From 7d42b8c1a84642486edad19caa2fd0a760b86f26 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 13:52:48 +0000 Subject: [PATCH 1/2] fix(ci): move the scanner pin to hypatia main 23dc74d The governance and hypatia-scan callers pass hypatia-ref aa34a4c (#940), which predates the rule fixes that clear this repository's own false positives: - #942: WH013 judges writes per job and skips PAT and app-token writes (estate-rescan, inbox-steward-intake). - #947: RE005 skips trap handlers, and job extraction survives comments between jobs. Moving the pin to main 23dc74d puts them in the baseline gate. The jump also brings #931's new rules (WF026, WF027, PIN-003); this PR's governance run is the first measurement of them on this repository. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM --- .github/workflows/governance.yml | 9 +++++---- .github/workflows/hypatia-scan.yml | 2 +- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index a04c0675..416ab42c 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -18,11 +18,12 @@ jobs: governance: uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 # Scanner pin, overriding the reusable's default (51ab649, which rejects the - # v0.0.3 actions.lock that gh actions-lock now writes). aa34a4c carries - # #938. Same value as standards#1315; drop this input once the `uses:` above - # is re-pinned past that PR. + # v0.0.3 actions.lock that gh actions-lock now writes). This is hypatia main + # with #938 (v0.0.3 lock), #942 (WH013 per-job credentials) and #947 + # (RE005 trap handlers). Drop this input once the standards callers are + # re-pinned to a default that includes them. with: - hypatia-ref: aa34a4cc6ba39d873710ff39763fdb9cde715f9d + hypatia-ref: 23dc74de05fb34fe0e6f8d204fb65bf0625673a0 permissions: actions: read contents: read diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 4739c432..68477449 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -24,7 +24,7 @@ jobs: uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 # Scanner pin: see governance.yml. Drop once `uses:` is re-pinned. with: - hypatia-ref: aa34a4cc6ba39d873710ff39763fdb9cde715f9d + hypatia-ref: 23dc74de05fb34fe0e6f8d204fb65bf0625673a0 # Only the one secret the callee declares (standards#1108 ยง6b). secrets: HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }} From b8c8934689427f08a92cdf6e0c38ae214117c97c Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 14:14:52 +0000 Subject: [PATCH 2/2] fix(ci): port #948, dropping harden-runner until actions.lock records it `governance / Actions lockfile verify` fails on this PR, and on main since #945. Of the verifier's findings, only the three `step-security/harden-runner@v2.22.2` "not-pinned" records are not accepted by standards' wrapper. #948 removes those steps. This is the same three-file change; it no-ops once #948 (or a lock regeneration) lands on main. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM --- .github/workflows/ci-health-sweep.yml | 8 -------- .github/workflows/dependabot-automerge.yml | 8 -------- .github/workflows/roadmap-sync.yml | 8 -------- 3 files changed, 24 deletions(-) diff --git a/.github/workflows/ci-health-sweep.yml b/.github/workflows/ci-health-sweep.yml index 3d705b66..c26d8ecc 100644 --- a/.github/workflows/ci-health-sweep.yml +++ b/.github/workflows/ci-health-sweep.yml @@ -45,14 +45,6 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - # Egress allowlist (RE001): this job talks only to the GitHub API. - - name: Harden runner - uses: step-security/harden-runner@v2.22.2 - with: - egress-policy: block - allowed-endpoints: > - api.github.com:443 - github.com:443 - uses: actions/checkout@v7.0.1 - name: Run CI-health sweep env: diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index d1875204..86842d10 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -62,14 +62,6 @@ jobs: pull-requests: write # needed to approve steps: - # Egress allowlist (RE001): this job talks only to the GitHub API. - - name: Harden runner - uses: step-security/harden-runner@v2.22.2 - with: - egress-policy: block - allowed-endpoints: > - api.github.com:443 - github.com:443 - name: Fetch Dependabot metadata id: meta uses: dependabot/fetch-metadata@v3.1.0 diff --git a/.github/workflows/roadmap-sync.yml b/.github/workflows/roadmap-sync.yml index ea784ee8..eae7a233 100644 --- a/.github/workflows/roadmap-sync.yml +++ b/.github/workflows/roadmap-sync.yml @@ -46,14 +46,6 @@ jobs: EXCLUDE: 'idaptik burble rattlescript vcl-ut' WINDOW_MIN: ${{ inputs.window_min || '45' }} # look-back window (> cron interval for overlap) steps: - # Egress allowlist (RE001): this job talks only to the GitHub API. - - name: Harden runner - uses: step-security/harden-runner@v2.22.2 - with: - egress-policy: block - allowed-endpoints: > - api.github.com:443 - github.com:443 - name: Mint App installation token id: app uses: actions/create-github-app-token@v3.3.0