fix(ci): pin standards reusables to default-branch HEAD - #58
Conversation
This repo's standards reusable pins are re-pointed at the standards default-branch HEAD, resolved live at sweep time. The prior refs are recorded in the verification line below. Three kinds of drift are repaired together and the body does not claim which one this repo had: an UNREACHABLE sha kills the run at workflow STARTUP, so GitHub reports no check at all rather than a failing one and the gate disappears instead of going red; a FLOATING ref (@main) is unpinned supply chain; a merely STALE but reachable sha silently reintroduces every bug fixed since it. files=5 pins=5 perms=0 permlines=0 from=257869d3061d5a8ed1529bf34225d90a2416d51a,fad242d35291de1898242d6737ba02b74a59a2f2 target=8f2ee508 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (5)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (18)
🔇 Additional comments (5)
📝 SummarySummary by CodeRabbit
WalkthroughFive GitHub workflow jobs now reference updated pinned commits for shared governance, Hypatia scan, mirror, Scorecard, and secret-scanner workflows. Triggers, permissions, and other workflow logic remain unchanged. ChangesReusable workflow pin updates
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This updates five reusable GitHub workflow pins to an available immutable standards commit without changing workflow behavior or permissions. No merge-blocking current-head risk remains. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks each workflow pin Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
1 participant
Re-points this repo's
hyperpolymath/standardsreusable-workflow pins at the standards default-branch HEAD,8f2ee50841e216cd8c192eeb68953118190f105c.Why this is not a routine version bump.
uses: org/repo/.github/workflows/x.yml@<ref>is resolved at workflow startup, so a bad ref is not a failing job — it is no job at all. This campaign repairs three kinds of drift and does not assume which one this repo had:gh pr checkssimply lists fewer rows. A repo in this state looks greener than one with working gates;@mainruns, but unpinned — the supply-chain property the estate pins for is absent;The refs this repo was actually pinned to, before this PR:
257869d3061d5a8ed1529bf34225d90a2416d51a fad242d35291de1898242d6737ba02b74a59a2f2.Expect this PR to surface failures that main does not show. Those failures are revealed, not introduced — they are the gates resuming work after being silently absent. The honest comparison is the set of check names emitted here versus on
main, not pass/fail counts. On the canary (hyperpolymath/empty-linter#79) the governance suite was absent on main and emitted 25 checks once repaired.The target is default-branch HEAD resolved at sweep time, never a sha copied from a plan: a reachable but non-HEAD sha silently reintroduces every bug fixed since it.
Engine:
.git-private-farm/scripts/smtp-notify-sweep.sh --campaign campaigns/pin-repair.sh. Verification for this repo:files=5 pins=5 perms=0 permlines=0 from=257869d3061d5a8ed1529bf34225d90a2416d51a,fad242d35291de1898242d6737ba02b74a59a2f2 target=8f2ee508 sig=G f22eaa0 canon=a7325fbdc356 base=main🤖 Generated with Claude Code
https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB