleness.sh .�[0m
shell: /usr/bin/bash -e {0}
env:
GITHUB_***REDACTED_SECRET_ASSIGNMENT***
STALENESS_STANDARDS_DIR: /home/runner/work/cloud-sync-tuner/cloud-sync-tuner/.standards-history
##[endgroup]
Staleness Check against Standards SHA: fad242d35291de1898242d6737ba02b74a59a2f2
Recency window: <= 50 commits behind HEAD OR <= 14 days old.
grep: write error: Broken pipe
##[error]hypatia-scan-reusable.yml pin 7fdc2705df74 is not a commit of hyperpolymath/standards reachable from main (confirmed against the GitHub compare API, not just this runner's clone). It may be forged, from a fork, or from rewritten history. Pin a published standards commit.

GitHub Actions: Governance / governance _ Check Workflow Staleness: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run bash .standards-history/scripts/check-workflow-staleness.sh .
�[36;1mbash .standards-history/scripts/check-workflow-staleness.sh .�[0m
shell: /usr/bin/bash -e {0}
env:
GITHUB_***REDACTED_SECRET_ASSIGNMENT***
STALENESS_STANDARDS_DIR: /home/runner/work/cloud-sync-tuner/cloud-sync-tuner/.standards-history
##[endgroup]
Staleness Check against Standards SHA: fad242d35291de1898242d6737ba02b74a59a2f2
Recency window: <= 50 commits behind HEAD OR <= 14 days old.
grep: write error: Broken pipe
##[error]hypatia-scan-reusable.yml pin 7fdc2705df74 is not a commit of hyperpolymath/standards reachable from main (confirmed against the GitHub compare API, not just this runner's clone). It may be forged, from a fork, or from rewritten history. Pin a published standards commit.

🔇 Additional comments (1)

.github/workflows/governance.yml (1)
30-30: LGTM!

📝 Summary

Summary by CodeRabbit

Chores
- Updated governance automation to use a newer verified workflow revision.
- Restricted automation permissions to read-only access where applicable.
- No changes to product functionality, user-facing features, or public interfaces.

Walkthrough

The governance workflow now grants read-only Actions permission and references a newer pinned revision of the shared reusable governance workflow.

Changes

Governance workflow

Layer / File(s)	Summary
Update governance workflow configuration `.github/workflows/governance.yml`	The workflow adds `actions: read` permission and changes the reusable workflow reference to commit `fad242d35291de1898242d6737ba02b74a59a2f2`.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk:⚪ Minimal · up to 87a8c

The governance workflow now uses the updated reusable revision with the required read-only Actions permission. No current merge-blocking risk is identified.

Suggested reviewers:metadatastician

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: updating the governance reusable workflow pin.
Description check	✅ Passed	The description directly explains the workflow revision, the two governance failures, the fixes, and the required actions permission.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks the workflow line
Read-only paws keep access fine
A newer pin now leads the way
Governance hops through each day
The workflow rests in safe array}

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitaiBot approved these changes

View reviewed changes

fix(ci): grant actions: read so the bumped reusable can start

87a8cb6

The governance-reusable at standards HEAD requests `actions: read`. A caller
granting only `contents: read` fails at startup after the pin bump, reporting
no check at all. This grants the missing scope in the same PR as the bump.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

sonarqubecloudBot commented Sep 8, 2026

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

hyperpolymath merged commit 49ac3f5 into main

28 of 30 checks passed

hyperpolymath deleted the chore/bump-governance-pin-to-standards-main branch

September 8, 2026 06:49

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment