From ddf2742e4798e47b5758e53f4e6525b3ad73db84 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 27 Oct 2026 03:04:31 +0000 Subject: [PATCH] ci: scan hypatia with its own main instead of a hand-bumped pin governance.yml and hypatia-scan.yml pinned hypatia-ref to 23dc74d, so a rule fix merged to main (for example #966's risk-scoped RE001) reached hypatia's own gate only after someone bumped the SHA by hand. Pass `github.event.pull_request.base.sha || github.sha` instead. On a PR that is the base-branch commit, and otherwise the commit being run. It is never the PR head, so a PR still cannot weaken the rules that gate it, and the value is always a 40-hex SHA as the reusable requires. Only hypatia's own callers change; every other repo keeps the reusable's vetted default. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01J4QvDfStHgMdZGTeqaBgM1 --- .github/workflows/governance.yml | 13 +++++++------ .github/workflows/hypatia-scan.yml | 4 ++-- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 065c8f7b..370e8467 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -17,13 +17,14 @@ permissions: jobs: governance: uses: metadatastician/standards/.github/workflows/governance-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 - # Scanner pin, overriding the reusable's default (51ab649, which rejects the - # v0.0.3 actions.lock that gh actions-lock now writes). This is hypatia main - # with #938 (v0.0.3 lock), #942 (WH013 per-job credentials) and #947 - # (RE005 trap handlers). Drop this input once the standards callers are - # re-pinned to a default that includes them. + # Scanner pin: hypatia scans itself with its own main branch. On a PR that + # is the base commit; on push, schedule or dispatch it is the commit being + # run. It is never the PR head, so a PR cannot weaken the rules that gate + # it. Each merged rule fix reaches this gate with no hand bump. If main + # ships a broken rule, the PR that fixes it can pin a known-good 40-hex + # SHA here temporarily. Other repos keep the reusable's vetted default. with: - hypatia-ref: 23dc74de05fb34fe0e6f8d204fb65bf0625673a0 + hypatia-ref: ${{ github.event.pull_request.base.sha || github.sha }} permissions: actions: read contents: read diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 13a442aa..1a0dfb9a 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -22,9 +22,9 @@ permissions: jobs: hypatia: uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7 - # Scanner pin: see governance.yml. Drop once `uses:` is re-pinned. + # Scanner pin: hypatia's own main branch, never the PR head. See governance.yml. with: - hypatia-ref: 23dc74de05fb34fe0e6f8d204fb65bf0625673a0 + hypatia-ref: ${{ github.event.pull_request.base.sha || github.sha }} # Only the one secret the callee declares (standards#1108 ยง6b). secrets: HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }}