From 116cf3620b82b026b3bb29673a7f3df24763f3db Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 20 Sep 2026 21:46:21 +0000
Subject: [PATCH] fix(ci): use github.token in the context-contract job

The CI context contract job referenced the secrets context, which trips the
Hypatia scanner's RE001 research extension ("job references secrets.* but does
not install step-security/harden-runner") and surfaced as a new code-scanning
alert on this pull request.

step-security/harden-runner is not in the estate actions allowlist, so adding it
is not an option: it would fail the allowlist preflight and the repository's
selected-actions policy. Use github.token instead. The job needs read access
only, it can read branch rulesets with that token, and the script states plainly
what it could not read (legacy branch protection needs a credential with
Administration: read, which the Actions token cannot have) rather than guessing.

Also move the new workflow to actions/checkout@v7.0.1, the pin the rest of the
estate uses, and record it in actions.lock with the official extension.
---
 .github/workflows/actions.lock    |  7 ++++++-
 .github/workflows/ci-contexts.yml | 30 ++++++++++++++++++++++++++++--
 2 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 64972a7..5ae11d5 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -4,7 +4,7 @@
 version: 'v0.0.2'
 workflows:
     '.github/workflows/ci-contexts.yml':
-        - 'actions/checkout@v4.4.0'
+        - 'actions/checkout@v7.0.1'
     '.github/workflows/governance.yml': []
     '.github/workflows/hypatia-scan.yml': []
     '.github/workflows/label-triage.yml': []
@@ -20,6 +20,11 @@ dependencies:
         commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
         owner_id: 44036562
         repo_id: 197814629
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
     'hyperpolymath/smtp-notify-action@v0.2.0':
         ref: 'v0.2.0'
         commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7'
diff --git a/.github/workflows/ci-contexts.yml b/.github/workflows/ci-contexts.yml
index 7c7af19..cfac113 100644
--- a/.github/workflows/ci-contexts.yml
+++ b/.github/workflows/ci-contexts.yml
@@ -1,24 +1,50 @@
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# CI context contract — the guard for docs/CI-CONTEXTS.adoc.
+#
+# WHY THIS JOB EXISTS: a required status check is matched by string equality
+# against the check-run name GitHub publishes. A required name nothing can
+# publish blocks every pull request while the board shows green (issue #17), and
+# the failure is invisible from the CI side. tools/check-ci-contexts.sh makes both
+# halves visible: the offline contract check fails the build when the published
+# string would drift, and the live half reports any required context this
+# repository's workflows cannot produce.
+#
+# The live half reads the repository's branch rules. A credential with
+# `Administration: read` sees more than the Actions token does — legacy branch
+# protection is only readable with one — so this job deliberately uses
+# `github.token` (no secret context referenced, hence no egress-review finding)
+# and reports exactly what it could not read rather than guessing. Run it locally
+# with a broader credential (`GH_TOKEN=… bash tools/check-ci-contexts.sh .`) to
+# get that extra coverage.
 name: CI context contract
+
 on:
   pull_request:
   push:
     branches: [main, master]
   workflow_dispatch:
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
 permissions:
   contents: read
+
 jobs:
   contract:
+    name: Required contexts are producible
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4.4.0
+      - name: Checkout
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Check the CI context contract
         env:
           GITHUB_REPOSITORY: ${{ github.repository }}
-          GH_TOKEN: ${{ secrets.HYPATIA_SCAN_PAT || secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: bash tools/check-ci-contexts.sh .