From f8ca8a9fd5ef63f6d30fe30fad7ec0b392df8f30 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 23:34:09 +0000 Subject: [PATCH 1/2] ci: re-pin the standards callers to 75bd599 and relock (invalid lockfile pin) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Since 2026-10-15/16, every job in a januskey workflow that calls a standards reusable has died in "Set up job" with no code change on this side: Unable to resolve action `actions/checkout@3d3c42e5…`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile The same commit, 69de917, was green on 2026-10-14 and red on 2026-10-19. Cause: GitHub resolves a called reusable workflow's actions against the CALLEE repository's actions.lock at the called SHA. It now rejects an action record whose `ref:` is the record's own commit SHA. standards at 7d2041a (the old pin) recorded actions/checkout@3d3c42e5… with `ref: '3d3c42e5…'`. standards #1271 (2026-10-16) and #1285 repaired its own lock. Evidence: - standards/scripts/lock-selfcheck.sh reports 7d2041a POISON (73 self-SHA refs, checkout@3d3c42e5 among them) and 75bd599 SELF-CONSISTENT. - cicd-squabbler hit the same error on the same day. Re-pinned to 75bd599, its Rust CI, Governance, Hypatia, Secret Scanner and Scorecard callers run green. Generated with the estate tooling, not edited by hand: standards/scripts/propagate-workflow-pins.sh --fix --to 75bd599 which runs relock-standards-pin.sh. That rebuilds the hyperpolymath/standards@75bd599 record from what the seven reusables use at 75bd599, and refreshes leaf refs from standards' own lock: cache, upload-artifact, rust-toolchain, editorconfig-checker, codeql-action and setup-zig get tag refs. relock-standards-pin.sh had a case-folding bug that wrote a second swatinem/rust-cache record. GitHub's lockfile parser rejects that duplicate ("duplicate action key ... after canonicalization"). This lock was generated with that bug fixed (standards PR on the same branch name). The reusables' workflow_call interfaces and permissions match between 7d2041a and 75bd599. The only change is an optional HYPATIA_SCAN_PAT secret on hypatia-scan; this caller passes `secrets: inherit`. Checks run locally: - github/actions-lockfile v0.0.6 Parse: OK. Before: OK. After the buggy relock: duplicate-key error. - standards check-lock-sync.sh: in sync. - standards .githooks/validate-actions-lock.sh: one remaining finding, the self-SHA ref on hyperpolymath/cicd-squabbler@b34cd53. Not fixed here; see the PR. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_013CuBToxr5h9catptGiTsFX --- .github/workflows/actions.lock | 52 +++++++++++++++++----------- .github/workflows/codeql.yml | 4 +-- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 8 files changed, 40 insertions(+), 28 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index bc7938f..f70c533 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -15,7 +15,7 @@ workflows: - 'actions/upload-pages-artifact@v5.0.0' - 'haskell-actions/setup@v2.12.1' '.github/workflows/codeql.yml': - - 'hyperpolymath/standards@7d2041a2315572d8257341449257e6cfddc9aebc' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/dashboard-check.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' @@ -30,9 +30,9 @@ workflows: - 'dtolnay/rust-toolchain@v1' - 'swatinem/rust-cache@v2.9.2' '.github/workflows/governance.yml': - - 'hyperpolymath/standards@7d2041a2315572d8257341449257e6cfddc9aebc' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/hypatia-scan.yml': - - 'hyperpolymath/standards@7d2041a2315572d8257341449257e6cfddc9aebc' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/idris-abi.yml': - 'actions/checkout@v7.0.1' '.github/workflows/label-triage.yml': [] @@ -41,17 +41,22 @@ workflows: - 'actions/checkout@v7.0.1' - 'hyperpolymath/cicd-suite@main' '.github/workflows/mirror.yml': - - 'hyperpolymath/standards@7d2041a2315572d8257341449257e6cfddc9aebc' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/rust-ci.yml': - - 'hyperpolymath/standards@7d2041a2315572d8257341449257e6cfddc9aebc' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/scorecard.yml': - - 'hyperpolymath/standards@7d2041a2315572d8257341449257e6cfddc9aebc' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/secret-scanner.yml': - - 'hyperpolymath/standards@7d2041a2315572d8257341449257e6cfddc9aebc' + - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/squabble.yml': - 'actions/checkout@v7.0.1' - 'hyperpolymath/cicd-squabbler@b34cd53f9157d1b8a4f9c5c8d843846557f8622c' dependencies: + 'Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6': + ref: 'v2' + commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' + owner_id: 580492 + repo_id: 298565987 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9': ref: 'v6.1.0' commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9' @@ -88,7 +93,7 @@ dependencies: owner_id: 44036562 repo_id: 192625955 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9': - ref: 'cf430e030ddbb5b0abf93d22962f4752f3646cd9' + ref: 'v7.0.2' commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' owner_id: 44036562 repo_id: 192625955 @@ -99,13 +104,18 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed': + ref: 'v2.0.5' + commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' + owner_id: 42048915 + repo_id: 356423100 'dependabot/fetch-metadata@v3.1.0': ref: 'v3.1.0' commit: 'sha1-25dd0e34f4fe68f24cc83900b1fe3fe149efef98' owner_id: 27347476 repo_id: 371068214 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f': - ref: 'e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + ref: 'v1' commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f' owner_id: 1940490 repo_id: 260749683 @@ -115,7 +125,7 @@ dependencies: owner_id: 1940490 repo_id: 260749683 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393': - ref: '51f63319f592f97930c73d9c46184d20bd206393' + ref: 'v3.0.0' commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393' owner_id: 26415196 repo_id: 297874902 @@ -125,12 +135,12 @@ dependencies: owner_id: 47606891 repo_id: 331103973 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63': - ref: 'b96794f015dfd88f77b49b1c93e0fa7110f94c63' + ref: 'v4.38.0' commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' owner_id: 9919 repo_id: 259445878 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406': - ref: 'abea47f85e598557f500fa1fd2ab7464fcb39406' + ref: 'v2.2.1' commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406' owner_id: 1006268 repo_id: 212984112 @@ -172,21 +182,23 @@ dependencies: commit: 'sha1-c1a34884054fabf0e9de81dbf68f4ba7874e85f1' owner_id: 6759885 repo_id: 1275650185 - 'hyperpolymath/standards@7d2041a2315572d8257341449257e6cfddc9aebc': - ref: '7d2041a2315572d8257341449257e6cfddc9aebc' - commit: 'sha1-7d2041a2315572d8257341449257e6cfddc9aebc' + 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': + ref: '75bd5994470661a099df562d6d5ad2fe744dbd66' + commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66' owner_id: 6759885 repo_id: 1116521501 uses: - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' + - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f' - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393' - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406' - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' + - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6' - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': @@ -194,11 +206,11 @@ dependencies: commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' owner_id: 67707773 repo_id: 421101922 - 'Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6': - ref: 'v2' - commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' - owner_id: 580492 - repo_id: 298565987 + 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6': + ref: 'v2.2.0' + commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6' + owner_id: 108928776 + repo_id: 512644635 'swatinem/rust-cache@v2.9.2': ref: 'v2.9.2' commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 383114c..f0f1f21 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,10 +32,10 @@ permissions: jobs: codeql-actions: - uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@7d2041a2315572d8257341449257e6cfddc9aebc # standards main, 2026-10-13 + uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # standards main, 2026-10-19 with: language: actions codeql-rust: - uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@7d2041a2315572d8257341449257e6cfddc9aebc # standards main, 2026-10-13 + uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # standards main, 2026-10-19 with: language: rust diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 5be3b35..c95d6ea 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -34,7 +34,7 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7d2041a2315572d8257341449257e6cfddc9aebc # standards main, 2026-10-13 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # standards main, 2026-10-19 permissions: actions: read contents: read diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 0565597..ed5c386 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -28,5 +28,5 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@7d2041a2315572d8257341449257e6cfddc9aebc # standards main, 2026-10-13 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # standards main, 2026-10-19 secrets: inherit diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 671da67..6fa3e99 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -14,7 +14,7 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7d2041a2315572d8257341449257e6cfddc9aebc # standards main, 2026-10-13 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # standards main, 2026-10-19 secrets: inherit permissions: actions: read diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 7e3c760..fc5b287 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -21,7 +21,7 @@ permissions: jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@7d2041a2315572d8257341449257e6cfddc9aebc # standards main, 2026-10-13 + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # standards main, 2026-10-19 permissions: actions: read contents: read diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 4d742e4..61ea18d 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -17,5 +17,5 @@ jobs: contents: read security-events: write id-token: write - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7d2041a2315572d8257341449257e6cfddc9aebc # standards main, 2026-10-13 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # standards main, 2026-10-19 secrets: inherit diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index f3b5967..ffa4577 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -22,4 +22,4 @@ jobs: actions: read security-events: write contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7d2041a2315572d8257341449257e6cfddc9aebc # standards main, 2026-10-13 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # standards main, 2026-10-19 From 40fc8647607a4b20978a795467916ee6ce2c5af1 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 23:39:39 +0000 Subject: [PATCH 2/2] ci: move the standards pin to a85aa8e for the js-runtimes workspace fix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On 75bd599, every standards-reusable job on this PR now starts. The lockfile fix works. One governance job failed in its own body: "JS runtimes — environment provisions Bun first" (job 118367034408). error: current package believes it's in a workspace when it's not: current: .standards-js/tools/js-runtimes/Cargo.toml workspace: Cargo.toml That job checks standards out into .standards-js/ inside this Cargo workspace. It is new to januskey with the move off 7d2041a. standards fixed it in #1296/#1299 by giving tools/js-runtimes its own [workspace] table. a85aa8e is the first commit carrying that fix. Regenerated as before with standards/scripts/propagate-workflow-pins.sh --fix --to a85aa8e. That runs the relock-standards-pin.sh with the standards#1314 fix. - lock-selfcheck.sh: a85aa8e is SELF-CONSISTENT. - The reusables' workflow_call interfaces and permissions match 75bd599, except one new hypatia-scan output that this caller does not read. - The lock parses with actions-lockfile v0.0.6. - check-lock-sync.sh: in sync. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_013CuBToxr5h9catptGiTsFX --- .github/workflows/actions.lock | 34 ++++++++++++++-------------- .github/workflows/codeql.yml | 4 ++-- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 8 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index f70c533..6ae9e66 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -15,7 +15,7 @@ workflows: - 'actions/upload-pages-artifact@v5.0.0' - 'haskell-actions/setup@v2.12.1' '.github/workflows/codeql.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@a85aa8e70326cceedae169013a47daee554918b7' '.github/workflows/dashboard-check.yml': - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' @@ -30,9 +30,9 @@ workflows: - 'dtolnay/rust-toolchain@v1' - 'swatinem/rust-cache@v2.9.2' '.github/workflows/governance.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@a85aa8e70326cceedae169013a47daee554918b7' '.github/workflows/hypatia-scan.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@a85aa8e70326cceedae169013a47daee554918b7' '.github/workflows/idris-abi.yml': - 'actions/checkout@v7.0.1' '.github/workflows/label-triage.yml': [] @@ -41,13 +41,13 @@ workflows: - 'actions/checkout@v7.0.1' - 'hyperpolymath/cicd-suite@main' '.github/workflows/mirror.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@a85aa8e70326cceedae169013a47daee554918b7' '.github/workflows/rust-ci.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@a85aa8e70326cceedae169013a47daee554918b7' '.github/workflows/scorecard.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@a85aa8e70326cceedae169013a47daee554918b7' '.github/workflows/secret-scanner.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'hyperpolymath/standards@a85aa8e70326cceedae169013a47daee554918b7' '.github/workflows/squabble.yml': - 'actions/checkout@v7.0.1' - 'hyperpolymath/cicd-squabbler@b34cd53f9157d1b8a4f9c5c8d843846557f8622c' @@ -114,9 +114,9 @@ dependencies: commit: 'sha1-25dd0e34f4fe68f24cc83900b1fe3fe149efef98' owner_id: 27347476 repo_id: 371068214 - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f': + 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8': ref: 'v1' - commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8' owner_id: 1940490 repo_id: 260749683 'dtolnay/rust-toolchain@v1': @@ -182,9 +182,9 @@ dependencies: commit: 'sha1-c1a34884054fabf0e9de81dbf68f4ba7874e85f1' owner_id: 6759885 repo_id: 1275650185 - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': - ref: '75bd5994470661a099df562d6d5ad2fe744dbd66' - commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66' + 'hyperpolymath/standards@a85aa8e70326cceedae169013a47daee554918b7': + ref: 'a85aa8e70326cceedae169013a47daee554918b7' + commit: 'sha1-a85aa8e70326cceedae169013a47daee554918b7' owner_id: 6759885 repo_id: 1116521501 uses: @@ -192,18 +192,18 @@ dependencies: - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed' - - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f' + - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8' - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393' - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124' - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406' - - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc' + - 'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e' - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6' - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555' - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc': - ref: 'v2.4.4' - commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc' + 'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e': + ref: 'v2.5.0' + commit: 'sha1-fa7117db83c52d787ae5a89f350999701505d78e' owner_id: 67707773 repo_id: 421101922 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6': diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f0f1f21..ce0a91d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,10 +32,10 @@ permissions: jobs: codeql-actions: - uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # standards main, 2026-10-19 + uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@a85aa8e70326cceedae169013a47daee554918b7 # standards main, 2026-10-19 (#1296) with: language: actions codeql-rust: - uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # standards main, 2026-10-19 + uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@a85aa8e70326cceedae169013a47daee554918b7 # standards main, 2026-10-19 (#1296) with: language: rust diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index c95d6ea..fc91895 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -34,7 +34,7 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # standards main, 2026-10-19 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@a85aa8e70326cceedae169013a47daee554918b7 # standards main, 2026-10-19 (#1296) permissions: actions: read contents: read diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index ed5c386..c2b4ebe 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -28,5 +28,5 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # standards main, 2026-10-19 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@a85aa8e70326cceedae169013a47daee554918b7 # standards main, 2026-10-19 (#1296) secrets: inherit diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 6fa3e99..07ce99a 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -14,7 +14,7 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # standards main, 2026-10-19 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@a85aa8e70326cceedae169013a47daee554918b7 # standards main, 2026-10-19 (#1296) secrets: inherit permissions: actions: read diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index fc5b287..1817f74 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -21,7 +21,7 @@ permissions: jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # standards main, 2026-10-19 + uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@a85aa8e70326cceedae169013a47daee554918b7 # standards main, 2026-10-19 (#1296) permissions: actions: read contents: read diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 61ea18d..53e16f6 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -17,5 +17,5 @@ jobs: contents: read security-events: write id-token: write - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # standards main, 2026-10-19 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@a85aa8e70326cceedae169013a47daee554918b7 # standards main, 2026-10-19 (#1296) secrets: inherit diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index ffa4577..7461542 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -22,4 +22,4 @@ jobs: actions: read security-events: write contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # standards main, 2026-10-19 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@a85aa8e70326cceedae169013a47daee554918b7 # standards main, 2026-10-19 (#1296)