chore(ci): bump governance-reusable pin to standards main

[hyperpolymath]

Pinned revision 7fdc2705 of governance-reusable.yml carries two bugs that make Governance red on every consumer:

1. Workflow security linter runs bash scripts/update-actions-lock.sh --verify-local in the caller's checkout, where the script does not exist — exit 127.
2. Allowlist Preflight runs check-actions-policy.sh with an empty GH_TOKEN — gh refuses, exit 3.

Both are cured on standards main (fad242d35291de1898242d6737ba02b74a59a2f2): the verifier is copied into \$RUNNER_TEMP, and the policy step is skipped when no credential is supplied.

Witness: verified green on hyperpolymath/blocky-writer#55 at this exact SHA — governance run completed/success, 15/15 jobs, including the two jobs that were red on that repo's default branch.

Judge this PR by the set difference against your own default branch (which governance jobs are newly red), not by overall check colour — unrelated build failures may pre-date it.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 586acf27-6ba5-48aa-a156-9d832595ef83

📥 Commits

Reviewing files that changed from the base of the PR and between 5873c19 and f6d7bac.

📒 Files selected for processing (1)

• .github/workflows/governance.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (11)

• GitHub Check: rust-ci / Detect Cargo.toml
• GitHub Check: Bench — Type System Performance
• GitHub Check: Validate eclexiaiser manifest
• GitHub Check: Aspect — Safety Invariants
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Groove manifest check
• GitHub Check: Validate A2ML manifests
• GitHub Check: E2E — Full Pipeline + Integration
• GitHub Check: analyze (actions, none)
• GitHub Check: idris2 --check (ABI proof modules)
• GitHub Check: Validate K9 contracts

🔇 Additional comments (1)

.github/workflows/governance.yml (1)

34-34: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the governance workflow reference to a newer approved version.

Walkthrough

The governance job now references commit fad242d35291de1898242d6737ba02b74a59a2f2 of the shared reusable governance workflow instead of commit 7fdc2705df74b4e352d2a1cde3e87a5923fdf329.

Changes

Governance workflow

Layer / File(s)	Summary
Update reusable workflow pin .github/workflows/governance.yml	The governance job uses the new pinned commit for the shared reusable workflow.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to f6d7b

The governance workflow now uses the updated pinned shared workflow revision, including its verifier execution and credential-aware preflight fixes. The change is ready to merge with no identified current-head risk.

Poem

A rabbit checks the workflow pin
One commit out, one commit in
The governance path stays neat
Pinned and ready, safe to greet
Ears up high, the checks repeat

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the change, rationale, affected failures, and verification result. However, it omits the required template sections, checklist status, testing section, and applicable change d…	Rewrite the description using the repository template. Complete the Summary, Changes, RSR Quality Checklist, and Testing sections. Add Screenshots output if applicable, and mark each checklist item accurately.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: updating the governance reusable workflow pin.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the change, rationale, affected failures, and verification result. However, it omits the required template sections, checklist status, testing section, and applicable change details.

• Fix all pre-merge checks with AI

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hyperpolymath]

Superseded by #54, which landed the same governance-reusable pin bump plus the hypatia-scan/mirror/scorecard/secret-scanner/rust-ci repins to standards main HEAD and the actions: read grant. Closing without merge.