From e740dc5f66bccf3bd59edec9aaa6835e6f8c5ae2 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 4 Aug 2026 05:17:32 +0100 Subject: [PATCH 1/2] fix(ci): bump standards re-pin to bd0df9e (lockfile-aware governance lint) Co-Authored-By: Claude Fable 5 --- .github/workflows/deno-ci.yml | 2 +- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/deno-ci.yml b/.github/workflows/deno-ci.yml index 5537219..29e191c 100644 --- a/.github/workflows/deno-ci.yml +++ b/.github/workflows/deno-ci.yml @@ -18,4 +18,4 @@ permissions: jobs: deno-ci: - uses: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # standards#168 head + uses: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 # standards#168 head diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 235c601..6fa4313 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -32,4 +32,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # main 2026-05-27 (post-#219 workflow_sha fix) + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 # main 2026-05-27 (post-#219 workflow_sha fix) diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 8df8727..bbde471 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -26,5 +26,5 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 secrets: inherit \ No newline at end of file diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 797be50..b27fda1 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -12,5 +12,5 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 secrets: inherit diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index b9b3dd8..8d0b54c 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -15,7 +15,7 @@ permissions: jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 with: enable_audit: true enable_coverage: true diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index df71468..3efc3d0 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -16,5 +16,5 @@ jobs: permissions: security-events: write id-token: write - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 secrets: inherit diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 2e351e7..436d61a 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -20,5 +20,5 @@ jobs: contents: read pull-requests: write actions: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 secrets: inherit \ No newline at end of file From 0558aab6e0e688eb69966713ef149610821b61b2 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 4 Aug 2026 05:31:16 +0100 Subject: [PATCH 2/2] fix(ci): grant wrappers the permission union their reusables demand MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit At standards >= fcb8669 the governance/hypatia/mirror/scorecard reusables declare actions: read (hypatia adds security-events: write; scorecard adds id-token/security-events write). A reusable requesting more than its caller grants is a startup_failure — the third enforcement layer after the lockfile and the caller entries. Co-Authored-By: Claude Fable 5 --- .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 5 +++-- .github/workflows/mirror.yml | 1 + 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 6fa4313..829527d 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -28,6 +28,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index bbde471..d96e21a 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -20,11 +20,12 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read - security-events: write pull-requests: write + security-events: write jobs: hypatia: uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 - secrets: inherit \ No newline at end of file + secrets: inherit diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index b27fda1..5a1be21 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -8,6 +8,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: