[hyperpolymath]

Replace the unreachable standards reusable-workflow commit 7fdc2705df74b4e352d2a1cde3e87a5923fdf329 with reachable standards main commit 092dedada188f56c5915f74a5fd40aac093742c3. The old SHA is an intermediate commit from squash-merged standards PR #596: it exists, but GitHub rejects it for cross-repository reusable workflows before creating jobs. This restores Hypatia/SARIF and the other affected workflows without weakening SHA pinning or branch protection. Estate incident: 251 active workflow files across 70 repositories in hyperpolymath and metadatastician.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 0912f64f-9e55-461d-99c5-5f2e0906dcf2

📥 Commits

Reviewing files that changed from the base of the PR and between 52a7193 and e4414f8.

📒 Files selected for processing (5)

• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/mirror.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (35)

• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: governance / Debt ratchet
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Actions lockfile verify
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: scan / shell-secrets
• GitHub Check: scan / rust-secrets
• GitHub Check: scan / gitleaks
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: CodeQL Analysis (python)
• GitHub Check: CodeQL Analysis (javascript)
• GitHub Check: CodeQL Analysis (rust)
• GitHub Check: Dependency Review
• GitHub Check: OpenSSF Scorecard
• GitHub Check: analyze (actions, none)
• GitHub Check: Validate SCM manifests
• GitHub Check: Groove manifest check
• GitHub Check: Validate K9 contracts
• GitHub Check: Build and test Rust tools
• GitHub Check: Fuzzing (cargo-fuzz, if present)
• GitHub Check: Check SPDX headers
• GitHub Check: Validate A2ML manifests
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: analyze (javascript-typescript, none)
• GitHub Check: Validate AsciiDoc docs
• GitHub Check: Validate eclexiaiser manifest

🔇 Additional comments (5)

.github/workflows/governance.yml (1)

35-35: LGTM!

.github/workflows/hypatia-scan.yml (1)

29-29: LGTM!

.github/workflows/mirror.yml (1)

15-15: LGTM!

.github/workflows/scorecard.yml (1)

17-17: LGTM!

.github/workflows/secret-scanner.yml (1)

21-21: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the pinned versions of governance, security scanning, mirroring, supply-chain security, and secret-scanning workflows.
  • No changes to workflow behaviour, permissions, or job configuration.

Walkthrough

Five GitHub Actions workflows update their reusable workflow references from one pinned commit to another. No job configuration or workflow behaviour changes.

Changes

Reusable workflow pin updates

Layer / File(s)	Summary
Update reusable workflow pins .github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/mirror.yml, .github/workflows/scorecard.yml, .github/workflows/secret-scanner.yml	The workflows now reference commit 092dedada188f56c5915f74a5fd40aac093742c3 instead of commit 7fdc2705df74b4e352d2a1cde3e87a5923fdf329.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to e4414

This restores execution of the affected reusable security, governance, mirroring, and scanning workflows while retaining immutable commit pinning. No current merge-blocking risk remains.

Poem

A rabbit checks the workflow trail
Five pins hop forward without fail
Governance guards the leafy gate
Scanners follow at the same rate
One new commit, neat and bright
The pipelines rest well tonight

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains that the pull request updates unreachable reusable-workflow pins and restores affected workflows.
Title check	✅ Passed	The title clearly and concisely summarises the main change: restoring reachable standards workflow pins.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hyperpolymath]

Superseded by #149, which landed the same uses: line pinned at standards main HEAD (fad242d3) rather than 092dedad. Closing without merge.