fix(ci): restore reachable standards workflow pins

[hyperpolymath]

Replace the unreachable standards reusable-workflow commit 7fdc2705df74b4e352d2a1cde3e87a5923fdf329 with reachable standards main commit 092dedada188f56c5915f74a5fd40aac093742c3. The old SHA is an intermediate commit from squash-merged standards PR #596: it exists, but GitHub rejects it for cross-repository reusable workflows before creating jobs. This restores Hypatia/SARIF and the other affected workflows without weakening SHA pinning or branch protection. Estate incident: 251 active workflow files across 70 repositories in hyperpolymath and metadatastician.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 0c600219-01b4-40ef-b6b2-ca328a5ba28f

📥 Commits

Reviewing files that changed from the base of the PR and between 2b9053c and 3745fe7.

📒 Files selected for processing (2)

• .github/workflows/governance.yml
• .github/workflows/scorecard.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (13)

• GitHub Check: Validate A2ML manifests
• GitHub Check: build
• GitHub Check: Validate eclexiaiser manifest
• GitHub Check: security
• GitHub Check: Validate K9 contracts
• GitHub Check: Hypatia Neurosymbolic Analysis
• GitHub Check: Groove manifest check
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: lint-workflows
• GitHub Check: Build and test
• GitHub Check: analyze (actions, none)
• GitHub Check: analyze (javascript-typescript, none)
• GitHub Check: lint-workflows

🔇 Additional comments (2)

.github/workflows/governance.yml (1)

34-34: LGTM!

.github/workflows/scorecard.yml (1)

19-19: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the governance automation workflow to use a newer verified revision.
  • Updated the Scorecards automation workflow to use a newer verified revision.

Walkthrough

The governance and Scorecards workflows now reference the pinned commit 092dedada188f56c5915f74a5fd40aac093742c3.

Changes

Workflow pin updates

Layer / File(s)	Summary
Update reusable workflow references .github/workflows/governance.yml, .github/workflows/scorecard.yml	The workflows now use the newer pinned reusable workflow commit.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 3745f

The governance and Scorecards workflows now use the reachable pinned shared-workflow revision, restoring reusable workflow execution without changing workflow inputs or permissions. The change is ready to merge.

Poem

A rabbit checks the workflow pins
Two newer hashes now begin
Governance hops in line
Scorecards follows fine
The CI burrow safely spins

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the replacement of the unreachable reusable-workflow commit and the resulting CI restoration. It directly matches the changeset and objectives.
Title check	✅ Passed	The title clearly identifies the CI fix and the restoration of reachable workflow pins. It accurately summarises the primary change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}