fix(ci): pin standards reusables to default-branch HEAD by hyperpolymath · Pull Request #22 · hyperpolymath/glyphbase

hyperpolymath · 2026-09-09T07:35:43Z

Re-points this repo's hyperpolymath/standards reusable-workflow pins at the standards default-branch HEAD, 8f2ee50841e216cd8c192eeb68953118190f105c.

Why this is not a routine version bump. uses: org/repo/.github/workflows/x.yml@<ref> is resolved at workflow startup, so a bad ref is not a failing job — it is no job at all. This campaign repairs three kinds of drift and does not assume which one this repo had:

an unreachable sha kills the run before any job is created, so GitHub reports no check at all rather than a failing one: the gate does not go red, it disappears, and gh pr checks simply lists fewer rows. A repo in this state looks greener than one with working gates;
a floating ref such as @main runs, but unpinned — the supply-chain property the estate pins for is absent;
a stale but reachable sha runs the reusable as it was, silently reintroducing every bug fixed since it.

The refs this repo was actually pinned to, before this PR: bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 main.

Expect this PR to surface failures that main does not show. Those failures are revealed, not introduced — they are the gates resuming work after being silently absent. The honest comparison is the set of check names emitted here versus on main, not pass/fail counts. On the canary (hyperpolymath/empty-linter#79) the governance suite was absent on main and emitted 25 checks once repaired.

The target is default-branch HEAD resolved at sweep time, never a sha copied from a plan: a reachable but non-HEAD sha silently reintroduces every bug fixed since it.

Engine: .git-private-farm/scripts/smtp-notify-sweep.sh --campaign campaigns/pin-repair.sh. Verification for this repo: files=2 pins=2 perms=0 permlines=0 from=bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4,main target=8f2ee508 sig=G 55c39bb canon=a7325fbdc356 base=main

🤖 Generated with Claude Code

https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

@main

This repo's standards reusable pins are re-pointed at the standards default-branch HEAD, resolved live at sweep time. The prior refs are recorded in the verification line below. Three kinds of drift are repaired together and the body does not claim which one this repo had: an UNREACHABLE sha kills the run at workflow STARTUP, so GitHub reports no check at all rather than a failing one and the gate disappears instead of going red; a FLOATING ref (@main) is unpinned supply chain; a merely STALE but reachable sha silently reintroduces every bug fixed since it. files=2 pins=2 perms=0 permlines=0 from=bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4,main target=8f2ee508 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

coderabbitai · 2026-09-09T07:37:48Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1c7f70bd-7387-4989-b6ee-c07e0f7cb140

📥 Commits

Reviewing files that changed from the base of the PR and between 146c9e0 and 55c39bb.

📒 Files selected for processing (2)

.github/workflows/governance.yml
.github/workflows/secret-scanner.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (11)

GitHub Check: governance / Workflow security linter
GitHub Check: governance / Exemption ratchet
GitHub Check: governance / Debt ratchet
GitHub Check: governance / Live Actions policy (credentialed advisory)
GitHub Check: governance / Guix packaging policy (Nix retired)
GitHub Check: governance / Language / package anti-pattern policy
GitHub Check: governance / Code quality + docs
GitHub Check: secret-scan / gitleaks
GitHub Check: governance / Allowlist Preflight
GitHub Check: secret-scan / rust-secrets
GitHub Check: analyze (javascript-typescript, none)

⚠️ CI failures not shown inline (2)

GitHub Actions: Hypatia Security Scan / 0_Hypatia Neurosymbolic Analysis.txt: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run erlef/setup-beam@v1.17.5
 with:
   elixir-version: 1.19.4
   otp-version: 28.3
   github-***REDACTED_SECRET_ASSIGNMENT***
   install-hex: true
   install-rebar: true
   version-type: loose
   disable_problem_matchers: false
   hexpm-mirrors: https://builds.hex.pm
 ##[endgroup]
 ##[error]Tried to map a target OS from env. variable 'ImageOS' (got ubuntu24), but failed. If you're using a self-hosted runner, you should set 'env': 'ImageOS': ... to one of the following: ['ubuntu18', 'ubuntu20', 'ubuntu22', 'win19', 'win22']

GitHub Actions: Hypatia Security Scan / Hypatia Neurosymbolic Analysis: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run erlef/setup-beam@v1.17.5
 with:
   elixir-version: 1.19.4
   otp-version: 28.3
   github-***REDACTED_SECRET_ASSIGNMENT***
   install-hex: true
   install-rebar: true
   version-type: loose
   disable_problem_matchers: false
   hexpm-mirrors: https://builds.hex.pm
 ##[endgroup]
 ##[error]Tried to map a target OS from env. variable 'ImageOS' (got ubuntu24), but failed. If you're using a self-hosted runner, you should set 'env': 'ImageOS': ... to one of the following: ['ubuntu18', 'ubuntu20', 'ubuntu22', 'win19', 'win22']

🔇 Additional comments (2)

.github/workflows/governance.yml (1)

28-28: LGTM!

.github/workflows/secret-scanner.yml (1)

21-21: LGTM!

📝 Summary

Summary by CodeRabbit

Chores
- Updated automated governance checks to use a fixed, version-controlled reference for improved consistency.
- Refreshed the secret-scanning workflow to use a newer shared workflow version.
- Existing workflow triggers, permissions, concurrency settings and secret handling remain unchanged.

Walkthrough

The governance workflow now pins its shared bundle to a commit. The secret-scanner workflow now uses the same updated commit. Other workflow settings remain unchanged.

Changes

Reusable workflow pinning

Layer / File(s)	Summary
Pin shared workflow references `.github/workflows/governance.yml`, `.github/workflows/secret-scanner.yml`	The governance workflow changes from `@main` to commit `8f2ee50841e216cd8c192eeb68953118190f105c`. The secret-scanner workflow changes to the same commit.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 55c39

Governance and secret-scanning workflows now use a fixed shared-workflow revision, preventing mutable or stale references without changing triggers, permissions, concurrency, or secret inheritance. The change is ready to merge.

Suggested reviewers: metadatastician

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarises the main change: pinning standards reusable workflows to the default-branch HEAD.
Description check	✅ Passed	The description directly explains the workflow pin updates, the previous references, the target commit, and the reason for the change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🛠️ Fix failing CI checks

Create stacked PR
Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit reads each line,
The patch grows clear beneath the moon,
Small changes hop in place,
Tests guard the garden path,
Reviews bloom before the dawn.}

_{Comment @coderabbitai help to get the list of available commands.}

sonarqubecloud · 2026-09-09T07:37:58Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

coderabbitai · 2026-09-09T09:33:28Z

✅ Coding Agent task started: View task and status

The task will inspect the CI failures, validate its fix, and open a stacked fix pull request automatically.

Note: Fixing CI failures is a beta feature and may encounter errors. Expect some limitations and changes as we gather feedback and continue to improve it.

⏭️ 2 check(s) skipped — already failing on `main` (not caused by this PR)

GitHub Actions: Hypatia Security Scan / 0_Hypatia Neurosymbolic Analysis.txt
GitHub Actions: Governance / 14_governance _ Security policy checks.txt

coderabbitai Bot approved these changes Sep 9, 2026

View reviewed changes

hyperpolymath merged commit f76b3f1 into main Sep 9, 2026
22 of 24 checks passed

hyperpolymath deleted the fix/bump-diverged-standards-pin branch September 9, 2026 09:36

Navigation Menu

Uh oh!

fix(ci): pin standards reusables to default-branch HEAD - #22

fix(ci): pin standards reusables to default-branch HEAD#22
hyperpolymath merged 1 commit into
mainfrom
fix/bump-diverged-standards-pin

hyperpolymath commented Sep 9, 2026

Uh oh!

coderabbitai Bot commented Sep 9, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

sonarqubecloud Bot commented Sep 9, 2026

Uh oh!

coderabbitai Bot commented Sep 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hyperpolymath commented Sep 9, 2026

Uh oh!

coderabbitai Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

sonarqubecloud Bot commented Sep 9, 2026

Quality Gate passed

Uh oh!

coderabbitai Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Sep 9, 2026 •

edited

Loading

coderabbitai Bot commented Sep 9, 2026 •

edited

Loading