From 72111863642438f3eb3d94e2e47f967d0cbe8bb7 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 1 Nov 2026 09:39:31 +0000
Subject: [PATCH 1/2] fix(ci): reconcile canonical-owner closure receipts with
 reviewed pinned source

---
 scripts/lib/lock-closure-receipts.tsv | 28 ++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/scripts/lib/lock-closure-receipts.tsv b/scripts/lib/lock-closure-receipts.tsv
index 0ea96303..69aedb7d 100644
--- a/scripts/lib/lock-closure-receipts.tsv
+++ b/scripts/lib/lock-closure-receipts.tsv
@@ -21,10 +21,10 @@
 #
 # PROVENANCE (re-emit, do not hand-edit)
 #   standards@75bd5994470661a099df562d6d5ad2fe744dbd66
-#     source: hyperpolymath/standards .github/workflows/{governance,hypatia-scan,
+#     source: metadatastician/standards .github/workflows/{governance,hypatia-scan,
 #             mirror,scorecard,secret-scanner}-reusable.yml at that commit
 #     command: ./scripts/audit-lock-closure.sh \
-#                --emit-receipt hyperpolymath/standards@75bd599... \
+#                --emit-receipt metadatastician/standards@75bd599... \
 #                --source <each of the five files>
 #   actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9
 #     source: action.yml at the commit the tag v5.0.0 resolved to when the lock
@@ -39,15 +39,17 @@
 # new receipt for the new commit and remove the old rows in the same change.
 #
 # fields: source <TAB> commit <TAB> nested-ref
-hyperpolymath/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
-hyperpolymath/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
-hyperpolymath/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
-hyperpolymath/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed
-hyperpolymath/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f
-hyperpolymath/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393
-hyperpolymath/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124
-hyperpolymath/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63
-hyperpolymath/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc
-hyperpolymath/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
-hyperpolymath/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555
+metadatastician/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+metadatastician/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+metadatastician/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+metadatastician/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed
+metadatastician/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f
+metadatastician/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393
+metadatastician/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124
+metadatastician/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63
+metadatastician/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc
+metadatastician/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+metadatastician/standards	75bd5994470661a099df562d6d5ad2fe744dbd66	webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555
 actions/upload-pages-artifact	fc324d3547104276b827a68afc52ff2a11cc49c9	actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
+# Reviewed source: hyperpolymath/cicd-suite/.github/workflows/secret-scanner-reusable.yml@4404c3c0474e17753fe7689f3485c02890aac113
+hyperpolymath/cicd-suite	4404c3c0474e17753fe7689f3485c02890aac113	actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

From 25f6d242b392eb17a75d937e90685a450c3b558e Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 1 Nov 2026 09:45:54 +0000
Subject: [PATCH 2/2] fix(ci): fail closed for incomplete scanner migration,
 accept reviewed applied state

---
 .../secret-scanner-cicd-suite/preflight.sh    | 32 ++++++++++++++++---
 1 file changed, 27 insertions(+), 5 deletions(-)

diff --git a/docs/migrations/secret-scanner-cicd-suite/preflight.sh b/docs/migrations/secret-scanner-cicd-suite/preflight.sh
index 624d9c29..42c60ec5 100755
--- a/docs/migrations/secret-scanner-cicd-suite/preflight.sh
+++ b/docs/migrations/secret-scanner-cicd-suite/preflight.sh
@@ -77,15 +77,37 @@ cp "$ROOT/scripts/audit-lock-closure.sh" "$TMP/tree/scripts/" 2>/dev/null || fin
 cp "$ROOT/scripts/lib/lock-closure-receipts.tsv" "$TMP/tree/scripts/lib/" 2>/dev/null || true
 cp "$ROOT/scripts/lib/lock-audit-baseline.tsv" "$TMP/tree/scripts/lib/" 2>/dev/null || true
 
+# A prepared migration can subsequently be applied by an approved PR.
+# In that case old patch hunks no longer apply; check the final artifacts.
 apply_ok=1
-for p in secret-scanner.yml.patch actions.lock.patch lock-closure-receipts.tsv.patch; do
-  if ! ( cd "$TMP/tree" && patch -p1 -s -f --no-backup-if-mismatch < "$MIG/patches/$p" ); then
-    finding PATCH-APPLY "patch does not apply to the current checkout: $p"
+already_applied=0
+if [ -f "$TMP/tree/.github/workflows/secret-scanner.yml" ] &&
+   grep -Fq "uses: $CALLEE" "$TMP/tree/.github/workflows/secret-scanner.yml"; then
+  already_applied=1
+  source_key="'hyperpolymath/cicd-suite@$SUITE_SHA'"
+  # Both caller's workflow map and dependency record must exist.
+  count=$(grep -Fc "$source_key" "$TMP/tree/.github/workflows/actions.lock" 2>/dev/null || true)
+  if [ "$count" -lt 2 ]; then
+    finding LOCK-MISSING "applied scanner lacks both pinned suite caller and dependency records"
     apply_ok=0
   fi
-done
+  receipt=$(printf 'hyperpolymath/cicd-suite\t%s\tactions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' "$SUITE_SHA")
+  if ! grep -Fxq "$receipt" "$TMP/tree/scripts/lib/lock-closure-receipts.tsv" 2>/dev/null; then
+    finding CLOSURE-NO-RECEIPT "applied scanner lacks the reviewed pinned-suite closure receipt"
+    apply_ok=0
+  fi
+else
+  for p in secret-scanner.yml.patch actions.lock.patch lock-closure-receipts.tsv.patch; do
+    if ! ( cd "$TMP/tree" && patch -p1 -s -f --no-backup-if-mismatch < "$MIG/patches/$p" ); then
+      finding PATCH-APPLY "patch does not apply to the current checkout: $p"
+      apply_ok=0
+    fi
+  done
+fi
 
-if [ "$CHECK_APPLY" -eq 1 ]; then
+# The intended migration must be applicable OR already applied with its
+# reviewed pinned artifacts. Partial transitions never count as success.
+if [ "$CHECK_APPLY" -eq 1 ] && [ "$already_applied" -eq 0 ]; then
   for p in "$MIG"/patches/*.patch; do
     if ! ( cd "$ROOT" && patch -p1 --dry-run -s -f < "$p" >/dev/null 2>&1 ); then
       finding PATCH-APPLY "patch --dry-run failed against $ROOT: $(basename "$p")"