From a6bc805aa0722891dfa01dab2c442c55cd33170c Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 9 Nov 2026 13:22:28 +0000 Subject: [PATCH 1/2] ci: re-pin standards reusables to metadatastician@e064539 The five standards reusables (governance, hypatia-scan, mirror, scorecard, secret-scanner) were pinned to hyperpolymath/standards at da2c748, where all five failed at startup on every push, so the required `scan / gitleaks` check never reported. Re-pin to metadatastician/standards@e064539, the commit panll runs green (hyperpolymath/panll#171). governance.yml and mirror.yml grant `actions: read`, which both reusables declare at workflow level at e064539. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t --- .github/workflows/governance.yml | 4 +++- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 4 +++- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- CHANGELOG.adoc | 10 ++++++++++ 6 files changed, 19 insertions(+), 5 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 7162c52..be1ac76 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -11,7 +11,9 @@ on: permissions: contents: read + # The reusable declares actions: read at workflow level (metadatastician/standards @ e064539). + actions: read jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 + uses: metadatastician/standards/.github/workflows/governance-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index c534530..002563e 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -21,4 +21,4 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 + uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index c003271..7af9265 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -9,8 +9,10 @@ on: permissions: contents: read + # The reusable declares actions: read at workflow level (metadatastician/standards @ e064539). + actions: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 + uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6 secrets: inherit diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index c9aa653..e850051 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -12,7 +12,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 + uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6 permissions: contents: read security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 4256c8f..b12526c 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -21,5 +21,5 @@ jobs: # caller must grant at least that or the run startup-fails. permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 + uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6 secrets: inherit diff --git a/CHANGELOG.adoc b/CHANGELOG.adoc index d2c5d68..e4a65d9 100644 --- a/CHANGELOG.adoc +++ b/CHANGELOG.adoc @@ -9,6 +9,16 @@ https://semver.org/spec/v2.0.0.html[Semantic Versioning]. === [Unreleased] +==== CI: standards re-pinned to metadatastician @ `e064539` (2026-11-09) + +* The five standards reusables (governance, hypatia-scan, mirror, scorecard, + secret-scanner) move from `hyperpolymath/standards@da2c748` to + `metadatastician/standards@e064539`, the commit panll runs green + (hyperpolymath/panll#171). At `da2c748` all five failed at startup on + every push, so the required `scan / gitleaks` check never reported. +* `governance.yml` and `mirror.yml` grant `actions: read`, which both + reusables declare at workflow level at `e064539`. + ==== L15-C at the front-end: a caller's caps contain its callee's (2026-10-27) * The canonical Rust front-end (`typed-wasm-codegen`, ADR-0006) now parses From b6857bb232e02f4cb7494ceb8fba60872ec1a03f Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 9 Nov 2026 13:30:14 +0000 Subject: [PATCH 2/2] ci: pass named secrets, not secrets: inherit `secrets: inherit` hands every repository secret to the callee. The mirror reusable at e064539 declares seven forge keys, so pass those by name; the secret-scanner reusable declares none, so pass none. SonarCloud rated the re-pin's new code C for security on the inherited secrets. The secret-scanner comment now says what the reusable asks for at e064539 (contents: read only). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t --- .github/workflows/mirror.yml | 11 ++++++++++- .github/workflows/secret-scanner.yml | 6 ++---- CHANGELOG.adoc | 3 +++ 3 files changed, 15 insertions(+), 5 deletions(-) diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 7af9265..08dd514 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -15,4 +15,13 @@ permissions: jobs: mirror: uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6 - secrets: inherit + # Named, not inherited: the reusable declares exactly these, and skips a + # forge whose key is not set. + secrets: + GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} + BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} + CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }} + SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }} + DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }} + GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }} + RADICLE_KEY: ${{ secrets.RADICLE_KEY }} diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index b12526c..cfe80c0 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -16,10 +16,8 @@ permissions: jobs: scan: - # The reusable's gitleaks job requests pull-requests: write (PR summary - # comment) and actions: read (workflow-run metadata) at job level; the - # caller must grant at least that or the run startup-fails. + # At metadatastician/standards @ e064539 the reusable's jobs ask for + # contents: read only, and it declares no secrets, so none are passed. permissions: contents: read uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6 - secrets: inherit diff --git a/CHANGELOG.adoc b/CHANGELOG.adoc index e4a65d9..6637159 100644 --- a/CHANGELOG.adoc +++ b/CHANGELOG.adoc @@ -18,6 +18,9 @@ https://semver.org/spec/v2.0.0.html[Semantic Versioning]. every push, so the required `scan / gitleaks` check never reported. * `governance.yml` and `mirror.yml` grant `actions: read`, which both reusables declare at workflow level at `e064539`. +* `mirror.yml` passes the seven forge keys the reusable declares by name, + and `secret-scanner.yml` passes none (its reusable declares none), instead + of `secrets: inherit`, which handed every repository secret to the callee. ==== L15-C at the front-end: a caller's caps contain its callee's (2026-10-27)