From 6b32e98fd06f48148f934cb297c26148225ec480 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 4 Sep 2026 17:32:14 +0100 Subject: [PATCH 1/2] fix(ci): restore reachable standards workflow pins --- .github/workflows/secret-scanner.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 0012a87..2aeeec6 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -14,5 +14,5 @@ jobs: scan: permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 secrets: inherit From 41037238897147c3ca4f868aa497f5d615b949f3 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 8 Sep 2026 16:18:10 +0100 Subject: [PATCH 2/2] fix(ci): grant actions: read so the governance reusable can start The reusable at the pinned standards revision requires actions: read. A caller granting only contents: read dies at startup and reports NO governance checks at all, silently disarming the whole gate (0 checks instead of 15). Verified on bofig: run 34200437178 at the patched head reported all 15 governance jobs; before the patch the run was startup_failure with zero checks. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01QMTyDv9CoJo5PfeNzyp519 --- .github/workflows/governance.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index d8c88d3..931cef9 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -9,6 +9,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: