Skip to content

e-pin the estate reusables to the last accepted standards ref - #46

Merged
hyperpolymath merged 1 commit into
mainfrom
fix/repin-accepted
Sep 19, 2026
Merged

hyperpolymath merged 1 commit into
mainfrom
fix/repin-accepted

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

fix(ci): re-pin the estate reusables to the last accepted standards ref

Pins at 4e6ffe55-or-later are rejected by GitHub's dependency-lockfile validation, so the
callers that used them could not parse: conclusion=failure, 0 jobs, run name equal to the
file's path. 210f14e7 (2026-09-12T17:32:17Z) is the last ref whose pins are accepted — measured by
pinning a caller at each candidate and dispatching it, not inferred.

This re-points the refs here to that ref. Behaviour is otherwise unchanged; the lockfile in
hyperpolymath/standards is the thing that has to be regenerated before a forward re-point is safe
again, and the estate's own applier (.github/workflows/apply-workflow-pins.yml) is what should do
that re-pointing once it can run.

Pins at `4e6ffe55`-or-later are rejected by GitHub's dependency-lockfile validation, so the
callers that used them could not parse: `conclusion=failure`, **0 jobs**, run name equal to the
file's path. `210f14e7` (2026-09-12T17:32:17Z) is the last ref whose pins are accepted — measured by
pinning a caller at each candidate and dispatching it, not inferred.

This re-points the refs here to that ref. Behaviour is otherwise unchanged; the lockfile in
`hyperpolymath/standards` is the thing that has to be regenerated before a forward re-point is safe
again, and the estate's own applier (`.github/workflows/apply-workflow-pins.yml`) is what should do
that re-pointing once it can run.
@coderabbitai

coderabbitai Bot commented Sep 19, 2026 •

Copy link
Copy Markdown
Contributor

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 14f7bcfd-df26-4c72-88f2-b3c5770646e9

📥 Commits

Reviewing files that changed from the base of the PR and between cd78f29 and 4aa8a71.

📒 Files selected for processing (46)
  • deno/.github/workflows/codeql.yml
  • deno/.github/workflows/governance.yml
  • deno/.github/workflows/hypatia-scan.yml
  • deno/.github/workflows/mirror.yml
  • deno/.github/workflows/scorecard-enforcer.yml
  • deno/.github/workflows/scorecard.yml
  • deno/.github/workflows/secret-scanner.yml
  • dispatch-templates/from-k9-svc/codeql.yml
  • dispatch-templates/from-k9-svc/governance.yml
  • dispatch-templates/from-k9-svc/hypatia-scan.yml
  • dispatch-templates/from-k9-svc/scorecard.yml
  • editors/vscode/.github/workflows/codeql.yml
  • editors/vscode/.github/workflows/governance.yml
  • editors/vscode/.github/workflows/hypatia-scan.yml
  • editors/vscode/.github/workflows/mirror.yml
  • editors/vscode/.github/workflows/scorecard-enforcer.yml
  • editors/vscode/.github/workflows/scorecard.yml
  • editors/vscode/.github/workflows/secret-scanner.yml
  • haskell/.github/workflows/codeql.yml
  • haskell/.github/workflows/governance.yml
  • haskell/.github/workflows/hypatia-scan.yml
  • haskell/.github/workflows/mirror.yml
  • haskell/.github/workflows/scorecard-enforcer.yml
  • haskell/.github/workflows/scorecard.yml
  • haskell/.github/workflows/secret-scanner.yml
  • pandoc/.github/workflows/codeql.yml
  • pandoc/.github/workflows/governance.yml
  • pandoc/.github/workflows/hypatia-scan.yml
  • pandoc/.github/workflows/mirror.yml
  • pandoc/.github/workflows/scorecard-enforcer.yml
  • pandoc/.github/workflows/scorecard.yml
  • pandoc/.github/workflows/secret-scanner.yml
  • rs/.github/workflows/codeql.yml
  • rs/.github/workflows/governance.yml
  • rs/.github/workflows/hypatia-scan.yml
  • rs/.github/workflows/mirror.yml
  • rs/.github/workflows/scorecard-enforcer.yml
  • rs/.github/workflows/scorecard.yml
  • rs/.github/workflows/secret-scanner.yml
  • validate-action/.github/workflows/codeql.yml
  • validate-action/.github/workflows/governance.yml
  • validate-action/.github/workflows/hypatia-scan.yml
  • validate-action/.github/workflows/mirror.yml
  • validate-action/.github/workflows/scorecard-enforcer.yml
  • validate-action/.github/workflows/scorecard.yml
  • validate-action/.github/workflows/secret-scanner.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (6)
  • GitHub Check: secret-scan / shell-secrets
  • GitHub Check: secret-scan / rust-secrets
  • GitHub Check: secret-scan / gitleaks
  • GitHub Check: Analyze (actions)
  • GitHub Check: Analyze (ruby)
  • GitHub Check: Analyze (rust)
🔇 Additional comments (46)
deno/.github/workflows/codeql.yml (1)

25-25: LGTM!

deno/.github/workflows/hypatia-scan.yml (1)

24-24: LGTM!

deno/.github/workflows/scorecard-enforcer.yml (1)

20-20: LGTM!

deno/.github/workflows/scorecard.yml (1)

26-26: LGTM!

deno/.github/workflows/secret-scanner.yml (1)

20-20: LGTM!

dispatch-templates/from-k9-svc/codeql.yml (1)

25-25: LGTM!

dispatch-templates/from-k9-svc/hypatia-scan.yml (1)

24-24: LGTM!

dispatch-templates/from-k9-svc/scorecard.yml (1)

26-26: LGTM!

editors/vscode/.github/workflows/codeql.yml (1)

25-25: LGTM!

editors/vscode/.github/workflows/hypatia-scan.yml (1)

24-24: LGTM!

editors/vscode/.github/workflows/scorecard-enforcer.yml (1)

20-20: LGTM!

editors/vscode/.github/workflows/scorecard.yml (1)

26-26: LGTM!

editors/vscode/.github/workflows/secret-scanner.yml (1)

20-20: LGTM!

haskell/.github/workflows/codeql.yml (1)

25-25: LGTM!

haskell/.github/workflows/hypatia-scan.yml (1)

24-24: LGTM!

haskell/.github/workflows/scorecard-enforcer.yml (1)

20-20: LGTM!

haskell/.github/workflows/scorecard.yml (1)

26-26: LGTM!

haskell/.github/workflows/secret-scanner.yml (1)

20-20: LGTM!

pandoc/.github/workflows/codeql.yml (1)

25-25: LGTM!

pandoc/.github/workflows/hypatia-scan.yml (1)

24-24: LGTM!

pandoc/.github/workflows/scorecard-enforcer.yml (1)

20-20: LGTM!

pandoc/.github/workflows/scorecard.yml (1)

26-26: LGTM!

pandoc/.github/workflows/secret-scanner.yml (1)

20-20: LGTM!

rs/.github/workflows/codeql.yml (1)

25-25: LGTM!

rs/.github/workflows/hypatia-scan.yml (1)

24-24: LGTM!

rs/.github/workflows/scorecard-enforcer.yml (1)

20-20: LGTM!

rs/.github/workflows/scorecard.yml (1)

26-26: LGTM!

rs/.github/workflows/secret-scanner.yml (1)

20-20: LGTM!

validate-action/.github/workflows/codeql.yml (1)

25-25: LGTM!

validate-action/.github/workflows/hypatia-scan.yml (1)

24-24: LGTM!

validate-action/.github/workflows/scorecard-enforcer.yml (1)

20-20: LGTM!

validate-action/.github/workflows/scorecard.yml (1)

26-26: LGTM!

validate-action/.github/workflows/secret-scanner.yml (1)

20-20: LGTM!

deno/.github/workflows/governance.yml (1)

30-30: LGTM!

deno/.github/workflows/mirror.yml (1)

17-17: LGTM!

dispatch-templates/from-k9-svc/governance.yml (1)

30-30: LGTM!

editors/vscode/.github/workflows/governance.yml (1)

30-30: LGTM!

editors/vscode/.github/workflows/mirror.yml (1)

17-17: LGTM!

haskell/.github/workflows/governance.yml (1)

30-30: LGTM!

haskell/.github/workflows/mirror.yml (1)

17-17: LGTM!

pandoc/.github/workflows/governance.yml (1)

30-30: LGTM!

pandoc/.github/workflows/mirror.yml (1)

17-17: LGTM!

rs/.github/workflows/governance.yml (1)

30-30: LGTM!

rs/.github/workflows/mirror.yml (1)

17-17: LGTM!

validate-action/.github/workflows/governance.yml (1)

30-30: LGTM!

validate-action/.github/workflows/mirror.yml (1)

17-17: LGTM!


📝 Summary

Summary by CodeRabbit

  • Chores
    • Updated the shared workflow revisions used across security scanning, governance, mirroring, secret detection, and scorecard checks.
    • Automated checks now run against a newer, consistently pinned workflow revision.
    • Existing workflow triggers, permissions, inputs, and job behaviour remain unchanged.

Walkthrough

The pull request updates 46 GitHub Actions workflow references across seven project areas. Each reference changes from commit 4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2 to 210f14e753c80064ec1bcae72f1d654dd9b0e687.

Changes

Reusable workflow pin updates

Layer / File(s) Summary
Security and quality workflow pins
deno/.github/workflows/*, dispatch-templates/from-k9-svc/*, editors/vscode/.github/workflows/*, haskell/.github/workflows/*, pandoc/.github/workflows/*, rs/.github/workflows/*, validate-action/.github/workflows/*
CodeQL, Hypatia, Scorecard, Scorecard Enforcer, and secret-scanner workflows now use the updated reusable workflow commit.
Governance and mirror workflow pins
deno/.github/workflows/governance.yml, deno/.github/workflows/mirror.yml, dispatch-templates/from-k9-svc/governance.yml, editors/vscode/.github/workflows/{governance,mirror}.yml, haskell/.github/workflows/{governance,mirror}.yml, pandoc/.github/workflows/{governance,mirror}.yml, rs/.github/workflows/{governance,mirror}.yml, validate-action/.github/workflows/{governance,mirror}.yml
Governance and mirror workflow references now use the updated reusable workflow commit. Other reported workflow settings remain unchanged.

Priority: ⬆️ High

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarises the main change: re-pinning the estate's reusable workflows to the last accepted standards reference.
Description check ✅ Passed The description directly explains the pin update, the GitHub validation failure, the selected commit, and the unchanged workflow behaviour.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit checks each workflow pin,
Old hashes hop away; new hashes begin.
CodeQL and scanners follow the trail,
Governance and mirrors update without fail.
Forty-six small changes keep the paths aligned.

Comment @coderabbitai help to get the list of available commands.

@sonarqubecloud

Copy link
Copy Markdown

@hyperpolymath
hyperpolymath merged commit c1a3488 into main Sep 19, 2026
10 of 11 checks passed
@hyperpolymath
hyperpolymath deleted the fix/repin-accepted branch September 19, 2026 20:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant