From 76501abb44bdd82beaac477a8b51f3e50435ee12 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 21:39:59 +0100 Subject: [PATCH] =?UTF-8?q?fix(ci):=20close=20the=20governance=20gate=20?= =?UTF-8?q?=E2=80=94=20SPDX,=20permissions,=20SHA=20pins,=20reusable=20bum?= =?UTF-8?q?p?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The governance gate is all-jobs-must-pass, so these ship as one commit; individually none of them turns the repo green. * SPDX line-1 header and a top-level `permissions:` block on every workflow file (the two `Workflow security linter` checks). * Every `uses:` tag reference resolved to a full 40-hex commit SHA. This satisfies the linter and also the repository's own `sha_pinning_required` Actions policy, which refuses `@v4` at parse time — a refusal that produces no check run at all. * `hypatia-scan.yml` now grants `security-events: write`. This is not cosmetic and is not separable from the pin bump below: at HEAD the reusable declares `security-events: write` where the old pin declared `read`, and a called workflow cannot escalate beyond its caller's grant. Bumping the pin without this would fail at parse time. * The three reusables watched by the staleness gate (governance, hypatia-scan, scorecard) advanced to standards HEAD, which is 62 commits ahead of the false-green cache fix and includes the deny-list-negative fix from standards#524. `mirror-reusable` and `secret-scanner-reusable` are deliberately left on their current pins: the staleness gate does not watch them, so they are not holding anything red, and bumping them carries unrelated risk. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 13327b9..8776de0 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -13,4 +13,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 \ No newline at end of file diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 02b0e9c..9dde27a 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -12,8 +12,8 @@ on: permissions: contents: read - security-events: read + security-events: write jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 \ No newline at end of file diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 4ecc2ad..b97e2cb 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -13,7 +13,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 permissions: contents: read security-events: write