From dac2e36214fee13b85394bffdc6b0326f9ef0d63 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 12:07:43 +0000 Subject: [PATCH 1/5] fix(ci): re-pin standards reusables and repair actions.lock GitHub now enforces the actions lockfile for reusable-workflow callers. The lock had no record for hyperpolymath/standards, so every caller failed at startup with "invalid lockfile pin". Moves the seven standards pins (codeql, governance, hypatia-scan, mirror, rust-ci, scorecard, secret-scanner) to 75bd5994 and regenerates the lock with the estate repair chain (relock-sha-keys, complete-job-refs including the standards#1294 case fix, close-lock, prune-stale). The standards record carries the 13 nested uses its reusables reach, identical to the relock on proof-burrower#116, where all callers went green. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- .github/workflows/actions.lock | 105 +++++++++++++++++++++++++-- .github/workflows/codeql.yml | 2 +- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 8 files changed, 105 insertions(+), 14 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 4faf683..5b32c63 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -19,7 +19,8 @@ workflows: - 'google/clusterfuzzlite@v1' '.github/workflows/cflite_pr.yml': - 'google/clusterfuzzlite@v1' - '.github/workflows/codeql.yml': [] + '.github/workflows/codeql.yml': + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/container.yml': - 'actions/attest-build-provenance@v4.2.2' - 'actions/checkout@v7.0.1' @@ -46,11 +47,14 @@ workflows: - 'swatinem/rust-cache@v2.9.2' '.github/workflows/echidnabot.yml': - 'actions/checkout@v7.0.1' - '.github/workflows/governance.yml': [] - '.github/workflows/hypatia-scan.yml': [] + '.github/workflows/governance.yml': + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + '.github/workflows/hypatia-scan.yml': + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/label-triage.yml': [] '.github/workflows/labels.yml': [] - '.github/workflows/mirror.yml': [] + '.github/workflows/mirror.yml': + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/openssf-compliance.yml': - 'actions/checkout@v7.0.1' '.github/workflows/proof-safety.yml': @@ -71,9 +75,12 @@ workflows: - 'softprops/action-gh-release@v3.0.3' '.github/workflows/rhodibot.yml': - 'actions/checkout@v7.0.1' - '.github/workflows/rust-ci.yml': [] - '.github/workflows/scorecard.yml': [] - '.github/workflows/secret-scanner.yml': [] + '.github/workflows/rust-ci.yml': + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + '.github/workflows/scorecard.yml': + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + '.github/workflows/secret-scanner.yml': + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/static-analysis-gate.yml': - 'actions/checkout@v7.0.1' - 'actions/download-artifact@v8.0.2' @@ -97,11 +104,21 @@ dependencies: commit: 'sha1-508db95dd578ae2727ebd6217d5ba78e4fbda05d' owner_id: 44036562 repo_id: 760701061 + 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9': + ref: 'v6.1.0' + commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' + owner_id: 44036562 + repo_id: 215566462 'actions/cache@v6.1.0': ref: 'v6.1.0' commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' owner_id: 44036562 repo_id: 215566462 + 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 'actions/checkout@v7.0.1': ref: 'v7.0.1' commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' @@ -127,6 +144,11 @@ dependencies: commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' owner_id: 44036562 repo_id: 192625955 + 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9': + ref: 'v7.0.2' + commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' + owner_id: 44036562 + repo_id: 192625955 'actions/upload-artifact@v7.0.2': ref: 'v7.0.2' commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' @@ -139,6 +161,11 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed': + ref: 'v2.0.5' + commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' + owner_id: 42048915 + repo_id: 356423100 'dependabot/fetch-metadata@v3.1.0': ref: 'v3.1.0' commit: 'sha1-25dd0e34f4fe68f24cc83900b1fe3fe149efef98' @@ -164,33 +191,97 @@ dependencies: commit: 'sha1-f87e5991a6d7451dcb8d9637bfbc97413f497069' owner_id: 5429470 repo_id: 288485773 + 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f': + ref: 'v1' + commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + owner_id: 1940490 + repo_id: 260749683 'dtolnay/rust-toolchain@v1': ref: 'v1' commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de' owner_id: 1940490 repo_id: 260749683 + 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393': + ref: 'v3.0.0' + commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393' + owner_id: 26415196 + repo_id: 297874902 + 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124': + ref: 'v1.24.1' + commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' + owner_id: 47606891 + repo_id: 331103973 'erlef/setup-beam@v1.24.1': ref: 'v1.24.1' commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' owner_id: 47606891 repo_id: 331103973 + 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63': + ref: 'v4.38.0' + commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' + owner_id: 9919 + repo_id: 259445878 'google/clusterfuzzlite@v1': ref: 'v1' commit: 'sha1-884713a6c30a92e5e8544c39945cd7cb630abcd1' owner_id: 1342004 repo_id: 400046858 + 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406': + ref: 'v2.2.1' + commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406' + owner_id: 1006268 + repo_id: 212984112 'haskell-actions/setup@v2.12.1': ref: 'v2.12.1' commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d' owner_id: 75048950 repo_id: 623796603 + 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': + ref: '75bd5994470661a099df562d6d5ad2fe744dbd66' + commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66' + owner_id: 6759885 + repo_id: 1116521501 + uses: + - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' + - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' + - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' + - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393' + - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' + - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' + - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406' + - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' + - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6' + - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' + 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': + ref: 'v2.4.4' + commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' + owner_id: 67707773 + repo_id: 421101922 + 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6': + ref: 'v2.2.0' + commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6' + owner_id: 108928776 + repo_id: 512644635 'softprops/action-gh-release@v3.0.3': ref: 'v3.0.3' commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64' owner_id: 2242 repo_id: 204253808 + 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6': + ref: 'v2.9.2' + commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + owner_id: 580492 + repo_id: 298565987 'swatinem/rust-cache@v2.9.2': ref: 'v2.9.2' commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' owner_id: 580492 repo_id: 298565987 + 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555': + ref: 'v0.10.0' + commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555' + owner_id: 135788 + repo_id: 208510314 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1fdfc72..fa515d1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -30,5 +30,5 @@ jobs: permissions: contents: read security-events: write - uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 # main as of 2026-06-01 + uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main as of 2026-06-01 secrets: inherit diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 08a6a9c..e3fca16 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -16,4 +16,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@fad242d35291de1898242d6737ba02b74a59a2f2 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index ecb1f0e..9f6081d 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -18,4 +18,4 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 55ff19a..354a178 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -10,5 +10,5 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 # main 2026-05-30 (Radicle + Instant-Sync secret-presence gating #305) + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-05-30 (Radicle + Instant-Sync secret-presence gating #305) secrets: inherit diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 5fb7aca..ad877cb 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -13,7 +13,7 @@ permissions: contents: read jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@412a7031577112b31ee287cc6060179d638d6500 # main 2026-05-31 (CI/CD campaigns C001-C005) + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-05-31 (CI/CD campaigns C001-C005) # The crate's library suite is known to hang past 20 minutes. Keep the # ordinary PR gate aligned with publish.yml: run every named integration # suite explicitly while the library-test deadlock is tracked separately. diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index f751176..d49f441 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -13,7 +13,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 permissions: contents: read security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 3f27a16..872d3ca 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -25,5 +25,5 @@ jobs: scan: permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586 # main as of 2026-06-01 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main as of 2026-06-01 secrets: inherit From 743bc81e690cfd46499ed053408d388ad0cc0a81 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 12:15:42 +0000 Subject: [PATCH 2/5] fix(dev-stub): drop the nil UUID from the canned verify response The governance UUID gates (check-uuid-v8.sh, v7 and strict v8) reject the nil-UUID literal in contrib/echidna-stub/responses/verify.json. The gates only started reporting it once the actions.lock repair let the governance reusable run. The stub's job_id is opaque: no echidnabot code parses it, and it already carried a stub- prefix, so it is now a plain label. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- contrib/echidna-stub/responses/verify.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contrib/echidna-stub/responses/verify.json b/contrib/echidna-stub/responses/verify.json index ae4a50f..49cdfbb 100644 --- a/contrib/echidna-stub/responses/verify.json +++ b/contrib/echidna-stub/responses/verify.json @@ -1,5 +1,5 @@ { - "job_id": "stub-00000000-0000-0000-0000-000000000000", + "job_id": "stub-job-dev", "status": "succeeded", "prover": "coq", "verified_files": ["stub.v"], From bbb4bcfbc8d449f76e0bfcf87c1f4b1026543bae Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 13:01:59 +0000 Subject: [PATCH 3/5] fix(ci): pass the re-pinned standards reusables only the secrets they declare At 75bd5994 the secret-scanner, scorecard and codeql reusables declare no workflow_call secrets, mirror declares seven optional forge keys, and hypatia-scan declares only HYPATIA_SCAN_PAT. `secrets: inherit` forwarded every repository and organisation secret regardless. Drop it where nothing is declared, map the declared keys explicitly elsewhere, and grant the scorecard caller `actions: read`, which the reusable needs for the Packaging check and cannot raise itself. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- .github/workflows/codeql.yml | 1 - .github/workflows/mirror.yml | 9 ++++++++- .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 - 4 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index fa515d1..273d224 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,4 +31,3 @@ jobs: contents: read security-events: write uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main as of 2026-06-01 - secrets: inherit diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 354a178..ba952c2 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -11,4 +11,11 @@ permissions: jobs: mirror: uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-05-30 (Radicle + Instant-Sync secret-presence gating #305) - secrets: inherit + secrets: + GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} + BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} + CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }} + SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }} + DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }} + GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }} + RADICLE_KEY: ${{ secrets.RADICLE_KEY }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index d49f441..357a555 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -15,6 +15,7 @@ jobs: scorecard: uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 permissions: + actions: read contents: read security-events: write id-token: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 872d3ca..6cbcb7d 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -26,4 +26,3 @@ jobs: permissions: contents: read uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main as of 2026-06-01 - secrets: inherit From 8f6e54b606858f6ed30b6ada53cc84beb9980a73 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 16:34:40 +0000 Subject: [PATCH 4/5] fix(ci): move standards pins to 740c9d7d and bump rustls to 0.23.46 The standards commit now carries #1297 (gitleaks fetches the estate baseline only when the repo has no .gitleaks.toml) and #1299 (js-runtimes is its own workspace root). The lock is relocked with relock-standards-pin.sh and close-lock.sh, never by hand; the standards record picks up the reusables' new nested pins (rust-toolchain, scorecard-action v2.5.0). check-lock-sync passes. rustls 0.23.46 fixes RUSTSEC-2026-0346/0347/0348/0349. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- .github/workflows/actions.lock | 34 ++++++++++++++-------------- .github/workflows/codeql.yml | 2 +- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- Cargo.lock | 4 ++-- 9 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 5b32c63..67fea36 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -20,7 +20,7 @@ workflows: '.github/workflows/cflite_pr.yml': - 'google/clusterfuzzlite@v1' '.github/workflows/codeql.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@740c9d7d4ed4d1f319a04c92b28218beb75668d7' '.github/workflows/container.yml': - 'actions/attest-build-provenance@v4.2.2' - 'actions/checkout@v7.0.1' @@ -48,13 +48,13 @@ workflows: '.github/workflows/echidnabot.yml': - 'actions/checkout@v7.0.1' '.github/workflows/governance.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@740c9d7d4ed4d1f319a04c92b28218beb75668d7' '.github/workflows/hypatia-scan.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@740c9d7d4ed4d1f319a04c92b28218beb75668d7' '.github/workflows/label-triage.yml': [] '.github/workflows/labels.yml': [] '.github/workflows/mirror.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@740c9d7d4ed4d1f319a04c92b28218beb75668d7' '.github/workflows/openssf-compliance.yml': - 'actions/checkout@v7.0.1' '.github/workflows/proof-safety.yml': @@ -76,11 +76,11 @@ workflows: '.github/workflows/rhodibot.yml': - 'actions/checkout@v7.0.1' '.github/workflows/rust-ci.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@740c9d7d4ed4d1f319a04c92b28218beb75668d7' '.github/workflows/scorecard.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@740c9d7d4ed4d1f319a04c92b28218beb75668d7' '.github/workflows/secret-scanner.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@740c9d7d4ed4d1f319a04c92b28218beb75668d7' '.github/workflows/static-analysis-gate.yml': - 'actions/checkout@v7.0.1' - 'actions/download-artifact@v8.0.2' @@ -191,9 +191,9 @@ dependencies: commit: 'sha1-f87e5991a6d7451dcb8d9637bfbc97413f497069' owner_id: 5429470 repo_id: 288485773 - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f': + 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8': ref: 'v1' - commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8' owner_id: 1940490 repo_id: 260749683 'dtolnay/rust-toolchain@v1': @@ -236,9 +236,9 @@ dependencies: commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d' owner_id: 75048950 repo_id: 623796603 - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': - ref: '75bd5994470661a099df562d6d5ad2fe744dbd66' - commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66' + 'hyperpolymath/standards@740c9d7d4ed4d1f319a04c92b28218beb75668d7': + ref: '740c9d7d4ed4d1f319a04c92b28218beb75668d7' + commit: 'sha1-740c9d7d4ed4d1f319a04c92b28218beb75668d7' owner_id: 6759885 repo_id: 1116521501 uses: @@ -246,18 +246,18 @@ dependencies: - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' - - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8' - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393' - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406' - - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' + - 'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e' - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6' - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': - ref: 'v2.4.4' - commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' + 'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e': + ref: 'v2.5.0' + commit: 'sha1-fa7117db83c52d787ae5a89f350999701505d78e' owner_id: 67707773 repo_id: 421101922 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6': diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 273d224..fef3892 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -30,4 +30,4 @@ jobs: permissions: contents: read security-events: write - uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main as of 2026-06-01 + uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main as of 2026-06-01 diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index e3fca16..5bca36a 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -16,4 +16,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 9f6081d..096f07b 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -18,4 +18,4 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index ba952c2..f34854f 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -10,7 +10,7 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-05-30 (Radicle + Instant-Sync secret-presence gating #305) + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main 2026-05-30 (Radicle + Instant-Sync secret-presence gating #305) secrets: GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index ad877cb..133fbd4 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -13,7 +13,7 @@ permissions: contents: read jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main 2026-05-31 (CI/CD campaigns C001-C005) + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main 2026-05-31 (CI/CD campaigns C001-C005) # The crate's library suite is known to hang past 20 minutes. Keep the # ordinary PR gate aligned with publish.yml: run every named integration # suite explicitly while the library-test deadlock is tracked separately. diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 357a555..01b7929 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -13,7 +13,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 permissions: actions: read contents: read diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 6cbcb7d..e1e065c 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -25,4 +25,4 @@ jobs: scan: permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # main as of 2026-06-01 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main as of 2026-06-01 diff --git a/Cargo.lock b/Cargo.lock index d351df4..e68596c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3502,9 +3502,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "log", "once_cell", From 92f713c87790f1b9e48859ab964bfeeace457da3 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 16:48:44 +0000 Subject: [PATCH 5/5] fix(ci): grant actions: read to the codeql, hypatia-scan and mirror callers The reusables at 740c9d7d request actions: read, and a called workflow cannot raise its caller's token. CodeQL Security Analysis and Hypatia Security Scan hit startup_failure on 8f6e54b, which no check run shows. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --- .github/workflows/codeql.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/mirror.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index fef3892..af3eeaa 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -28,6 +28,7 @@ permissions: jobs: analyze: permissions: + actions: read contents: read security-events: write uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main as of 2026-06-01 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 096f07b..4756b4a 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -13,6 +13,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read security-events: write diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index f34854f..0586a77 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -7,6 +7,7 @@ on: branches: [main] workflow_dispatch: permissions: + actions: read contents: read jobs: mirror: