Skip to content

ci: scan hypatia with its own main instead of a hand-bumped pin #973

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 1 commit into from
Oct 27, 2026
Merged

ci: scan hypatia with its own main instead of a hand-bumped pin #973

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions .github/workflows/governance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,13 +17,14 @@ permissions:
jobs:
governance:
uses: metadatastician/standards/.github/workflows/governance-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7
# Scanner pin, overriding the reusable's default (51ab649, which rejects the
# v0.0.3 actions.lock that gh actions-lock now writes). This is hypatia main
# with #938 (v0.0.3 lock), #942 (WH013 per-job credentials) and #947
# (RE005 trap handlers). Drop this input once the standards callers are
# re-pinned to a default that includes them.
# Scanner pin: hypatia scans itself with its own main branch. On a PR that
# is the base commit; on push, schedule or dispatch it is the commit being
# run. It is never the PR head, so a PR cannot weaken the rules that gate
# it. Each merged rule fix reaches this gate with no hand bump. If main
# ships a broken rule, the PR that fixes it can pin a known-good 40-hex
# SHA here temporarily. Other repos keep the reusable's vetted default.
with:
hypatia-ref: 23dc74de05fb34fe0e6f8d204fb65bf0625673a0
hypatia-ref: ${{ github.event.pull_request.base.sha || github.sha }}
permissions:
actions: read
contents: read
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/hypatia-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,9 @@ permissions:
jobs:
hypatia:
uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7
# Scanner pin: see governance.yml. Drop once `uses:` is re-pinned.
# Scanner pin: hypatia's own main branch, never the PR head. See governance.yml.
with:
hypatia-ref: 23dc74de05fb34fe0e6f8d204fb65bf0625673a0
hypatia-ref: ${{ github.event.pull_request.base.sha || github.sha }}
# Only the one secret the callee declares (standards#1108 §6b).
secrets:
HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }}
Loading