From c061bfdac68933685a51b08bc38301141cb17f74 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 7 Sep 2026 19:44:28 +0100 Subject: [PATCH] chore(ci): bump governance-reusable pin to standards main The pinned revision carries bugs that make Governance red on every consumer: the Workflow security linter runs update-actions-lock.sh from the CALLER's checkout where it does not exist (exit 127), and Allowlist Preflight runs check-actions-policy.sh with an empty GH_TOKEN (exit 3). Both are fixed on standards main. Witnessed green on hyperpolymath/blocky-writer at this exact SHA: governance run completed/success, 15/15 jobs. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/governance.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 232ff80..c0518ff 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -37,4 +37,4 @@ jobs: # matches the sibling repos' pin (e.g. ochrance-framework). Bump # deliberately, never float: an unpinned reusable workflow is an # unpinned trust boundary. mirror.yml / scorecard.yml already pin. - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@fad242d35291de1898242d6737ba02b74a59a2f2