From a650c53e65255d14a06df4708709709e735adf83 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 4 Nov 2026 22:57:54 +0000 Subject: [PATCH 1/2] ci: point the standards reusable-workflow callers at metadatastician/standards@857ff09 (the repository was transferred) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit What was wrong: every workflow here that calls a hyperpolymath/standards reusable (.github/workflows/governance.yml .github/workflows/hypatia-scan.yml .github/workflows/mirror.yml .github/workflows/rust-ci.yml .github/workflows/scorecard.yml .github/workflows/secret-scanner.yml ) has failed before any job was created since 2026-10-26: `hyperpolymath/standards` was transferred to `metadatastician/standards` and GitHub Actions does not follow repository redirects for `jobs..uses` (run annotation: "error parsing called workflow ... workflow was not found"). Because the ruleset's only required status check, `scan / gitleaks`, is a job of the called secret-scanner workflow, no pull request in this repository could satisfy it. The owner has already made the same move in trope-checker (#107, #110), where the scanner has been green on main since 2026-10-31, and in vocarium's own secret-scanner.yml (#48). What changed: only the `uses:` lines — each caller now names metadatastician/standards/.github/workflows/@857ff096af11451841fb10488fed1438523973a1, the commit trope-checker main uses. Every input and secret those reusables declare at that commit is optional, so the callers' with/secrets blocks are left as they were. Nothing else in the files changes. What this does NOT fix (owner-only, repository settings): the Actions policy "Allow select actions and reusable workflows" must also permit `metadatastician/standards/.github/workflows/*@*`; until it does, these runs end in a startup failure that names that policy (as vocarium's re-pointed scanner does today). The re-point is necessary either way. What I ran: actionlint -shellcheck= -pyflakes= over the changed files -> clean. What I did not run: the workflows themselves; the runs on this branch are the test, and the `scan / gitleaks` job appearing is the discriminating signal. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01J4QvDh3p24SCUjyM9HHT31 --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index bb20105..b7a95ff 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -18,4 +18,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 + uses: metadatastician/standards/.github/workflows/governance-reusable.yml@857ff096af11451841fb10488fed1438523973a1 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index aba592a..40b64d2 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -27,4 +27,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 + uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@857ff096af11451841fb10488fed1438523973a1 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index fca74d8..9790af5 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -13,5 +13,5 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 + uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@857ff096af11451841fb10488fed1438523973a1 secrets: inherit diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 7e8fb87..b9ba5b2 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -16,4 +16,4 @@ permissions: contents: read jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 + uses: metadatastician/standards/.github/workflows/rust-ci-reusable.yml@857ff096af11451841fb10488fed1438523973a1 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 389a140..b83dada 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -18,7 +18,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 + uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@857ff096af11451841fb10488fed1438523973a1 # Reusable called-workflow permissions are CAPPED by the caller's grants; # without security-events: write here the scorecard SARIF upload fails with # startup_failure (hypatia WF018). id-token: write enables OIDC publish. diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 8ad7330..e4ef19f 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -23,5 +23,5 @@ jobs: contents: read pull-requests: write actions: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@857ff096af11451841fb10488fed1438523973a1 secrets: inherit From 4be6146279b8db92792c71bdab6b39f12a55c12c Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 4 Nov 2026 23:38:17 +0000 Subject: [PATCH 2/2] ci: match the three callers to the contract their reusables declare secret-scanner.yml drops `secrets: inherit` (the reusable at 857ff09 declares no workflow_call.secrets, references no secrets.* context, and says the caller passes no secrets line); mirror.yml maps the ten named optional secrets mirror-reusable.yml declares instead of inheriting everything; scorecard.yml's job-level permissions gain `actions: read`, which the called scorecard job requests for the Packaging check and which a job-level block, replacing the workflow-level one, had dropped. All three now match trope-checker's callers on main at the same pin, where the scanner has been green since 2026-10-31. Evidence: CodeRabbit review on #80 (zizmor secrets-inherit on the two lines; the scorecard permission read from the reusable); SonarCloud's "C Security Rating on New Code" cleared on workbench #78 at fe3f743 after the identical change and is the failing condition here. actionlint -shellcheck= -pyflakes= on the three files: clean. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01J4QvDh3p24SCUjyM9HHT31 --- .github/workflows/mirror.yml | 12 +++++++++++- .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 - 3 files changed, 12 insertions(+), 2 deletions(-) diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 9790af5..02764cd 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -14,4 +14,14 @@ permissions: jobs: mirror: uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@857ff096af11451841fb10488fed1438523973a1 - secrets: inherit + secrets: + GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} + BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} + CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }} + SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }} + DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }} + GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }} + RADICLE_KEY: ${{ secrets.RADICLE_KEY }} + R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }} + R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }} + R2_AGE_RECIPIENT: ${{ secrets.R2_AGE_RECIPIENT }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index b83dada..ee26e97 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -23,6 +23,7 @@ jobs: # without security-events: write here the scorecard SARIF upload fails with # startup_failure (hypatia WF018). id-token: write enables OIDC publish. permissions: + actions: read contents: read security-events: write id-token: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index e4ef19f..5a9356c 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -24,4 +24,3 @@ jobs: pull-requests: write actions: read uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@857ff096af11451841fb10488fed1438523973a1 - secrets: inherit