From 75cd6d11b45b58116aa5c8632db220531928c58d Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 27 Aug 2026 01:25:19 +0100
Subject: [PATCH] fix(ci): repin standards reusables to a commit that has a
 lockfile

Every workflow here calls a standards reusable pinned to a commit with NO
.github/workflows/actions.lock:

    81dbf2dd  2026-07-21  no lockfile
    892497fe  2026-08-12  no lockfile
    84355587  HEAD        lockfile present, 11754 bytes, 38 workflows onboarded

GitHub's Workflow Dependency Locking (public preview) rejects a run when
the callee at the pinned SHA is not covered by a lockfile. It does so at
startup_failure - zero jobs, no logs, no annotations in REST or GraphQL.
The reason is visible only in the run page banner:

    Workflow must use a lockfile. Run "gh actions pin" to generate one.
    The following workflows are missing a lockfile:
      - .github/workflows/governance.yml
      - hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd

That requirement can never be satisfied at 81dbf2dd or 892497fe, because
no lockfile existed anywhere in standards on either date. Repinning to
HEAD is the fix; hand-adding entries to this repo's own lockfile is not,
because it addresses only the first line of the message.

(Note: "gh actions pin" is not a released command - it is an open RFC,
cli/cli#13314. The shipped tool is the gh actions-lock extension. The
server's own error text names a command that has never existed.)

Pilot for an estate-wide repin. Verified before pushing: 0 residual
references to either stale SHA.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/governance.yml     | 2 +-
 .github/workflows/hypatia-scan.yml   | 2 +-
 .github/workflows/mirror.yml         | 2 +-
 .github/workflows/scorecard.yml      | 2 +-
 .github/workflows/secret-scanner.yml | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 931cef9..b4dd16a 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -14,4 +14,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 3c08e0a..761bb8a 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -17,4 +17,4 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index c6d5ebd..bdb00bb 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -12,5 +12,5 @@ permissions:
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@892497fe373744874316710966b81ae6f0ea9e66
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
     secrets: inherit
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 0859959..97f761d 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
     permissions:
       contents: read
       security-events: write
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 11cced2..ebff893 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -18,5 +18,5 @@ jobs:
   scan:
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@892497fe373744874316710966b81ae6f0ea9e66
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
     secrets: inherit