chore(ci): bump governance-reusable pin to standards main

[hyperpolymath]

Pinned revision 84355587 of governance-reusable.yml carries two bugs that make Governance red on every consumer:

1. Workflow security linter runs bash scripts/update-actions-lock.sh --verify-local in the caller's checkout, where the script does not exist — exit 127.
2. Allowlist Preflight runs check-actions-policy.sh with an empty GH_TOKEN — gh refuses, exit 3.

Both are cured on standards main (fad242d35291de1898242d6737ba02b74a59a2f2): the verifier is copied into \$RUNNER_TEMP, and the policy step is skipped when no credential is supplied.

Witness: verified green on hyperpolymath/blocky-writer#55 at this exact SHA — governance run completed/success, 15/15 jobs, including the two jobs that were red on that repo's default branch.

Judge this PR by the set difference against your own default branch (which governance jobs are newly red), not by overall check colour — unrelated build failures may pre-date it.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

[github-actions]

🔍 Hypatia Security Scan

Findings: 54 issues detected

Severity	Count
🔴 Critical	6
🟠 High	20
🟡 Medium	28

⚠️Action Required: Critical security issues found!

View findings

[
{
"reason": "No test directory or test files found",
"type": "no_tests",
"file": "/home/runner/work/echo-types/echo-types",
"action": "flag",
"rule_module": "honest_completion",
"severity": "high",
"deduction": 20
},
{
"reason": "Action actions/deploy-pages@v5.0.1 needs attention",
"type": "unpinned_action",
"file": "pages.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in label-triage.yml",
"type": "missing_timeout_minutes",
"file": "label-triage.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in labels.yml",
"type": "missing_timeout_minutes",
"file": "labels.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Required file missing (condition: public_repo)",
"type": "missing_requirement",
"file": "SECURITY.md",
"action": "create",
"rule_module": "cicd_rules",
"severity": "high"
},
{
"reason": "No SECURITY.md found in echo-types",
"type": "SecurityPolicy",
"file": "/home/runner/work/echo-types/echo-types",
"action": "auto_fix",
"rule_module": "scorecard",
"severity": "medium",
"remediation": "Add SECURITY.md documenting how to report vulnerabilities.",
"scorecard_check": "Security-Policy"
},
{
"reason": "5 workflow(s) with tag-pinned (not SHA-pinned) actions in echo-types",
"type": "DependencyPinning",
"file": "/home/runner/work/echo-types/echo-types",
"action": "auto_fix",
"rule_module": "scorecard",
"severity": "medium",
"remediation": "Pin GitHub Actions and Docker base images by SHA hash.",
"scorecard_check": "Pinned-Dependencies"
},
{
"reason": "Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 0 day(s) old",
"type": "CSA001",
"file": ".github/workflows/push-email-notify.yml",
"action": "review",
"rule_module": "code_scanning_alerts",
"severity": "medium"
},
{
"reason": "Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 0 day(s) old",
"type": "CSA001",
"file": ".github/workflows/pages.yml",
"action": "review",
"rule_module": "code_scanning_alerts",
"severity": "medium"
},
{
"reason": "Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 7 day(s) old",
"type": "CSA001",
"file": ".github/workflows/pages.yml",
"action": "review",
"rule_module": "code_scanning_alerts",
"severity": "medium"
}
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 076ea1ac-d1d3-461b-a026-8119b456b63b

📥 Commits

Reviewing files that changed from the base of the PR and between 46cd1a3 and c061bfd.

📒 Files selected for processing (1)

• .github/workflows/governance.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: cold-check
• GitHub Check: check

⚠️ CI failures not shown inline (22)

GitHub Actions: Secret Scanner / 0_scan _ gitleaks.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1m# A repo-local baseline wins outright — it is expected to `[extend]`�[0m
�[36;1m# the estate one, so "wins" still means "inherits". This mirrors what�[0m
�[36;1m# the AsciiDoc pass below already did, which was inconsistent with�[0m
�[36;1m# this step until now.�[0m
�[36;1mCONFIG=".gitleaks-estate.toml"�[0m
�[36;1mif [ -f .gitleaks.toml ]; then�[0m
�[36;1m CONFIG=".gitleaks.toml"�[0m
�[36;1m echo "Using repository .gitleaks.toml (extending the estate baseline)."�[0m
�[36;1melse�[0m
�[36;1m echo "Using estate baseline allowlist."�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1m"$RUNNER_TEMP/gitleaks" detect \�[0m
�[36;1m --source . \�[0m
�[36;1m --no-git \�[0m
�[36;1m --redact \�[0m
�[36;1m --no-banner \�[0m
�[36;1m --verbose \�[0m
�[36;1m --config "$CONFIG" \�[0m
�[36;1m --exit-code 1�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
Using estate baseline allowlist.
Finding: authoritative-text = "�[1;3;mREDACTED�[0m § Observation G"
***REDACTED_SECRET_ASSIGNMENT***
RuleID: generic-api-key
Entropy: 3.576618
File: .machine_readable/6a2/STATE.a2ml
Line: 261
Fingerprint: .machine_readable/6a2/STATE.a2ml:generic-api-key:261
�[90m6:44PM�[0m �[32mINF�[0m scan completed in 222ms
�[90m6:44PM�[0m �[31mWRN�[0m leaks found: 1
##[error]Process completed with exit code 1.

---

GitHub Actions: Secret Scanner / scan _ gitleaks: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1m# A repo-local baseline wins outright — it is expected to `[extend]`�[0m
�[36;1m# the estate one, so "wins" still means "inherits". This mirrors what�[0m
�[36;1m# the AsciiDoc pass below already did, which was inconsistent with�[0m
�[36;1m# this step until now.�[0m
�[36;1mCONFIG=".gitleaks-estate.toml"�[0m
�[36;1mif [ -f .gitleaks.toml ]; then�[0m
�[36;1m CONFIG=".gitleaks.toml"�[0m
�[36;1m echo "Using repository .gitleaks.toml (extending the estate baseline)."�[0m
�[36;1melse�[0m
�[36;1m echo "Using estate baseline allowlist."�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1m"$RUNNER_TEMP/gitleaks" detect \�[0m
�[36;1m --source . \�[0m
�[36;1m --no-git \�[0m
�[36;1m --redact \�[0m
�[36;1m --no-banner \�[0m
�[36;1m --verbose \�[0m
�[36;1m --config "$CONFIG" \�[0m
�[36;1m --exit-code 1�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
Using estate baseline allowlist.
Finding: authoritative-text = "�[1;3;mREDACTED�[0m § Observation G"
***REDACTED_SECRET_ASSIGNMENT***
RuleID: generic-api-key
Entropy: 3.576618
File: .machine_readable/6a2/STATE.a2ml
Line: 261
Fingerprint: .machine_readable/6a2/STATE.a2ml:generic-api-key:261
�[90m6:44PM�[0m �[32mINF�[0m scan completed in 222ms
�[90m6:44PM�[0m �[31mWRN�[0m leaks found: 1
##[error]Process completed with exit code 1.

---

GitHub Actions: Secret Scanner / 1_scan _ shell-secrets.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
�[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
�[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
�[36;1mPATTERNS=(�[0m
�[36;1m '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
�[36;1m '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
�[36;1m '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
�[36;1m '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
�[36;1m)�[0m
�[36;1m�[0m
�[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
�[36;1m# immediately preceding line.�[0m
�[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
�[36;1m�[0m
�[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
�[36;1m# reference rather than a literal are never real secrets.�[0m
�[36;1m# Matches: ="$VAR" ="${VAR}" ="${VAR:-…}" ="${VAR:?…}" ='${VAR}' =$VAR�[0m
�[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
�[36;1m�[0m
�[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
�[36;1mIGNORE_GLOBS=()�[0m
�[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
�[36;1m while IFS= read -r line || [[ -n "$line" ]]; do�[0m
�[36;1m # Skip blank lines and comments�[0m
�[36;1m [[ -z "$line" || "$line" == \#* ]] && continue�[0m
�[36;1m IGNORE_GLOBS+=("$line")�[0m
�[36;1m done < .shell-secrets-ignore�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
�[36;1mis_ignored() {�[0m
�[36;1m local path="$1"�[0m
�[36;1m for glob in "${IGNORE_GLOBS[@]}"; do�[0m
�[36;1m #...

---

GitHub Actions: Secret Scanner / scan _ shell-secrets: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
�[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
�[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
�[36;1mPATTERNS=(�[0m
�[36;1m '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
�[36;1m '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
�[36;1m '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
�[36;1m '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
�[36;1m)�[0m
�[36;1m�[0m
�[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
�[36;1m# immediately preceding line.�[0m
�[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
�[36;1m�[0m
�[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
�[36;1m# reference rather than a literal are never real secrets.�[0m
�[36;1m# Matches: ="$VAR" ="${VAR}" ="${VAR:-…}" ="${VAR:?…}" ='${VAR}' =$VAR�[0m
�[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
�[36;1m�[0m
�[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
�[36;1mIGNORE_GLOBS=()�[0m
�[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
�[36;1m while IFS= read -r line || [[ -n "$line" ]]; do�[0m
�[36;1m # Skip blank lines and comments�[0m
�[36;1m [[ -z "$line" || "$line" == \#* ]] && continue�[0m
�[36;1m IGNORE_GLOBS+=("$line")�[0m
�[36;1m done < .shell-secrets-ignore�[0m
�[36;1mfi�[0m
�[36;1m�[0m
�[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
�[36;1mis_ignored() {�[0m
�[36;1m local path="$1"�[0m
�[36;1m for glob in "${IGNORE_GLOBS[@]}"; do�[0m
�[36;1m #...

---

GitHub Actions: Secret Scanner / 2_scan _ rust-secrets.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
�[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
�[36;1m�[0m
�[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
�[36;1m# disarming the widened scan. Refuse to run instead.�[0m
�[36;1mrequire_date() {�[0m
�[36;1m case "$2" in�[0m
�[36;1m [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
�[36;1m *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

---

GitHub Actions: Secret Scanner / scan _ rust-secrets: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
�[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
�[36;1m�[0m
�[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
�[36;1m# disarming the widened scan. Refuse to run instead.�[0m
�[36;1mrequire_date() {�[0m
�[36;1m case "$2" in�[0m
�[36;1m [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
�[36;1m *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

---

GitHub Actions: Governance / 1_governance _ Workflow security linter.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
�[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
�[36;1m SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-lint)."�[0m
�[36;1melse�[0m
�[36;1m SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

---

GitHub Actions: Governance / governance _ Workflow security linter: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
�[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
�[36;1m SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-lint)."�[0m
�[36;1melse�[0m
�[36;1m SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

---

GitHub Actions: Governance / governance _ Workflow security linter: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
�[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
�[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
�[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
�[36;1m# duplicate and reports success — so the file "parses" and every�[0m
�[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
�[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
�[36;1m# successful runs in its entire lifetime.�[0m
�[36;1mset -euo pipefail�[0m
�[36;1m# Standards exercises its pull-request scripts; every consumer uses�[0m
�[36;1m# the canonical scripts fetched from this workflow's immutable�[0m
�[36;1m# Standards revision.�[0m
�[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
�[36;1m SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-lint)."�[0m
�[36;1melse�[0m
�[36;1m SCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

---

GitHub Actions: Governance / 3_governance _ Actions lockfile verify.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run set -uo pipefail
�[36;1mset -uo pipefail�[0m
�[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
�[36;1m SRC=scripts�[0m
�[36;1m echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
�[36;1melse�[0m
�[36;1m SRC=.standards-lock/scripts�[0m
�[36;1mfi�[0m
�[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
�[36;1m if [ ! -f "$SRC/$f" ]; then�[0m
�[36;1m echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at job.workflow_sha failed?)"�[0m

---

GitHub Actions: Governance / governance _ Actions lockfile verify: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run set -uo pipefail
�[36;1mset -uo pipefail�[0m
�[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
�[36;1m SRC=scripts�[0m
�[36;1m echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
�[36;1melse�[0m
�[36;1m SRC=.standards-lock/scripts�[0m
�[36;1mfi�[0m
�[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
�[36;1m if [ ! -f "$SRC/$f" ]; then�[0m
�[36;1m echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at job.workflow_sha failed?)"�[0m

---

GitHub Actions: Governance / 5_governance _ Code quality + docs.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
with:
github-***REDACTED_SECRET_ASSIGNMENT***
version: latest
##[endgroup]
Find 'latest' release
##[error]Error: The binary 'ec-linux-amd64*' not found

---

GitHub Actions: Governance / governance _ Code quality + docs: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
with:
github-***REDACTED_SECRET_ASSIGNMENT***
version: latest
##[endgroup]
Find 'latest' release
##[error]Error: The binary 'ec-linux-amd64*' not found

---

GitHub Actions: Governance / 6_governance _ Well-Known (RFC 9116 + RSR).txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SECTXT=""
�[36;1mSECTXT=""�[0m
�[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
�[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
�[36;1mif [ -z "$SECTXT" ]; then�[0m
�[36;1m echo "::warning::No security.txt found."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

---

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SECTXT=""
�[36;1mSECTXT=""�[0m
�[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
�[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
�[36;1mif [ -z "$SECTXT" ]; then�[0m
�[36;1m echo "::warning::No security.txt found."�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

---

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
�[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
�[36;1mif [ -n "$MIXED" ]; then�[0m
�[36;1m echo "::error::Mixed content (HTTP in HTML)"�[0m

---

GitHub Actions: Governance / 8_governance _ Language _ package anti-pattern policy.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
�[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
�[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
�[36;1m && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
�[36;1m SCRIPT="scripts/check-ts-allowlist.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-check)."�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

---

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
�[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
�[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
�[36;1m && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
�[36;1m SCRIPT="scripts/check-ts-allowlist.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-check)."�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

---

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"
�[36;1mSCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"�[0m
�[36;1mif [ ! -f "$SCRIPT" ] && [ -f tools/policy/check-language-policy.sh ]; then�[0m
�[36;1m SCRIPT="tools/policy/check-language-policy.sh"�[0m
�[36;1m echo "Using this repository's own copy (standards self-check)."�[0m
�[36;1mfi�[0m
�[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
�[36;1m echo "::error::language-policy gate not found in standards@main or locally"�[0m

---

GitHub Actions: Governance / 14_governance _ Security policy checks.txt: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run FAILED=false
�[36;1mFAILED=false�[0m
�[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
�[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
�[36;1m echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
�[36;1m echo "$WEAK_CRYPTO"�[0m
�[36;1mfi�[0m
�[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
�[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
�[36;1m echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
�[36;1m echo "$HTTP_URLS"�[0m
�[36;1mfi�[0m
�[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
�[36;1mif [ -n "$SECRETS" ]; then�[0m
�[36;1m echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

---

GitHub Actions: Governance / governance _ Security policy checks: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run FAILED=false
�[36;1mFAILED=false�[0m
�[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
�[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
�[36;1m echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
�[36;1m echo "$WEAK_CRYPTO"�[0m
�[36;1mfi�[0m
�[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
�[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
�[36;1m echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
�[36;1m echo "$HTTP_URLS"�[0m
�[36;1mfi�[0m
�[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
�[36;1mif [ -n "$SECRETS" ]; then�[0m
�[36;1m echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

---

GitHub Actions: Governance / governance _ Security policy checks: chore(ci): bump governance-reusable pin to standards main

Conclusion: failure

View job details

##[group]Run set -uo pipefail
�[36;1mset -uo pipefail�[0m
�[36;1mDIR=.github/canonical-references�[0m
�[36;1mif [ ! -d "$DIR" ]; then�[0m
�[36;1m echo "ℹ️ [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
�[36;1m exit 0�[0m
�[36;1mfi�[0m
�[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
�[36;1m echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
�[36;1m exit 2�[0m
�[36;1mfi�[0m
�[36;1mpython3 - <<'PY'�[0m
�[36;1mimport os, sys, glob, subprocess�[0m
�[36;1mtry:�[0m
�[36;1m import yaml�[0m
�[36;1mexcept ImportError:�[0m
�[36;1m sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
�[36;1m�[0m
�[36;1mdir_ = ".github/canonical-references"�[0m
�[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
�[36;1mif not files:�[0m
�[36;1m print(f"ℹ️ [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
�[36;1m sys.exit(0)�[0m
�[36;1m�[0m
�[36;1mtotal = 0�[0m
�[36;1mfor rf in files:�[0m
�[36;1m with open(rf, encoding="utf-8") as fh:�[0m
�[36;1m cfg = yaml.safe_load(fh)�[0m
�[36;1m if not isinstance(cfg, dict):�[0m
�[36;1m print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
�[36;1m rid = cfg.get("id", os.path.basename(rf))�[0m
�[36;1m desc = cfg.get("description", "")�[0m
�[36;1m pats = cfg.get("patterns") or []�[0m
�[36;1m canon = cfg.get("canonical_pointer", "")�[0m
�[36;1m scope = (cfg.get("scope") or {})�[0m
�[36;1m includes = scope.get("include") or []�[0m
�[36;1m if not pats or not includes:�[0m
�[36;1m print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
�[36;1m total += 1; continue�[0m
�[36;1m # exclude self-references�[0m
�[36;1m skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
�[36;1m if canon: skip.add(canon)�[0m
�[36;1m rule_hits = 0�[0m
�[36;1m for f_ in includes:�[0m
�[36;1m if f_ in skip or not os...

🔇 Additional comments (1)

.github/workflows/governance.yml (1)

40-40: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the shared governance workflow reference to a newer approved revision.
  • No changes to workflow triggers, permissions, concurrency, or user-facing functionality.

Walkthrough

The governance workflow now uses a new pinned commit for the shared reusable workflow. Triggers, permissions, concurrency, and other workflow logic remain unchanged.

Changes

Governance workflow

Layer / File(s)	Summary
Update reusable workflow pin .github/workflows/governance.yml	The uses reference now points to commit fad242d35291de1898242d6737ba02b74a59a2f2.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk:⚪ Minimal · up to c061b

The governance workflow now uses the updated pinned shared-workflow revision, with no other workflow configuration changes. No current merge-readiness risk remains.

Poem

A rabbit checks the workflow pin
One SHA changes; checks begin
The governance path stays clear
No triggers shift, no settings veer
A tidy update hops in cheer

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description accurately explains the governance workflow pin update and the failures fixed by the new revision.
Title check	✅ Passed	The title clearly and concisely identifies the CI governance pin update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}