Skip to content

fix(ci): pin standards reusables to default-branch HEAD - #90

Merged
hyperpolymath merged 1 commit into
mainfrom
fix/bump-diverged-standards-pin
Sep 8, 2026
Merged

fix(ci): pin standards reusables to default-branch HEAD#90
hyperpolymath merged 1 commit into
mainfrom
fix/bump-diverged-standards-pin

Conversation

@hyperpolymath

@hyperpolymath hyperpolymath commented Sep 8, 2026

Copy link
Copy Markdown
Owner

Re-points this repo's hyperpolymath/standards reusable-workflow pins at the standards default-branch HEAD, 257869d3061d5a8ed1529bf34225d90a2416d51a.

Why this is not a routine version bump. uses: org/repo/.github/workflows/x.yml@<ref> is resolved at workflow startup, so a bad ref is not a failing job — it is no job at all. This campaign repairs three kinds of drift and does not assume which one this repo had:

  • an unreachable sha kills the run before any job is created, so GitHub reports no check at all rather than a failing one: the gate does not go red, it disappears, and gh pr checks simply lists fewer rows. A repo in this state looks greener than one with working gates;
  • a floating ref such as @main runs, but unpinned — the supply-chain property the estate pins for is absent;
  • a stale but reachable sha runs the reusable as it was, silently reintroducing every bug fixed since it.

The refs this repo was actually pinned to, before this PR: fad242d35291de1898242d6737ba02b74a59a2f2.

Expect this PR to surface failures that main does not show. Those failures are revealed, not introduced — they are the gates resuming work after being silently absent. The honest comparison is the set of check names emitted here versus on main, not pass/fail counts. On the canary (hyperpolymath/empty-linter#79) the governance suite was absent on main and emitted 25 checks once repaired.

The target is default-branch HEAD resolved at sweep time, never a sha copied from a plan: a reachable but non-HEAD sha silently reintroduces every bug fixed since it.

Engine: .git-private-farm/scripts/smtp-notify-sweep.sh --campaign campaigns/pin-repair.sh. Verification for this repo: files=5 pins=5 perms=0 permlines=0 from=fad242d35291de1898242d6737ba02b74a59a2f2 target=257869d3 sig=G 71af918 canon=393d9db5fa79 base=main

🤖 Generated with Claude Code

https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

@hyperpolymath @claude
fix(ci): pin standards reusables to main HEAD 257869d3
71af918 
This repo's standards reusable pins are re-pointed at the standards default-branch HEAD, resolved live at sweep time. The prior refs are recorded in the verification line below. Three kinds of drift are repaired together and the body does not claim which one this repo had: an UNREACHABLE sha kills the run at workflow STARTUP, so GitHub reports no check at all rather than a failing one and the gate disappears instead of going red; a FLOATING ref (@main) is unpinned supply chain; a merely STALE but reachable sha silently reintroduces every bug fixed since it. files=5 pins=5 perms=0 permlines=0 from=fad242d35291de1898242d6737ba02b74a59a2f2 target=257869d3

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB
@coderabbitai

coderabbitai Bot commented Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 647a046b-7d97-422b-9688-3d58c49172b3

📥 Commits

Reviewing files that changed from the base of the PR and between ef933ef and 71af918.

📒 Files selected for processing (5)
  • .github/workflows/governance.yml
  • .github/workflows/hypatia-scan.yml
  • .github/workflows/mirror.yml
  • .github/workflows/scorecard.yml
  • .github/workflows/secret-scanner.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⚠️ CI failures not shown inline (19)

GitHub Actions: Central Estate CI/CD Audit / 0_estate-audit.txt: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 Packages: read
 ##[endgroup]
 Secret source: Actions
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]The actions actions/checkout@v4 and hyperpolymath/cicd-suite/actions/required-files-check@main are not allowed in hyperpolymath/candy-crash because all actions must be pinned to a full-length commit SHA.

GitHub Actions: CodeQL Security Analysis / 0_analyze (actions, none).txt: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Load language configuration
 [command]/opt/hostedtoolcache/CodeQL/2.26.4/x64/codeql/codeql resolve languages --format=betterjson --extractor-options-verbosity=4 --extractor-include-aliases
 {
   "aliases" : {
     "c" : "cpp",
     "c++" : "cpp",
     "c-c++" : "cpp",
     "c-cpp" : "cpp",
     "c#" : "csharp",
     "java-kotlin" : "java",
     "kotlin" : "java",
     "javascript-typescript" : "javascript",
     "typescript" : "javascript"
   },
   "extractors" : {
     "java" : [
       {
         "extractor_root" : "/opt/hostedtoolcache/CodeQL/2.26.4/x64/codeql/java",
         "extractor_options" : {
           "exclude" : {
             "title" : "A glob excluding files from analysis.",
             "description" : "A glob indicating what files to exclude from the analysis. This accepts glob patterns that are supported by Java's 'getPathMatcher' implementation.\n",
             "type" : "string"
           },
           "add_prefer_source" : {
             "title" : "Whether to always prefer source files over class files.",
             "description" : "A value indicating whether source files should be preferred over class files. If set to 'true', the extraction adds '-Xprefer:source' to the javac command line. If set to 'false', the extraction uses the default javac behavior ('-Xprefer:newer'). The default is 'true'.\n",
             "type" : "string",
             "pattern" : "^(false|true)$"
           },
           "buildless" : {
             "title" : "Whether to use buildless (standalone) extraction (experimental).",
             "description" : "A value indicating, which type of extraction the autobuilder should perform. If 'true', then the standalone extractor will be used, otherwise tracing extraction will be performed. The default is 'false'. Note that buildless extraction will generally yield less accurate analysis results, and should only be used in cases where it is not possible to build the code (for example if it uses inaccessible depe...

GitHub Actions: Workflow Security Linter / 0_lint-workflows.txt: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run errors=0
 �[36;1merrors=0�[0m
 �[36;1mfor f in .github/workflows/*.yml .github/workflows/*.yaml; do�[0m
 �[36;1m  [ -f "$f" ] || continue�[0m
 �[36;1m  if ! head -1 "$f" | grep -q "SPDX-License-Identifier"; then�[0m
 �[36;1m    echo "ERROR: $f missing SPDX header"�[0m
 �[36;1m    errors=$((errors + 1))�[0m
 �[36;1m  fi�[0m
 �[36;1mdone�[0m
 �[36;1mexit $errors�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ERROR: .github/workflows/main-estate-audit.yml missing SPDX header
 ##[error]Process completed with exit code 1.

GitHub Actions: Central Estate CI/CD Audit / estate-audit: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 Packages: read
 ##[endgroup]
 Secret source: Actions
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]The actions actions/checkout@v4 and hyperpolymath/cicd-suite/actions/required-files-check@main are not allowed in hyperpolymath/candy-crash because all actions must be pinned to a full-length commit SHA.

GitHub Actions: CodeQL Security Analysis / analyze (actions, none): fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Load language configuration
 [command]/opt/hostedtoolcache/CodeQL/2.26.4/x64/codeql/codeql resolve languages --format=betterjson --extractor-options-verbosity=4 --extractor-include-aliases
 {
   "aliases" : {
     "c" : "cpp",
     "c++" : "cpp",
     "c-c++" : "cpp",
     "c-cpp" : "cpp",
     "c#" : "csharp",
     "java-kotlin" : "java",
     "kotlin" : "java",
     "javascript-typescript" : "javascript",
     "typescript" : "javascript"
   },
   "extractors" : {
     "java" : [
       {
         "extractor_root" : "/opt/hostedtoolcache/CodeQL/2.26.4/x64/codeql/java",
         "extractor_options" : {
           "exclude" : {
             "title" : "A glob excluding files from analysis.",
             "description" : "A glob indicating what files to exclude from the analysis. This accepts glob patterns that are supported by Java's 'getPathMatcher' implementation.\n",
             "type" : "string"
           },
           "add_prefer_source" : {
             "title" : "Whether to always prefer source files over class files.",
             "description" : "A value indicating whether source files should be preferred over class files. If set to 'true', the extraction adds '-Xprefer:source' to the javac command line. If set to 'false', the extraction uses the default javac behavior ('-Xprefer:newer'). The default is 'true'.\n",
             "type" : "string",
             "pattern" : "^(false|true)$"
           },
           "buildless" : {
             "title" : "Whether to use buildless (standalone) extraction (experimental).",
             "description" : "A value indicating, which type of extraction the autobuilder should perform. If 'true', then the standalone extractor will be used, otherwise tracing extraction will be performed. The default is 'false'. Note that buildless extraction will generally yield less accurate analysis results, and should only be used in cases where it is not possible to build the code (for example if it uses inaccessible depe...

GitHub Actions: Workflow Security Linter / lint-workflows: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run errors=0
 �[36;1merrors=0�[0m
 �[36;1mfor f in .github/workflows/*.yml .github/workflows/*.yaml; do�[0m
 �[36;1m  [ -f "$f" ] || continue�[0m
 �[36;1m  if ! head -1 "$f" | grep -q "SPDX-License-Identifier"; then�[0m
 �[36;1m    echo "ERROR: $f missing SPDX header"�[0m
 �[36;1m    errors=$((errors + 1))�[0m
 �[36;1m  fi�[0m
 �[36;1mdone�[0m
 �[36;1mexit $errors�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ERROR: .github/workflows/main-estate-audit.yml missing SPDX header
 ##[error]Process completed with exit code 1.

GitHub Actions: AffineScript/Deno CI / 1_build.txt: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run deno lint
 �[36;1mdeno lint�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 �[0m�[1m�[31merror�[0m: No target files found.
 ##[error]Process completed with exit code 1.

GitHub Actions: AffineScript/Deno CI / build: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run deno lint
 �[36;1mdeno lint�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 �[0m�[1m�[31merror�[0m: No target files found.
 ##[error]Process completed with exit code 1.

GitHub Actions: CI/CD Pipeline / 0_RSR Compliance Check.txt: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run echo "📚 Validating RSR documentation requirements..."
 �[36;1mecho "📚 Validating RSR documentation requirements..."�[0m
 �[36;1mrequired_docs=(�[0m
 �[36;1m  "LICENSE.txt"�[0m
 �[36;1m  "SECURITY.md"�[0m
 �[36;1m  "CONTRIBUTING.adoc"�[0m
 �[36;1m  "CODE_OF_CONDUCT.adoc"�[0m
 �[36;1m  "MAINTAINERS.adoc"�[0m
 �[36;1m  "CHANGELOG.adoc"�[0m
 �[36;1m  "FUNDING.yml"�[0m
 �[36;1m  "GOVERNANCE.adoc"�[0m
 �[36;1m  "REVERSIBILITY.adoc"�[0m
 �[36;1m  ".gitignore"�[0m
 �[36;1m  ".gitattributes"�[0m
 �[36;1m)�[0m
 �[36;1mmissing=0�[0m
 �[36;1mfor doc in "${required_docs[@]}"; do�[0m
 �[36;1m  if [ ! -f "$doc" ]; then�[0m
 �[36;1m    echo "❌ Missing: $doc"�[0m
 �[36;1m    missing=1�[0m
 �[36;1m  else�[0m
 �[36;1m    echo "✅ $doc"�[0m
 �[36;1m  fi�[0m
 �[36;1mdone�[0m
 �[36;1mif [ $missing -eq 1 ]; then�[0m
 �[36;1m  exit 1�[0m
 �[36;1mfi�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 📚 Validating RSR documentation requirements...
 ❌ Missing: LICENSE.txt
 ✅ SECURITY.md
 ✅ CONTRIBUTING.adoc
 ✅ CODE_OF_CONDUCT.adoc
 ✅ MAINTAINERS.adoc
 ✅ CHANGELOG.adoc
 ✅ FUNDING.yml
 ✅ GOVERNANCE.adoc
 ✅ REVERSIBILITY.adoc
 ✅ .gitignore
 ✅ .gitattributes
 ##[error]Process completed with exit code 1.

GitHub Actions: CI/CD Pipeline / RSR Compliance Check: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run echo "📚 Validating RSR documentation requirements..."
 �[36;1mecho "📚 Validating RSR documentation requirements..."�[0m
 �[36;1mrequired_docs=(�[0m
 �[36;1m  "LICENSE.txt"�[0m
 �[36;1m  "SECURITY.md"�[0m
 �[36;1m  "CONTRIBUTING.adoc"�[0m
 �[36;1m  "CODE_OF_CONDUCT.adoc"�[0m
 �[36;1m  "MAINTAINERS.adoc"�[0m
 �[36;1m  "CHANGELOG.adoc"�[0m
 �[36;1m  "FUNDING.yml"�[0m
 �[36;1m  "GOVERNANCE.adoc"�[0m
 �[36;1m  "REVERSIBILITY.adoc"�[0m
 �[36;1m  ".gitignore"�[0m
 �[36;1m  ".gitattributes"�[0m
 �[36;1m)�[0m
 �[36;1mmissing=0�[0m
 �[36;1mfor doc in "${required_docs[@]}"; do�[0m
 �[36;1m  if [ ! -f "$doc" ]; then�[0m
 �[36;1m    echo "❌ Missing: $doc"�[0m
 �[36;1m    missing=1�[0m
 �[36;1m  else�[0m
 �[36;1m    echo "✅ $doc"�[0m
 �[36;1m  fi�[0m
 �[36;1mdone�[0m
 �[36;1mif [ $missing -eq 1 ]; then�[0m
 �[36;1m  exit 1�[0m
 �[36;1mfi�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 📚 Validating RSR documentation requirements...
 ❌ Missing: LICENSE.txt
 ✅ SECURITY.md
 ✅ CONTRIBUTING.adoc
 ✅ CODE_OF_CONDUCT.adoc
 ✅ MAINTAINERS.adoc
 ✅ CHANGELOG.adoc
 ✅ FUNDING.yml
 ✅ GOVERNANCE.adoc
 ✅ REVERSIBILITY.adoc
 ✅ .gitignore
 ✅ .gitattributes
 ##[error]Process completed with exit code 1.

GitHub Actions: CI/CD Pipeline / 1_Code Quality.txt: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run bundle exec rubocop --parallel
 �[36;1mbundle exec rubocop --parallel�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 Could not locate Gemfile or .bundle/ directory
 ##[error]Process completed with exit code 10.

GitHub Actions: CI/CD Pipeline / Code Quality: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run bundle exec rubocop --parallel
 �[36;1mbundle exec rubocop --parallel�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 Could not locate Gemfile or .bundle/ directory
 ##[error]Process completed with exit code 10.

GitHub Actions: CI/CD Pipeline / 2_Build Container Image.txt: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run podman build -t candy-crash:test -f Containerfile .
 �[36;1mpodman build -t candy-crash:test -f Containerfile .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 [1/2] STEP 1/9: FROM cgr.dev/chainguard/wolfi-base:latest AS builder
 Trying to pull cgr.dev/chainguard/wolfi-base:latest...
 Getting image source signatures
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying config sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Writing manifest to image destination
 [1/2] STEP 2/9: RUN apk add --no-cache deno just bash
 fetch https://apk.cgr.dev/chainguard/x86_64/APKINDEX.tar.gz
 (1/5) Installing ncurses-terminfo-base (6.6.20260905-r0)
 (2/5) Installing ncurses (6.6.20260905-r0)
 (3/5) Installing bash (5.3-r13)
 (4/5) Installing deno (2.8.2-r0)
 (5/5) Installing just (1.58.0-r1)
 Executing busybox-1.38.0-r2.trigger
 OK: 161 MiB in 20 packages
 --> e68afff06605
 [1/2] STEP 3/9: WORKDIR /app
 --> e4cb1061e971
 [1/2] STEP 4/9: COPY . .
 --> 62b2abc0a1c3
 [1/2] STEP 5/9: RUN echo '{"version":"4"}' > deno.lock
 --> beec541eae66
 [1/2] STEP 6/9: RUN deno task check
 �[0m�[1m�[31merror�[0m: deno task couldn't find deno.json(c) or package.json. See https://docs.deno.com/go/config
 Error: building at STEP "RUN deno task check": while running runtime: exit status 1
 ##[error]Process completed with exit code 1.

GitHub Actions: CI/CD Pipeline / Build Container Image: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run podman build -t candy-crash:test -f Containerfile .
 �[36;1mpodman build -t candy-crash:test -f Containerfile .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 [1/2] STEP 1/9: FROM cgr.dev/chainguard/wolfi-base:latest AS builder
 Trying to pull cgr.dev/chainguard/wolfi-base:latest...
 Getting image source signatures
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying config sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Writing manifest to image destination
 [1/2] STEP 2/9: RUN apk add --no-cache deno just bash
 fetch https://apk.cgr.dev/chainguard/x86_64/APKINDEX.tar.gz
 (1/5) Installing ncurses-terminfo-base (6.6.20260905-r0)
 (2/5) Installing ncurses (6.6.20260905-r0)
 (3/5) Installing bash (5.3-r13)
 (4/5) Installing deno (2.8.2-r0)
 (5/5) Installing just (1.58.0-r1)
 Executing busybox-1.38.0-r2.trigger
 OK: 161 MiB in 20 packages
 --> e68afff06605
 [1/2] STEP 3/9: WORKDIR /app
 --> e4cb1061e971
 [1/2] STEP 4/9: COPY . .
 --> 62b2abc0a1c3
 [1/2] STEP 5/9: RUN echo '{"version":"4"}' > deno.lock
 --> beec541eae66
 [1/2] STEP 6/9: RUN deno task check
 �[0m�[1m�[31merror�[0m: deno task couldn't find deno.json(c) or package.json. See https://docs.deno.com/go/config
 Error: building at STEP "RUN deno task check": while running runtime: exit status 1
 ##[error]Process completed with exit code 1.

GitHub Actions: CI/CD Pipeline / 3_Build Assets.txt: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run bundle install
 �[36;1mbundle install�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 Could not locate Gemfile
 ##[error]Process completed with exit code 10.

GitHub Actions: CI/CD Pipeline / Build Assets: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run bundle install
 �[36;1mbundle install�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 Could not locate Gemfile
 ##[error]Process completed with exit code 10.

GitHub Actions: CI/CD Pipeline / 4_Test Suite.txt: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run bundle install
 �[36;1mbundle install�[0m
 shell: /usr/bin/bash -e {0}
 env:
   RAILS_ENV: test
   DATABASE_URL: ***localhost:5432/candy_crash_test
 ##[endgroup]
 Could not locate Gemfile
 ##[error]Process completed with exit code 10.

GitHub Actions: CI/CD Pipeline / Test Suite: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run bundle install
 �[36;1mbundle install�[0m
 shell: /usr/bin/bash -e {0}
 env:
   RAILS_ENV: test
   DATABASE_URL: ***localhost:5432/candy_crash_test
 ##[endgroup]
 Could not locate Gemfile
 ##[error]Process completed with exit code 10.

GitHub Actions: CI/CD Pipeline / Test Suite: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

Print service container logs: 0177956ba54d428bb57c559d30a27104_postgres15_049505
 ##[command]/usr/bin/docker logs --details ***REDACTED_HIGH_ENTROPY_STRING***
  The files belonging to this database system will be owned by user "postgres".
  This user must also own the server process.
  The database cluster will be initialized with locale "en_US.utf8".
  The default database encoding has accordingly been set to "UTF8".
  The default text search configuration will be set to "english".
  Data page checksums are disabled.
  fixing permissions on existing directory /var/lib/postgresql/data ... ok
  creating subdirectories ... ok
  selecting dynamic shared memory implementation ... posix
  selecting default max_connections ... 100
  selecting default shared_buffers ... 128MB
  selecting default time zone ... Etc/UTC
  creating configuration files ... ok
  running bootstrap script ... ok
  performing post-bootstrap initialization ... ok
  syncing data to disk ... ok
  Success. You can now start the database server using:
      pg_ctl -D /var/lib/postgresql/data -l logfile start
  waiting for server to start.....042 UTC [48] LOG:  starting PostgreSQL 15.19 (Debian 15.19-1.pgdg13+2) on x86_64-pc-linux-gnu, compiled by gcc (Debian 14.2.0-19) 14.2.0, 64-bit
  .042 UTC [48] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
  .045 UTC [51] LOG:  database system was shut down at  UTC
  .049 UTC [48] LOG:  database system is ready to accept connections
   done
  server started
  /usr/local/bin/docker-entrypoint.sh: ignoring /docker-entrypoint-initdb.d/*
  initdb: warning: enabling "trust" authentication for local connections
  initdb: hint: You can change this by editing pg_hba.conf or using the option -A, or --auth-local and --auth-host, the next time you run initdb.
  .278 UTC [1] LOG:  starting PostgreSQL 15.19 (Debian 15.19-1.pgdg13+2) on x86_64-pc-linux-gnu, compiled by gcc (Debian 14.2.0-19) 14.2.0, 64-bit
  .279 UTC [1] LOG:  listening on IPv4 address "0...
🔇 Additional comments (5)
.github/workflows/governance.yml (1)

17-17: LGTM!

.github/workflows/hypatia-scan.yml (1)

20-20: LGTM!

.github/workflows/mirror.yml (1)

15-15: LGTM!

.github/workflows/scorecard.yml (1)

14-14: LGTM!

.github/workflows/secret-scanner.yml (1)

20-20: LGTM!

📝 Summary

Summary by CodeRabbit

  • Chores
    • Updated the project’s automated governance, security scanning, mirroring, scorecard, and secret-scanning workflows.
    • These maintenance updates keep repository checks aligned with the latest approved workflow revisions.
    • No changes were made to public features, configuration behaviour, or user-facing functionality.

Walkthrough

The pull request updates five GitHub Actions workflows to reference reusable workflows at commit 257869d3061d5a8ed1529bf34225d90a2416d51a.

Changes

Reusable workflow pin updates

Layer / File(s) Summary
Update reusable workflow revisions
.github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/mirror.yml, .github/workflows/scorecard.yml, .github/workflows/secret-scanner.yml		 The five workflow references now use commit 257869d3061d5a8ed1529bf34225d90a2416d51a instead of the previous pinned revision.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 71af9

This updates five reusable GitHub Actions workflow references to a newer immutable standards revision without changing permissions or scheduling. The updated references remain compatible, so no merge-blocking risk is identified.

Suggested reviewers: metadatastician

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description clearly explains the five workflow pin updates, the previous and target revisions, and the reason for the change. However, it omits most required template sections, including Type of C… Rewrite the description using the repository template. Complete the required sections, mark the configuration/infrastructure change, list the five workflow updates, record testing and test results, complete applicable checklist items, and p…
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately and concisely describes the main change: pinning the standards reusable workflows to the default-branch HEAD.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Description check

Explanation

The description clearly explains the five workflow pin updates, the previous and target revisions, and the reason for the change. However, it omits most required template sections, including Type of Change, Related Issues, Changes Made, Testing, Checklist, Additional Context, and Reviewer Notes.

Resolution

Rewrite the description using the repository template. Complete the required sections, mark the configuration/infrastructure change, list the five workflow updates, record testing and test results, complete applicable checklist items, and provide issue links or state that none apply.

🤖 Coding task started

✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit checked each workflow pin
And found the newer commit within
Governance hopped, scans followed too
Mirrors and Scorecard changed their view
Secret scanning now joins the crew

Comment @coderabbitai help to get the list of available commands.

@coderabbitai

coderabbitai Bot commented Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Coding task complete — no changes needed

@hyperpolymath
hyperpolymath merged commit cb6f918 into main Sep 8, 2026
11 of 21 checks passed
@hyperpolymath
hyperpolymath deleted the fix/bump-diverged-standards-pin branch September 8, 2026 19:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath