Skip to content

fix(ci): restore reachable standards workflow pins - #82

Merged
hyperpolymath merged 1 commit into
mainfrom
fix/restore-reachable-standards-pin
Sep 8, 2026
Merged

fix(ci): restore reachable standards workflow pins#82
hyperpolymath merged 1 commit into
mainfrom
fix/restore-reachable-standards-pin

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Replace the unreachable standards reusable-workflow commit 7fdc2705df74b4e352d2a1cde3e87a5923fdf329 with reachable standards main commit 092dedada188f56c5915f74a5fd40aac093742c3. The old SHA is an intermediate commit from squash-merged standards PR #596: it exists, but GitHub rejects it for cross-repository reusable workflows before creating jobs. This restores Hypatia/SARIF and the other affected workflows without weakening SHA pinning or branch protection. Estate incident: 251 active workflow files across 70 repositories in hyperpolymath and metadatastician.

@coderabbitai

coderabbitai Bot commented Sep 4, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 6bf796aa-cd45-4572-982b-9514204d2d9b

📥 Commits

Reviewing files that changed from the base of the PR and between 16b0d8a and 8f6d1ee.

📒 Files selected for processing (5)
  • .github/workflows/governance.yml
  • .github/workflows/hypatia-scan.yml
  • .github/workflows/mirror.yml
  • .github/workflows/scorecard.yml
  • .github/workflows/secret-scanner.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (9)
  • GitHub Check: scan / gitleaks
  • GitHub Check: scan / rust-secrets
  • GitHub Check: scan / shell-secrets
  • GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
  • GitHub Check: Empty-linter (invisible characters)
  • GitHub Check: Groove manifest check
  • GitHub Check: Validate A2ML manifests
  • GitHub Check: analyze (actions, none)
  • GitHub Check: Validate K9 contracts
🔇 Additional comments (5)
.github/workflows/governance.yml (1)

34-34: LGTM!

.github/workflows/hypatia-scan.yml (1)

29-29: LGTM!

.github/workflows/mirror.yml (1)

15-15: LGTM!

.github/workflows/scorecard.yml (1)

13-13: LGTM!

.github/workflows/secret-scanner.yml (1)

22-22: LGTM!


📝 Summary

Summary by CodeRabbit

  • Security & Maintenance
    • Updated pinned versions of the reusable governance, security scanning, supply-chain security, and mirroring workflows.
    • No changes to workflow permissions, schedules, or other configuration behaviour.

Walkthrough

Five GitHub Actions workflows now pin their reusable workflow references to commit 092dedada188f56c5915f74a5fd40aac093742c3. No workflow logic, permissions, or schedules changed.

Changes

Reusable workflow pin alignment

Layer / File(s) Summary
Repin reusable workflows
.github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/mirror.yml, .github/workflows/scorecard.yml, .github/workflows/secret-scanner.yml
The five workflow references now use commit 092dedada188f56c5915f74a5fd40aac093742c3 instead of the previous commit.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 8f6d1

This restores the affected reusable GitHub Actions workflows by replacing an unreachable pinned standards commit with a reachable pinned commit. No remaining merge-readiness risk is identified.

Poem

A rabbit checks each workflow pin
The newer commit hops in
Governance, scans, and mirrors align
Scorecards and secrets follow the line
Five small updates, neat and bright

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the CI fix and the restoration of reachable standards workflow pins.
Description check ✅ Passed The description directly explains the SHA replacement, the affected workflows, and the reason for the change.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@sonarqubecloud

sonarqubecloud Bot commented Sep 4, 2026

Copy link
Copy Markdown

@hyperpolymath
hyperpolymath merged commit fa631d5 into main Sep 8, 2026
16 checks passed
@hyperpolymath
hyperpolymath deleted the fix/restore-reachable-standards-pin branch September 8, 2026 07:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant