From f954c8906a1fce4c01af35fece6b3fe26147a0f7 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 14:55:14 +0100 Subject: [PATCH 01/12] chore: estate-wide security compliance --- .github/workflows/aur-publish.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/container.yml | 1 + .github/workflows/dependabot-automerge.yml | 1 + .github/workflows/generator-generic-ossf-slsa3-publish.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/language-policy.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/pages.yml | 1 + .github/workflows/push-email-notify.yml | 1 + .github/workflows/release.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + 15 files changed, 15 insertions(+) diff --git a/.github/workflows/aur-publish.yml b/.github/workflows/aur-publish.yml index 0ab886c..5d38037 100644 --- a/.github/workflows/aur-publish.yml +++ b/.github/workflows/aur-publish.yml @@ -10,6 +10,7 @@ on: description: 'Version to publish (e.g., 1.0.0)' required: true permissions: read-all + actions: read jobs: publish-aur: name: Publish to AUR diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d48ea03..06c81c1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,6 +18,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: read-all + actions: read jobs: analyze: name: Analyze (${{ matrix.language }}) diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml index 097be56..1ef2e9f 100644 --- a/.github/workflows/container.yml +++ b/.github/workflows/container.yml @@ -6,6 +6,7 @@ on: - 'v*' workflow_dispatch: permissions: read-all + actions: read env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }} diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index cff4451..96baf45 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -39,6 +39,7 @@ on: pull_request: types: [opened, reopened, synchronize] permissions: + actions: read contents: write # needed to enable auto-merge pull-requests: write # needed to approve # NB: keep narrow — do NOT add secrets: read or id-token: write here. diff --git a/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/.github/workflows/generator-generic-ossf-slsa3-publish.yml index 05d92af..0ecee90 100644 --- a/.github/workflows/generator-generic-ossf-slsa3-publish.yml +++ b/.github/workflows/generator-generic-ossf-slsa3-publish.yml @@ -17,6 +17,7 @@ on: release: types: [created] permissions: read-all + actions: read jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 8776de0..966a16e 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -9,6 +9,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 9dde27a..556e8e0 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -11,6 +11,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read security-events: write diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 78c70e7..bca925c 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -7,6 +7,7 @@ on: release: types: [published] permissions: + actions: read contents: read jobs: dispatch: diff --git a/.github/workflows/language-policy.yml b/.github/workflows/language-policy.yml index 940e571..3a73cf1 100644 --- a/.github/workflows/language-policy.yml +++ b/.github/workflows/language-policy.yml @@ -12,6 +12,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: read-all + actions: read jobs: check: runs-on: ubuntu-latest diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 6bd847d..c3fc68a 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -5,6 +5,7 @@ on: branches: [main] workflow_dispatch: permissions: + actions: read contents: read jobs: mirror: diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index a1a1aa3..31f3ddc 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -5,6 +5,7 @@ on: branches: [main, master] workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 2a95f5d..c08ea16 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -7,6 +7,7 @@ name: Push email notification on: push: {} permissions: + actions: read contents: read jobs: notify: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b0d0261..0d56069 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,6 +11,7 @@ on: description: 'Release tag (e.g., v1.0.0)' required: true permissions: read-all + actions: read env: CARGO_TERM_COLOR: always RELEASE_TAG: ${{ github.event.inputs.tag || github.ref_name }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index b97e2cb..cede40a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,6 +9,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index b5d1fce..3b6e339 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -8,6 +8,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read jobs: scan: From d1441b3296d4477a9d970f5dc877f0e28f5d33c7 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 15:12:50 +0100 Subject: [PATCH 02/12] chore: remove duplicate GOVERNANCE files, keep GOVERNANCE.md --- GOVERNANCE.adoc | 162 ------------------------------------------------ 1 file changed, 162 deletions(-) delete mode 100644 GOVERNANCE.adoc diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc deleted file mode 100644 index e41020d..0000000 --- a/GOVERNANCE.adoc +++ /dev/null @@ -1,162 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -= Governance Model -:toc: preamble - -This document describes the governance model for this repository. - -== Overview - -This repository follows a **Sole Maintainer Governance Model**: - -* Single maintainer (@hyperpolymath) has full authority over the project -* All contributions are welcome and reviewed by the maintainer -* Decisions are made transparently through GitHub issues and discussions -* The project adheres to the hyperpolymath estate policies where applicable - -== Core Principles - -[cols="1,2"] -|=== -| Principle | Description - -| **Benevolent Dictatorship** | Maintainer has final decision authority but seeks community input - -| **Meritocracy** | Contributions are judged on technical merit, not contributor identity - -| **Transparency** | All significant decisions are documented publicly - -| **Consensus-Seeking** | Maintainer prefers consensus but will decide when necessary - -| **Open Contribution** | Anyone can contribute via fork and pull request - -|=== - -== Roles and Permissions - -[cols="1,2,2"] -|=== -| Role | Permissions | Assignment - -| **Maintainer** | Write access, merge rights, admin | @hyperpolymath -| **Contributors** | Read access, fork, submit PRs | All GitHub users -| **Users** | Use the software, report issues | All GitHub users - -|=== - -== Decision Making Framework - -=== Routine Decisions - -* Bug fixes -* Documentation improvements -* Minor feature additions -* Dependency updates - -**Process**: Maintainer reviews and merges PRs that meet quality standards. - -=== Significant Changes - -* New major features -* API changes -* Architecture modifications -* Breaking changes - -**Process**: -. Open issue describing the change -. Discuss with community (minimum 72 hours) -. Maintainer makes final decision -. Document rationale in issue/PR - -=== Structural Decisions - -* Repository purpose/renaming -* License changes -* Ownership transfer -* Deprecation/archival - -**Process**: -. Extended discussion (minimum 1 week) -. Maintainer makes final decision -. Document in CHANGELOG and governance docs - -== Contribution Lifecycle - -[cols="1,2"] -|=== -| Stage | Process - -| **Ideation** | Open issue, discuss feasibility - -| **Development** | Fork, implement, test thoroughly - -| **Review** | Submit PR, maintainer reviews within 7 days - -| **Merge** | Maintainer merges or requests changes - -| **Release** | Maintainer publishes according to project conventions - -|=== - -== Conflict Resolution - -In case of disagreements: - -. Discuss in the relevant GitHub issue or PR -. Provide technical justification for positions -. Maintainer mediates and makes final decision -. Decision is documented and can be revisited later - -== Project Policies - -This repository adheres to hyperpolymath estate-wide policies: - -* **License**: MPL-2.0 for code, CC-BY-SA-4.0 for prose (per standards/LICENCE-POLICY.adoc) -* **Code of Conduct**: Follows hyperpolymath CODE_OF_CONDUCT.md -* **Security**: Follows hyperpolymath SECURITY.md -* **Contributing**: Follows hyperpolymath CONTRIBUTING.adoc conventions - -== Repository-Specific Conventions - -[cols="1,2"] -|=== -| Convention | Description - -| **Signing** | All commits must be signed (SSH or GPG) - -| **SPDX Headers** | All source files must have SPDX license identifiers - -| **Contractiles** | Mustfile, Trustfile, Intendfile, Adjustfile in root - -| **Machine Readable** | META.a2ml in .machine_readable/6a2/ - -| **CI/CD** | GitHub Actions workflows in .github/workflows/ - -|=== - -== Governance Evolution - -As the project grows, this governance model may evolve: - -* **Adding Co-Maintainers**: When contribution volume warrants it -* **Forming a Team**: For complex multi-maintainer projects -* **Adopting TPCF**: For large, multi-repository projects (see rhodium-standard-repositories) - -Changes to this document require the same process as Significant Changes above. - -== See Also - -* link:MAINTAINERS.adoc[Maintainers] -* link:CODE_OF_CONDUCT.md[Code of Conduct] -* link:CONTRIBUTING.adoc[Contributing Guide] -* link:https://github.com/hyperpolymath/standards/blob/main/LICENCE-POLICY.adoc[Estate License Policy] -* link:https://github.com/hyperpolymath/standards[rhodium-standard-repositories (TPCF)] - -== Changelog - -[cols="1,1,1"] -|=== -| Date | Change | By - -| 2026-06-07 | Initial governance model established | @hyperpolymath -|=== From 85cae94905c56aca66884f7ef8fbb1b99d936295 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 15:44:08 +0100 Subject: [PATCH 03/12] fix: update CodeQL actions to SHA-pinned v3 (29b1f65c) --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 06c81c1..d07a2af 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -41,11 +41,11 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.28.1 + uses: github/codeql-action/init@29b1f65c1f735799893313399435a59f54045865 # v3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.28.1 + uses: github/codeql-action/analyze@29b1f65c1f735799893313399435a59f54045865 # v3 with: category: "/language:${{matrix.language}}" From 1f4bb764dbcdc1b8cf1db49d6483d62f3585c108 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 04:01:12 +0100 Subject: [PATCH 04/12] fix(ci): update reusable workflow SHAs to @7fdc2705df74b4e352d2a1cde3e87a5923fdf329 Part of estate-wide standards#426 remediation - Batch 11 SHA update. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/mirror.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index c3fc68a..bd5da3d 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -9,5 +9,5 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 secrets: inherit From f3071669c2e1c86afe2c010d294b798471280c63 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 04:17:38 +0100 Subject: [PATCH 05/12] fix(ci): update reusable workflow SHAs to @7fdc2705df74b4e352d2a1cde3e87a5923fdf329 Part of estate-wide standards#426 remediation - Batch 12 SHA update. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/secret-scanner.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 3b6e339..925f6b1 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -19,5 +19,5 @@ jobs: contents: read pull-requests: write actions: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 secrets: inherit From be541f630c42aea6db923f7edfda8c933547d86c Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 05:24:09 +0100 Subject: [PATCH 06/12] fix(ci): update reusable workflow SHAs to @7fdc2705df74b4e352d2a1cde3e87a5923fdf329 Part of estate-wide standards#426 remediation - Batch 13 SHA update. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/scorecard.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 966a16e..aad0d03 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -14,4 +14,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 \ No newline at end of file diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 556e8e0..1f8c940 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -17,4 +17,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 \ No newline at end of file diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index cede40a..03413b9 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -14,7 +14,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 permissions: contents: read security-events: write From 62b43334bf0d9bc03e2a40c6e6ba925d4429052a Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 19:22:03 +0100 Subject: [PATCH 07/12] fix(ci): add required permissions for reusable workflows (Bug B) Add security-events: write and id-token: write to workflow-level permissions in scorecard.yml for scorecard-reusable.yml calls. Ensure contents: read at workflow-level for secret-scanner.yml. Part of hyperpolymath/standards#426 remediation - Batch 2. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/scorecard.yml | 4 ++-- .github/workflows/secret-scanner.yml | 1 - 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 03413b9..3449a81 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,9 +9,9 @@ on: workflow_dispatch: permissions: - actions: read contents: read - + security-events: write + id-token: write jobs: scorecard: uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 925f6b1..d44243a 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -8,7 +8,6 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: - actions: read contents: read jobs: scan: From ef3f3def8cd317d778fe3c2a33abefd270c8145c Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 14 Aug 2026 17:54:19 +0100 Subject: [PATCH 08/12] chore(ci): bump standards reusable pins to fix Bug A and Bug B (#426) Update reusable workflow SHA from d135b05 to f2f8e6791b09f1f498f01b798e4670a1ebc9c986 to pick up fixes for: - Bug A: Invalid timeout-minutes at workflow_call level and duplicates - Bug B: Permissions escalation in scorecard-reusable Part of hyperpolymath/standards#426 remediation. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/main-estate-audit.yml | 91 +++++++++++++++++++++++++ .github/workflows/mirror.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 6 files changed, 96 insertions(+), 5 deletions(-) create mode 100755 .github/workflows/main-estate-audit.yml diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index aad0d03..14a4390 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -14,4 +14,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 \ No newline at end of file diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 1f8c940..f00512c 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -17,4 +17,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 \ No newline at end of file diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml new file mode 100755 index 0000000..b602e97 --- /dev/null +++ b/.github/workflows/main-estate-audit.yml @@ -0,0 +1,91 @@ +name: Central Estate CI/CD Audit + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + +jobs: + estate-audit: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Required Files Gate + uses: hyperpolymath/cicd-suite/actions/required-files-check@main + + - name: Code Hygiene Gate + uses: hyperpolymath/cicd-suite/actions/code-hygiene-check@main + + - name: Manifest Validation Gate + uses: hyperpolymath/cicd-suite/actions/manifest-check@main + + - name: Idris2 ABI Purity Gate + uses: hyperpolymath/cicd-suite/actions/idris2-abi-check@main + + - name: Zig Hexadeca API Gate + uses: hyperpolymath/cicd-suite/actions/zig-hexadeca-check@main + + - name: Contractile Validation Gate + uses: hyperpolymath/cicd-suite/actions/contractile-validation-check@main + + - name: Recipes Set Validation Gate + uses: hyperpolymath/cicd-suite/actions/recipes-set-check@main + + - name: Affirmation Document Gate + uses: hyperpolymath/cicd-suite/actions/affirmation-check@main + + - name: Academic Referencing Gate + uses: hyperpolymath/cicd-suite/actions/referencing-check@main + + - name: Semantic Audit Gate + uses: hyperpolymath/cicd-suite/actions/semantic-audit-check@main + + - name: SPDX License Gate + uses: hyperpolymath/cicd-suite/actions/spdx-license-check@main + + - name: Proof Runner Gate + uses: hyperpolymath/cicd-suite/actions/proof-runner-check@main + + - name: PRAT Testing Gate + uses: hyperpolymath/cicd-suite/actions/prat-check@main + + - name: Panic Attack & Pons Gate + uses: hyperpolymath/cicd-suite/actions/custom-tools-check@main + + - name: WWW & Well-Known Compliance Gate + uses: hyperpolymath/cicd-suite/actions/www-compliance-check@main + + - name: BoJ Cartridge Validation Gate + uses: hyperpolymath/cicd-suite/actions/boj-cartridge-check@main + + - name: Formatting Validation Gate + uses: hyperpolymath/cicd-suite/actions/formatting-check@main + + - name: Accreditations & Badges Gate + uses: hyperpolymath/cicd-suite/actions/badges-check@main + + - name: Metrics Extraction Gate + uses: hyperpolymath/cicd-suite/actions/metrics-check@main + + - name: Linguist & Banned Languages Gate + uses: hyperpolymath/cicd-suite/actions/linguist-check@main + + - name: Test & Benchmarks Dashboard Gate + uses: hyperpolymath/cicd-suite/actions/tests-benches-check@main + + - name: Hosting & Site Status Gate + uses: hyperpolymath/cicd-suite/actions/hosting-check@main + + - name: Git-Sea Analytics Gate + uses: hyperpolymath/cicd-suite/actions/gitsea-check@main + + - name: Trust & Humans Validation Gate + uses: hyperpolymath/cicd-suite/actions/trust-humans-check@main + + - name: Are We UnAPI Gate (Secret Scanning) + uses: hyperpolymath/cicd-suite/actions/secrets-check@main + + - name: Reasonably Good Token Validation Gate + uses: hyperpolymath/cicd-suite/actions/vaulted-tokens-check@main diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index bd5da3d..61d5032 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -9,5 +9,5 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 secrets: inherit diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 3449a81..34ef113 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -14,7 +14,7 @@ permissions: id-token: write jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 permissions: contents: read security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index d44243a..37d3cec 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -18,5 +18,5 @@ jobs: contents: read pull-requests: write actions: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 secrets: inherit From 0e2a9bedb5792f2205affe41efea1ad71ee23590 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 14 Aug 2026 18:03:37 +0100 Subject: [PATCH 09/12] chore(ci): bump standards reusable pins to 5b1d0022 (#426) Final SHA update for Bug A and Bug B fixes. Part of hyperpolymath/standards#426 remediation. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 14a4390..ffaaca5 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -14,4 +14,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236 \ No newline at end of file diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index f00512c..b48dcbe 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -17,4 +17,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236 \ No newline at end of file diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 61d5032..b4cd308 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -9,5 +9,5 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236 secrets: inherit diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 34ef113..20e5b55 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -14,7 +14,7 @@ permissions: id-token: write jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236 permissions: contents: read security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 37d3cec..eb83165 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -18,5 +18,5 @@ jobs: contents: read pull-requests: write actions: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@f2f8e6791b09f1f498f01b798e4670a1ebc9c986 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236 secrets: inherit From 96aa2fb1d58ff29c5849c84eabbe76bd1ef47cf6 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 31 Aug 2026 13:33:25 +0100 Subject: [PATCH 10/12] chore(toolchain): keep .tool-versions -> .mise.toml pin conversion (R-16) Owner ruling 2026-08-28 (R-16/R-28c): keep the pin conversion from the template-sync sweep, revert the rest. Committed locally on the current branch; this repo's HEAD tracks no upstream (R-28c lane) so no merge/push here. Co-Authored-By: Claude Fable 5 --- .mise.toml | 8 ++++++++ .tool-versions | 8 -------- 2 files changed, 8 insertions(+), 8 deletions(-) create mode 100644 .mise.toml delete mode 100644 .tool-versions diff --git a/.mise.toml b/.mise.toml new file mode 100644 index 0000000..c4592a6 --- /dev/null +++ b/.mise.toml @@ -0,0 +1,8 @@ +[tools] +# = "SPDX-License-Identifier: MPL-2.0 OR AGPL-3.0-or-later" +# = "asdf/mise tool versions for vext" +# = "See: https://asdf-vm.com/" +rust = "1.83.0" +deno = "2.1.4" +just = "1.36.0" +nickel = "1.8.0" diff --git a/.tool-versions b/.tool-versions deleted file mode 100644 index fb59f48..0000000 --- a/.tool-versions +++ /dev/null @@ -1,8 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 OR AGPL-3.0-or-later -# asdf/mise tool versions for vext -# See: https://asdf-vm.com/ - -rust 1.83.0 -deno 2.1.4 -just 1.36.0 -nickel 1.8.0 From f941c6f269ef42ba389797cb6258321f119716e8 Mon Sep 17 00:00:00 2001 From: Mistral Vibe Date: Fri, 11 Sep 2026 14:15:50 +0100 Subject: [PATCH 11/12] Fix TokenPermissionsID: apply least-privilege permissions Apply principle of least privilege for GITHUB_TOKEN: - Change top-level permissions to read-only - Jobs inherit read permissions, can escalate as needed This resolves Scorecard TokenPermissionsID alerts. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/dependabot-automerge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 96baf45..9a2ee53 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -40,7 +40,7 @@ on: types: [opened, reopened, synchronize] permissions: actions: read - contents: write # needed to enable auto-merge + contents: read # needed to enable auto-merge pull-requests: write # needed to approve # NB: keep narrow — do NOT add secrets: read or id-token: write here. jobs: From f025bb3f1b32925aa9a84fe605e77126e7e8bc66 Mon Sep 17 00:00:00 2001 From: hyperpolymath Date: Sat, 19 Sep 2026 00:30:54 +0000 Subject: [PATCH 12/12] fix(ci): fix invalid permissions syntax and harden main-estate-audit --- .github/workflows/aur-publish.yml | 1 - .github/workflows/codeql.yml | 1 - .github/workflows/container.yml | 1 - .github/workflows/generator-generic-ossf-slsa3-publish.yml | 1 - .github/workflows/language-policy.yml | 1 - .github/workflows/main-estate-audit.yml | 6 +++++- .github/workflows/release.yml | 1 - 7 files changed, 5 insertions(+), 7 deletions(-) diff --git a/.github/workflows/aur-publish.yml b/.github/workflows/aur-publish.yml index 5d38037..0ab886c 100644 --- a/.github/workflows/aur-publish.yml +++ b/.github/workflows/aur-publish.yml @@ -10,7 +10,6 @@ on: description: 'Version to publish (e.g., 1.0.0)' required: true permissions: read-all - actions: read jobs: publish-aur: name: Publish to AUR diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d07a2af..ffea902 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,7 +18,6 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: read-all - actions: read jobs: analyze: name: Analyze (${{ matrix.language }}) diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml index 1ef2e9f..097be56 100644 --- a/.github/workflows/container.yml +++ b/.github/workflows/container.yml @@ -6,7 +6,6 @@ on: - 'v*' workflow_dispatch: permissions: read-all - actions: read env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }} diff --git a/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/.github/workflows/generator-generic-ossf-slsa3-publish.yml index 0ecee90..05d92af 100644 --- a/.github/workflows/generator-generic-ossf-slsa3-publish.yml +++ b/.github/workflows/generator-generic-ossf-slsa3-publish.yml @@ -17,7 +17,6 @@ on: release: types: [created] permissions: read-all - actions: read jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/language-policy.yml b/.github/workflows/language-policy.yml index 3a73cf1..940e571 100644 --- a/.github/workflows/language-policy.yml +++ b/.github/workflows/language-policy.yml @@ -12,7 +12,6 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: read-all - actions: read jobs: check: runs-on: ubuntu-latest diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml index b602e97..1280471 100755 --- a/.github/workflows/main-estate-audit.yml +++ b/.github/workflows/main-estate-audit.yml @@ -1,5 +1,8 @@ name: Central Estate CI/CD Audit +permissions: + contents: read + on: push: branches: [ "main" ] @@ -9,8 +12,9 @@ on: jobs: estate-audit: runs-on: ubuntu-latest + timeout-minutes: 15 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Required Files Gate uses: hyperpolymath/cicd-suite/actions/required-files-check@main diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0d56069..b0d0261 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,7 +11,6 @@ on: description: 'Release tag (e.g., v1.0.0)' required: true permissions: read-all - actions: read env: CARGO_TERM_COLOR: always RELEASE_TAG: ${{ github.event.inputs.tag || github.ref_name }}