[hyperpolymath]

Summary

This PR fixes four workflows that never started on main. GitHub killed each one at startup (startup_failure, 0 jobs, no check run), so none of them showed in the checks list:

1. sonarqube.yml (commit 1, 80b5628). Dependabot's actions-group bump (Bump the actions group with 2 updates #1, merged as 4b5f580) changed two uses: refs and left .github/workflows/actions.lock behind, so the lock no longer matched the workflows. The resync also clears the red actions.lock is in sync with the workflow YAML check (run 37542789432).
2. secret-scanner.yml (gitleaks), rust-ci.yml, governance.yml (commit 2, 00001f0a). These have died at startup on every commit since the repo was created.
   • Their callers pinned hyperpolymath/standards@main, and the lock's standards@main record had no uses: closure.
   • The fully closed record for the template's pin, standards@da2c748, sat orphaned in the same lock.
   • Commit 2 repins all six standards callers to da2c748, which is the pin rsr-template-repo uses, where the same callers run green. It also removes the dangling @main record.

About GitGuardian: GitGuardian was running, and it passed ("1 commit scanned, no secrets"). The secret scanning that was not running is the repo's own gitleaks workflow, secret-scanner.yml, which is case 2 above. On this head, scan / gitleaks runs and passes alongside GitGuardian.

Changes

Commit 1 (80b5628): resync after Dependabot #1. .github/workflows/actions.lock, 8 lines changed:

• The pages.yml workflow entry and its dependency record now say haskell-actions/setup@v2.12.1, matching the workflow.
• The sonarqube.yml workflow entry and its dependency record now say sonarsource/sonarqube-scan-action@v8.3.0, matching the workflow.
• Both are leaf actions, so no closure records are needed. I did not use the fix mode of gh actions-lock: a trial run pruned about 12 unrelated closure records.

Commit 2 (00001f0a): repin the standards callers.

• secret-scanner.yml, rust-ci.yml, governance.yml, hypatia-scan.yml, scorecard.yml, mirror.yml: hyperpolymath/standards/.github/workflows/*-reusable.yml@main becomes @da2c748aad55c1a1dcba00b60fe4a35017bc6540.
• actions.lock: the six workflows: entries now point at standards@da2c748…, and the unclosed 'hyperpolymath/standards@main' record is removed.
• The existing standards@da2c748 record is unchanged. Its uses: list is exactly the union of the six reusables' uses: at that commit (checked against git show da2c748:.github/workflows/*-reusable.yml), and every one of those leaves already has a record.

📌 New pins

Head SHA: 00001f0adc209bff15de2fc95229dccf5996a98b

Pin	Resolves to	Replaces
hyperpolymath/standards@da2c748aad55c1a1dcba00b60fe4a35017bc6540 (6 reusable callers)	the same commit (2026-09-10, "fix(scorecard): publish findings reconciled with verified native action locks")	@main (lock record sha1-d556b3db…, which had no closure)
haskell-actions/setup@v2.12.1 (lock)	sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d (annotated tag 0f7370cc dereferenced to its commit)	v2.12.0 at 6037f336…
sonarsource/sonarqube-scan-action@v8.3.0 (lock)	sha1-d209202bc7d53ff1cc128f7f907dac145c9d6ae9	v8.2.2 at ba9859ea…

da2c748 is 118+ commits behind standards main. I picked it because it is the template's current pin and has been proven green there. Moving the template's cohort forward is a separate change.

RSR Quality Checklist

Required

• Tests pass. The checks this PR affects all pass on the head (see Testing). No code changed, so there are no code tests to run.
• Code is formatted. Does not apply: no source code changed. YAML indentation and key order are preserved.
• Linter is clean. gh actions-lock --no-fix exits 0. The governance / Workflow security linter check passes on the head.
• No banned language patterns. No files were added; only workflow YAML and the lockfile changed.
• No unsafe blocks without // SAFETY: comments. Does not apply: no code changed.
• No banned functions. Does not apply: no code changed.
• SPDX license headers on new or modified source files. Does not apply: no new files. The modified workflows keep their existing headers, and actions.lock is a generated lockfile.
• No secrets, credentials, or .env files included. scan / gitleaks and GitGuardian both pass on the head.

As Applicable

• STATE.a2ml / ECOSYSTEM.a2ml / META.a2ml updated. Does not apply: A2ML is retired estate-wide (deed replaces it), and project state did not change.
• Documentation updated. Does not apply: nothing user-facing changed.
• TOPOLOGY.md updated. Does not apply: the architecture did not change.
• CHANGELOG or release notes updated. Does not apply: this is a CI-only fix.
• New dependencies reviewed for license compatibility. Does not apply: there are no new dependencies, only a repin of an existing estate dependency and two patch/minor bumps from Bump the actions group with 2 updates #1.
• ABI/FFI changes validated. Does not apply: there are no ABI or FFI changes.

Testing

Local, on head 00001f0a:

• gh actions-lock --no-fix exits 0. It printed two advisories about the unrelated deed-ecosystem@main and k9-ecosystem@main refs, which were inconclusive because the Compare API was rate-limited.
• ./scripts/check-lock-sync.sh exits 0: "in sync and transitively closed".

CI on head 00001f0a (check suites read via GraphQL):

Workflow	On every earlier commit	On this head
secret-scanner.yml	startup_failure, 0 jobs	success, 3 jobs: gitleaks, shell-secrets, rust-secrets
rust-ci.yml	startup_failure, 0 jobs	success, 5 jobs. Detect passes; the Cargo jobs are skipped because there is no Cargo.toml
governance.yml	startup_failure, 0 jobs	success, 15 jobs
sonarqube.yml	startup_failure at 4b5f580	success, 1 job
lock-sync-gate.yml, k9-validate.yml, deed-validate.yml	—	success

Known limits:

• check-lock-sync.sh cannot detect an incomplete callee closure. I removed one leaf from the standards@da2c748 record and the script still exited 0. Lock-sync passing is therefore no evidence that a reusable caller will start; the CI run above is the evidence.
• About 15 other pull_request workflows produce no check suite on this PR at all, including codeql.yml. This is why the CODE_SCANNING rule cannot be satisfied. It is being investigated separately and is not changed by this PR.
• The EstateBranching ruleset also requires code-owner review, Copilot code review and code coverage. These are human or ruleset items that this PR cannot satisfy.

Screenshots

Does not apply. The terminal and CI output is summarised in the Testing section.

🤖 Generated with Claude Code

https://claude.ai/code/session_015bTuGfwCcvjrmNFejydTML

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Free
• Run ID: 9fe90599-eedd-4eba-addf-59f6d57d4a37

📥 Commits

Reviewing files that changed from the base of the PR and between 80b5628 and 00001f0.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (6)

• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/mirror.yml
• .github/workflows/rust-ci.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Pinned shared governance, security scanning, mirroring, CI and scoring workflows to a specific revision for more consistent automation.

Walkthrough

Six GitHub Actions workflows now reference reusable workflows at commit da2c748aad55c1a1dcba00b60fe4a35017bc6540 instead of the moving main branch.

Changes

Reusable workflow pins

Layer / File(s)	Summary
Update reusable workflow references .github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/mirror.yml, .github/workflows/rust-ci.yml, .github/workflows/scorecard.yml, .github/workflows/secret-scanner.yml	Each workflow now references its reusable workflow at commit da2c748aad55c1a1dcba00b60fe4a35017bc6540. The mirror workflow’s explicit seven-secret mapping remains unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{A rabbit checks each workflow line,
Six pins now point to one commit.
No branch can shift their chosen place,
The mirror keeps its secrets set.
The rabbit hops, then calls it done.}

_{Comment @coderabbitai help to get the list of available commands.}