Skip to content

fix(ci): repin governance-reusable off phantom SHA 8f31a5a4 - #97

Merged
hyperpolymath merged 2 commits into
mainfrom
fix/repin-governance-phantom-pin-20260915
Sep 15, 2026
Merged

fix(ci): repin governance-reusable off phantom SHA 8f31a5a4#97
hyperpolymath merged 2 commits into
mainfrom
fix/repin-governance-phantom-pin-20260915

Conversation

@hyperpolymath

@hyperpolymath hyperpolymath commented Sep 15, 2026

Copy link
Copy Markdown
Owner

What

Repins this repo's governance.yml from 8f31a5a4 to da2c748a (standards main).

Why

8f31a5a4 is a phantom SHA — it does not exist in hyperpolymath/standards.
Discriminator: gh api repos/hyperpolymath/standards/compare/main...8f31a5a4 returns
404. A real-but-stale pin returns behind; only a nonexistent one 404s.

A caller pinned to a nonexistent ref cannot start. The run is created with
jobs.total_count == 0 and emits no check run at all — so the required context
governance / Code quality + docs never reports, and this repo has been reading
greener than a healthy one while its governance gate was silently absent.

Scope

Pin line only. No ruleset was edited and the required status check is unchanged.
This is plan C8 — fix the workflow, not the rule. Owner ruling R-U, 2026-09-15.

Known cosmetic defect left alone deliberately: the duplicated
# This workflow is managed by gh actions-lock. banner is a separate recorded
tool defect and is out of scope here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TCKh98NmUmfvgpuGyJbNu8

@hyperpolymath @claude
fix(ci): repin governance-reusable off a phantom SHA
5a383b3 
8f31a5a4ba591d544b65f91f6d78b136e07756f0 does not exist in hyperpolymath/standards: compare/main...8f31a5a4 returns
404, not "behind". A caller pinned to a nonexistent ref cannot start. The run is
created with jobs.total_count == 0 and emits NO check run, so the required context
"governance / Code quality + docs" never reports and the repo reads GREENER than a
healthy one.

Repinned to da2c748aad55c1a1dcba00b60fe4a35017bc6540 (standards main, 2026-09-14T20:13:37Z).

Owner ruling R-U 2026-09-15: fix the workflow, not the rule (plan C8). No ruleset
was edited; the required status check is unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TCKh98NmUmfvgpuGyJbNu8
@coderabbitai

coderabbitai Bot commented Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: e9745365-e0c5-4139-9bf2-dbc64d7808c5

📥 Commits

Reviewing files that changed from the base of the PR and between 5a383b3 and 89c8d8f.

📒 Files selected for processing (1)
  • .github/workflows/hypatia-scan.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (7)
  • GitHub Check: rust-ci / Cargo check + clippy + fmt
  • GitHub Check: rust-ci / Cargo audit (security)
  • GitHub Check: rust-ci / llvm-cov line coverage
  • GitHub Check: governance / Code quality + docs
  • GitHub Check: governance / Guix packaging policy (Nix retired)
  • GitHub Check: scan / Hypatia Neurosymbolic Analysis
  • GitHub Check: build
⚠️ CI failures not shown inline (17)

GitHub Actions: Governance / 1_governance _ Security policy checks.txt: fix(ci): repin governance-reusable off phantom SHA 8f31a5a4

Conclusion: failure

View job details

##[group]Run FAILED=false
 �[36;1mFAILED=false�[0m
 �[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
 �[36;1m  echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
 �[36;1m  echo "$WEAK_CRYPTO"�[0m
 �[36;1mfi�[0m
 �[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
 �[36;1m  echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
 �[36;1m  echo "$HTTP_URLS"�[0m
 �[36;1mfi�[0m
 �[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
 �[36;1mif [ -n "$SECRETS" ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

GitHub Actions: Governance / governance _ Security policy checks: fix(ci): repin governance-reusable off phantom SHA 8f31a5a4

Conclusion: failure

View job details

##[group]Run FAILED=false
 �[36;1mFAILED=false�[0m
 �[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
 �[36;1m  echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
 �[36;1m  echo "$WEAK_CRYPTO"�[0m
 �[36;1mfi�[0m
 �[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
 �[36;1m  echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
 �[36;1m  echo "$HTTP_URLS"�[0m
 �[36;1mfi�[0m
 �[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
 �[36;1mif [ -n "$SECRETS" ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

GitHub Actions: Governance / governance _ Security policy checks: fix(ci): repin governance-reusable off phantom SHA 8f31a5a4

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mPATTERN='^[[:space:]]*[*_]{0,2}Version[*_]{0,2}[[:space:]]*[:=][[:space:]]*v?[0-9]+\.[0-9]+\.[0-9]+'�[0m
 �[36;1mR5B=0�[0m
 �[36;1mshopt -s nullglob�[0m
 �[36;1mfor doc in *.md *.adoc; do�[0m
 �[36;1m  [ -f "$doc" ] || continue�[0m
 �[36;1m  case "$doc" in CHANGELOG.md|CHANGELOG.adoc) continue ;; esac�[0m
 �[36;1m  while IFS= read -r hit; do�[0m
 �[36;1m    [ -n "$hit" ] || continue�[0m
 �[36;1m    echo "❌ [R5b] pinned version string: $doc:$hit"�[0m
 �[36;1m    R5B=$((R5B+1))�[0m
 �[36;1m  done < <(grep -nE "$PATTERN" "$doc" 2>/dev/null || true)�[0m
 �[36;1mdone�[0m
 �[36;1mif [ "$R5B" -gt 0 ]; then�[0m
 �[36;1m  echo ""�[0m
 �[36;1m  echo "❌ [R5b] $R5B pinned version-string line(s) in load-bearing docs."�[0m
 �[36;1m  echo "Fix: drop the embedded version; defer to CHANGELOG.md (release"�[0m
 �[36;1m  echo "history) and Cargo.toml's [package].version (semver pin) or the"�[0m
 �[36;1m  echo "equivalent package manifest. Git log carries dates."�[0m
 �[36;1m  exit 1�[0m
 �[36;1mfi�[0m
 �[36;1mecho "✅ [R5b] Documentation version-string drift: clean."�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ❌ [R5b] pinned version string: PROJECT_SUMMARY.adoc:3:*Version*: 0.1.0 *Date*: 2025-11-22 *RSR Compliance*: Bronze ✅
 ❌ [R5b] 1 pinned version-string line(s) in load-bearing docs.
 Fix: drop the embedded version; defer to CHANGELOG.md (release
 history) and Cargo.toml's [package].version (semver pin) or the
 equivalent package manifest. Git log carries dates.
 ##[error]Process completed with exit code 1.

GitHub Actions: Governance / 4_governance _ Check Workflow Staleness.txt: fix(ci): repin governance-reusable off phantom SHA 8f31a5a4

Conclusion: failure

View job details

##[group]Run bash .standards-history/scripts/check-workflow-staleness.sh .
 �[36;1mbash .standards-history/scripts/check-workflow-staleness.sh .�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GITHUB_***REDACTED_SECRET_ASSIGNMENT***
   STALENESS_STANDARDS_DIR: /home/runner/work/heterogenous-mobile-computing/heterogenous-mobile-computing/.standards-history
 ##[endgroup]
 Staleness Check against Standards SHA: 874ffe5839095bd9b181eb465ec20fb473cda7c5
 Recency window: <= 50 commits behind HEAD OR <= 14 days old.
 ##[error]scorecard-reusable.yml pin 8750b94ac1bb is not a commit of hyperpolymath/standards reachable from main (confirmed against the GitHub compare API, not just this runner's clone). It may be forged, from a fork, or from rewritten history. Pin a published standards commit.

GitHub Actions: Governance / governance _ Check Workflow Staleness: fix(ci): repin governance-reusable off phantom SHA 8f31a5a4

Conclusion: failure

View job details

##[group]Run bash .standards-history/scripts/check-workflow-staleness.sh .
 �[36;1mbash .standards-history/scripts/check-workflow-staleness.sh .�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GITHUB_***REDACTED_SECRET_ASSIGNMENT***
   STALENESS_STANDARDS_DIR: /home/runner/work/heterogenous-mobile-computing/heterogenous-mobile-computing/.standards-history
 ##[endgroup]
 Staleness Check against Standards SHA: 874ffe5839095bd9b181eb465ec20fb473cda7c5
 Recency window: <= 50 commits behind HEAD OR <= 14 days old.
 ##[error]scorecard-reusable.yml pin 8750b94ac1bb is not a commit of hyperpolymath/standards reachable from main (confirmed against the GitHub compare API, not just this runner's clone). It may be forged, from a fork, or from rewritten history. Pin a published standards commit.

GitHub Actions: Governance / 6_governance _ Language _ package anti-pattern policy.txt: fix(ci): repin governance-reusable off phantom SHA 8f31a5a4

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
 �[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
 �[36;1m   && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-ts-allowlist.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: fix(ci): repin governance-reusable off phantom SHA 8f31a5a4

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
 �[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
 �[36;1m   && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-ts-allowlist.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: fix(ci): repin governance-reusable off phantom SHA 8f31a5a4

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"
 �[36;1mSCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f tools/policy/check-language-policy.sh ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-language-policy.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::language-policy gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / 10_governance _ Workflow security linter.txt: fix(ci): repin governance-reusable off phantom SHA 8f31a5a4

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

GitHub Actions: Governance / governance _ Workflow security linter: fix(ci): repin governance-reusable off phantom SHA 8f31a5a4

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

GitHub Actions: Governance / governance _ Workflow security linter: fix(ci): repin governance-reusable off phantom SHA 8f31a5a4

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1m# Standards exercises its pull-request scripts; every consumer uses�[0m
 �[36;1m# the canonical scripts fetched from this workflow's immutable�[0m
 �[36;1m# Standards revision.�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / governance _ Workflow security linter: fix(ci): repin governance-reusable off phantom SHA 8f31a5a4

Conclusion: failure

View job details

##[group]Run # Copy out and delete the checkout before scanning, so the standards
 �[36;1m# Copy out and delete the checkout before scanning, so the standards�[0m
 �[36;1m# tree is never part of the caller's workspace (same idiom as the�[0m
 �[36;1m# allowlist preflight above).�[0m
 �[36;1mcp .standards-checkout/scripts/check-action-pins-resolve.sh "$RUNNER_TEMP/"�[0m
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-action-pins-resolve.sh" .�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GH_***REDACTED_SECRET_ASSIGNMENT***
 ##[endgroup]
 Checking 6 unique action pin(s) resolve upstream…
 ##[error]1 of 6 action pin(s) DO NOT EXIST upstream.

GitHub Actions: Governance / 11_governance _ Well-Known (RFC 9116 + RSR).txt: fix(ci): repin governance-reusable off phantom SHA 8f31a5a4

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): fix(ci): repin governance-reusable off phantom SHA 8f31a5a4

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): fix(ci): repin governance-reusable off phantom SHA 8f31a5a4

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m

GitHub Actions: Governance / 13_governance _ Actions lockfile verify.txt: fix(ci): repin governance-reusable off phantom SHA 8f31a5a4

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at the explicit helper pin failed?)"�[0m

GitHub Actions: Governance / governance _ Actions lockfile verify: fix(ci): repin governance-reusable off phantom SHA 8f31a5a4

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at the explicit helper pin failed?)"�[0m
🔇 Additional comments (1)
.github/workflows/hypatia-scan.yml (1)

23-23: LGTM!

📝 Summary

Summary by CodeRabbit

  • Chores
    • Updated the governance automation workflow to use a newer pinned revision of its reusable workflow.
    • Updated the Hypatia security scanning workflow to use a newer pinned revision of its reusable workflow.
    • No changes were made to workflow triggers, permissions, or other execution logic.

Walkthrough

The governance and Hypatia security scan workflows now reference reusable workflow commit da2c748aad55c1a1dcba00b60fe4a35017bc6540.

Changes

Workflow pin updates

Layer / File(s) Summary
Update reusable workflow pins
.github/workflows/governance.yml, .github/workflows/hypatia-scan.yml		 Both workflows now use the updated pinned commit. No other workflow logic changed.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 89c8d

The updated pins restore valid reusable workflow references without introducing a merge-blocking risk.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the CI pin change and the phantom SHA that caused the issue.
Description check ✅ Passed The description accurately explains the workflow repins, the phantom SHA failure, the scope, and the related Hypatia scan update.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit checks the workflow trail
Two pinned paths now share one sail
Governance hops in place
Hypatia keeps pace
Clean commits leave a tidy trail

Comment @coderabbitai help to get the list of available commands.

coderabbitai[bot]
coderabbitai Bot previously approved these changes Sep 15, 2026
View reviewed changes
@hyperpolymath @claude
fix(ci): repin hypatia-scan.yml onto the last usable standards blob
89c8d8f 
hypatia-scan.yml called hypatia-scan-reusable.yml at cc58c0cb, which does not
resolve (422). GitHub rejected the file at parse time, so the run recorded
`failure` with zero jobs and uploaded no SARIF. The code_scanning ruleset rule
therefore waited forever for a Hypatia result that could never arrive, blocking
the PR while every required status check was green.

Repins onto da2c748a, the same blob this PR already uses for
governance-reusable.yml. The caller passes no inputs and the reusable only
input is optional with a default, so the contract is unchanged. Verified green
first on knot-rider#56, where Hypatia SARIF went from 0 to 1 analysis.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TCKh98NmUmfvgpuGyJbNu8
@sonarqubecloud

sonarqubecloud Bot commented Sep 15, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@hyperpolymath
hyperpolymath merged commit 105a061 into main Sep 15, 2026
27 of 36 checks passed
@hyperpolymath
hyperpolymath deleted the fix/repin-governance-phantom-pin-20260915 branch September 15, 2026 17:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath