From 8e558065b20cb75f4b8e72756c9096c1f97d5193 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 12:31:13 +0000 Subject: [PATCH] fix(ci): pass hypatia-ref aa34a4c to the standards scanner reusables Governance's Validate Hypatia Baseline and the Hypatia Security Scan build the scanner at the reusables' default hypatia-ref, 51ab649. That commit's ActionsLock parser accepts only v0.0.2, so this repo's tool-owned v0.0.3 actions.lock fails closed as two high invalid_actions_lock findings on every run. Pass hypatia-ref aa34a4c (main after #938, which adds v0.0.3 support) as an input. The `uses:` refs are unchanged, so actions.lock is untouched. This is the value standards#1315 moves the defaults to; drop the input once the standards callers are re-pinned past that PR. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM --- .github/workflows/governance.yml | 6 ++++++ .github/workflows/hypatia-scan.yml | 3 +++ 2 files changed, 9 insertions(+) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index b587d669..a04c0675 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -17,6 +17,12 @@ permissions: jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 + # Scanner pin, overriding the reusable's default (51ab649, which rejects the + # v0.0.3 actions.lock that gh actions-lock now writes). aa34a4c carries + # #938. Same value as standards#1315; drop this input once the `uses:` above + # is re-pinned past that PR. + with: + hypatia-ref: aa34a4cc6ba39d873710ff39763fdb9cde715f9d permissions: actions: read contents: read diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index c640d0f7..f647bbcc 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -22,5 +22,8 @@ permissions: jobs: hypatia: uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 + # Scanner pin: see governance.yml. Drop once `uses:` is re-pinned. + with: + hypatia-ref: aa34a4cc6ba39d873710ff39763fdb9cde715f9d secrets: HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }}