From f3040349ea1ad8a2856656cb06d62104244e9224 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 1 Nov 2026 09:55:46 +0000 Subject: [PATCH 1/2] ci: pin standards workflows to SLSA allowlist fix Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> --- .github/workflows/fork-governance-publish.yml | 2 +- .github/workflows/fork-governance.yml | 6 +++--- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 7 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/fork-governance-publish.yml b/.github/workflows/fork-governance-publish.yml index 3f0a2f6..76e26ad 100644 --- a/.github/workflows/fork-governance-publish.yml +++ b/.github/workflows/fork-governance-publish.yml @@ -187,7 +187,7 @@ jobs: GH_TOKEN: ${{ github.token }} run: | set -euo pipefail - gh api 'repos/metadatastician/standards/contents/scripts/fork-governance-render.sh?ref=34cf03f988b8ca95b91b45d9b3351f7d3babfb65' \ + gh api 'repos/metadatastician/standards/contents/scripts/fork-governance-render.sh?ref=857ff096af11451841fb10488fed1438523973a1' \ --jq .content | base64 -d > "$RUNNER_TEMP/trusted-renderer.sh" - name: Render and publish the verified run's summary diff --git a/.github/workflows/fork-governance.yml b/.github/workflows/fork-governance.yml index 2492f6c..0ae000c 100644 --- a/.github/workflows/fork-governance.yml +++ b/.github/workflows/fork-governance.yml @@ -52,7 +52,7 @@ permissions: jobs: deed: name: DEED syntax - uses: metadatastician/standards/.github/workflows/deed-conformance.yml@34cf03f988b8ca95b91b45d9b3351f7d3babfb65 + uses: metadatastician/standards/.github/workflows/deed-conformance.yml@857ff096af11451841fb10488fed1438523973a1 permissions: contents: read with: @@ -60,7 +60,7 @@ jobs: k9: name: K9-DEED conformance - uses: metadatastician/standards/.github/workflows/k9-conformance.yml@34cf03f988b8ca95b91b45d9b3351f7d3babfb65 + uses: metadatastician/standards/.github/workflows/k9-conformance.yml@857ff096af11451841fb10488fed1438523973a1 permissions: contents: read pull-requests: read @@ -88,7 +88,7 @@ jobs: # orange fleet rows, never as a missing lane. needs: [fleet] if: ${{ always() }} - uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@34cf03f988b8ca95b91b45d9b3351f7d3babfb65 + uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@857ff096af11451841fb10488fed1438523973a1 permissions: actions: read contents: read diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index e6d39f4..03a8f09 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -29,7 +29,7 @@ jobs: permissions: actions: read contents: read - uses: metadatastician/standards/.github/workflows/governance-reusable.yml@34cf03f988b8ca95b91b45d9b3351f7d3babfb65 + uses: metadatastician/standards/.github/workflows/governance-reusable.yml@857ff096af11451841fb10488fed1438523973a1 with: # Strictest baseline mode: if a .hypatia-baseline.json acknowledgement # ever lands here it must carry an expires_at, or this fails. (The repo diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 428d05f..651c6a8 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -34,7 +34,7 @@ jobs: actions: read contents: read security-events: write - uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@34cf03f988b8ca95b91b45d9b3351f7d3babfb65 + uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@857ff096af11451841fb10488fed1438523973a1 secrets: # Same declared-secret shape as the PR lane: without it the alert # meta-rules fall back to the built-in token, which cannot read diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index edbdee0..93d9027 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -18,7 +18,7 @@ jobs: permissions: actions: read contents: read - uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@34cf03f988b8ca95b91b45d9b3351f7d3babfb65 + uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@857ff096af11451841fb10488fed1438523973a1 secrets: GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index e12d032..f43e700 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -30,4 +30,4 @@ jobs: contents: read id-token: write security-events: write - uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@34cf03f988b8ca95b91b45d9b3351f7d3babfb65 + uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@857ff096af11451841fb10488fed1438523973a1 diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 128a499..d01f080 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -25,4 +25,4 @@ jobs: # re-resolves every reusable pin on each run. permissions: contents: read - uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@34cf03f988b8ca95b91b45d9b3351f7d3babfb65 + uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@857ff096af11451841fb10488fed1438523973a1 From 8d065c3a7f091be2491576410b4646b3fab7f126 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 1 Nov 2026 10:07:04 +0000 Subject: [PATCH 2/2] docs(ci): refresh standards pin comment Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> --- .github/workflows/fork-governance.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/fork-governance.yml b/.github/workflows/fork-governance.yml index 0ae000c..c408693 100644 --- a/.github/workflows/fork-governance.yml +++ b/.github/workflows/fork-governance.yml @@ -2,7 +2,7 @@ # fork-governance.yml — the estate conformance lanes on every pull request, # adopted per metadatastician/standards 3-practice/fork-governance/ADOPTION.adoc # at the same standards commit every other reusable in this repo pins -# (34cf03f…). Scans here; fork-governance-publish.yml posts one comment: +# (857ff096af11451841fb10488fed1438523973a1). Scans here; fork-governance-publish.yml posts one comment: # # CANONICAL COORDINATES (2026-10-28 repair). `standards` was transferred from # the `hyperpolymath` user account to the `metadatastician` organisation on