fix(ci): restore reachable standards workflow pins

[hyperpolymath]

Replace the unreachable standards reusable-workflow commit 7fdc2705df74b4e352d2a1cde3e87a5923fdf329 with reachable standards main commit 092dedada188f56c5915f74a5fd40aac093742c3. The old SHA is an intermediate commit from squash-merged standards PR #596: it exists, but GitHub rejects it for cross-repository reusable workflows before creating jobs. This restores Hypatia/SARIF and the other affected workflows without weakening SHA pinning or branch protection. Estate incident: 251 active workflow files across 70 repositories in hyperpolymath and metadatastician.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: d5f23d91-4c4c-4dd1-8841-b650b19a3880

📥 Commits

Reviewing files that changed from the base of the PR and between d39fa3c and efce1e0.

📒 Files selected for processing (4)

• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/mirror.yml
• .github/workflows/scorecard.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (28)

• GitHub Check: governance / Actions lockfile verify
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Debt ratchet
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: governance / Security policy checks
• GitHub Check: scan / gitleaks
• GitHub Check: scan / shell-secrets
• GitHub Check: scan / rust-secrets
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Groove manifest check
• GitHub Check: Validate A2ML manifests
• GitHub Check: Validate eclexiaiser manifest
• GitHub Check: Smoke — Documented Install Path
• GitHub Check: Validate K9 contracts
• GitHub Check: E2E — Julia Test Suite
• GitHub Check: Workflows parse (no silent-dead gates)
• GitHub Check: estate-audit
• GitHub Check: Aspect — Safety + SPDX
• GitHub Check: analyze (javascript-typescript, none)

🧰 Additional context used

📓 Path-based instructions (1)

Never create these in the repo root:

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Files:

• .github/workflows/governance.yml
• .github/workflows/scorecard.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/mirror.yml

🪛 zizmor (1.29.0)

.github/workflows/mirror.yml

[warning] 16-16: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow

(secrets-inherit)

🔇 Additional comments (4)

.github/workflows/governance.yml (1)

17-17: LGTM!

.github/workflows/hypatia-scan.yml (1)

23-23: LGTM!

.github/workflows/mirror.yml (1)

16-16: LGTM!

.github/workflows/scorecard.yml (1)

15-15: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the automated governance, security scanning, repository mirroring and scorecard checks to use refreshed workflow versions.
  • Existing triggers, permissions and workflow behaviour remain unchanged.

Walkthrough

Four GitHub Actions workflows now pin their reusable hyperpolymath/standards workflow references to commit 092dedada188f56c5915f74a5fd40aac093742c3.

Changes

Reusable workflow pin updates

Layer / File(s)	Summary
Repin reusable workflows .github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/mirror.yml, .github/workflows/scorecard.yml	The governance, Hypatia scan, mirror, and scorecard workflows now use the newer pinned commit. No triggers, permissions, or other workflow logic changed.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk:⚪ Minimal · up to efce1

This restores the reusable workflow references for governance, Hypatia scanning, mirroring, and scorecard checks while retaining SHA pinning. No current merge-blocking risk is identified.

Poem

A rabbit checks each workflow pin
Four fresh hashes now settle in
Governance hops, scans follow through
Mirrors and scorecards update too
No other lines disturb the run
The tidy change is safely done

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the purpose and affected workflows, but it does not use the required sections or provide testing results, checklist status, or applicable change details.	Add the required Summary, Changes, RSR Quality Checklist, and Testing sections. Record the relevant checklist results and describe the tests run, or explain why testing is not applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: restoring reachable pinned standards workflow references.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}