Skip to content

fix(ci): restore reachable standards workflow pins - #55

Open
hyperpolymath wants to merge 1 commit into
mainfrom
fix/restore-reachable-standards-pin
Open

fix(ci): restore reachable standards workflow pins#55
hyperpolymath wants to merge 1 commit into
mainfrom
fix/restore-reachable-standards-pin

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Replace the unreachable standards reusable-workflow commit 7fdc2705df74b4e352d2a1cde3e87a5923fdf329 with reachable standards main commit 092dedada188f56c5915f74a5fd40aac093742c3. The old SHA is an intermediate commit from squash-merged standards PR #596: it exists, but GitHub rejects it for cross-repository reusable workflows before creating jobs. This restores Hypatia/SARIF and the other affected workflows without weakening SHA pinning or branch protection. Estate incident: 251 active workflow files across 70 repositories in hyperpolymath and metadatastician.

@coderabbitai

coderabbitaiBot commented Sep 4, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 189b38b5-ccdf-441c-a84e-669fbd6138b7

📥 Commits

Reviewing files that changed from the base of the PR and between b62536e and 2f446bf.

📒 Files selected for processing (5)
  • .github/workflows/governance.yml
  • .github/workflows/hypatia-scan.yml
  • .github/workflows/mirror.yml
  • .github/workflows/scorecard.yml
  • .github/workflows/secret-scanner.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (24)
  • GitHub Check: scan / rust-secrets
  • GitHub Check: scan / gitleaks
  • GitHub Check: scan / shell-secrets
  • GitHub Check: governance / Actions lockfile verify
  • GitHub Check: governance / Workflow security linter
  • GitHub Check: governance / Allowlist Preflight
  • GitHub Check: governance / Licence consistency
  • GitHub Check: governance / Code quality + docs
  • GitHub Check: governance / Check Workflow Staleness
  • GitHub Check: governance / Trusted-base reduction policy
  • GitHub Check: governance / Exemption ratchet
  • GitHub Check: governance / Security policy checks
  • GitHub Check: governance / Well-Known (RFC 9116 + RSR)
  • GitHub Check: governance / Debt ratchet
  • GitHub Check: governance / Live Actions policy (credentialed advisory)
  • GitHub Check: governance / Language / package anti-pattern policy
  • GitHub Check: governance / Guix packaging policy (Nix retired)
  • GitHub Check: scan / Hypatia Neurosymbolic Analysis
  • GitHub Check: analyze (actions, none)
  • GitHub Check: analyze (rust, none)
  • GitHub Check: Groove manifest check
  • GitHub Check: Validate A2ML manifests
  • GitHub Check: Validate K9 contracts
  • GitHub Check: Empty-linter (invisible characters)
🔇 Additional comments (5)
.github/workflows/governance.yml (1)

17-17: LGTM!

.github/workflows/hypatia-scan.yml (1)

20-20: LGTM!

.github/workflows/mirror.yml (1)

15-15: LGTM!

.github/workflows/scorecard.yml (1)

15-15: LGTM!

.github/workflows/secret-scanner.yml (1)

21-21: LGTM!


📝 Summary

Summary by CodeRabbit

  • Chores
    • Updated the pinned versions of governance, security scanning, mirroring, scorecard, and secret-scanning workflows.
    • CI and security checks now use newer workflow revisions.

Walkthrough

Five GitHub Actions workflows now reference reusable workflows at commit 092dedada188f56c5915f74a5fd40aac093742c3 instead of the previous pinned commit.

Changes

Reusable workflow reference updates

Layer / File(s)Summary
Update reusable workflow pins
.github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/mirror.yml, .github/workflows/scorecard.yml, .github/workflows/secret-scanner.yml
The governance, Hypatia scan, mirror, Scorecard, and secret-scanner jobs now use the updated reusable workflow commit.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk:⚪ Minimal · up to 2f446

This updates five reusable workflow pins to restore their availability while retaining immutable SHA references. No current merge-blocking risk is identified.

Poem

A rabbit checks each workflow pin
New commit hashes hop in
Governance, scans, and mirrors align
Scorecard follows the same line
Secret scanning joins the queue
Five little updates, neat and true

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check nameStatusExplanationResolution
Description check⚠️ WarningThe description gives a specific purpose, affected commit SHAs, failure context, and impact. It does not use the required template sections for Summary, Changes, RSR Quality Checklist, Testing, or Scr…Update the description to include the required template headings. List the workflow changes, record the applicable RSR Quality Checklist items, and describe the tests performed or explain why testing is not applicable. Add screenshots or te…
✅ Passed checks (4 passed)
Check nameStatusExplanation
Title check✅ PassedThe title clearly describes the main change: restoring reachable pinned references for standards reusable workflows.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Full details: Description check

Explanation

The description gives a specific purpose, affected commit SHAs, failure context, and impact. It does not use the required template sections for Summary, Changes, RSR Quality Checklist, Testing, or Screenshots, and it provides no testing or checklist status.

Resolution

Update the description to include the required template headings. List the workflow changes, record the applicable RSR Quality Checklist items, and describe the tests performed or explain why testing is not applicable. Add screenshots or terminal output if applicable; otherwise state that they are not applicable.

  • Fix all pre-merge checks with AI

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath