From 4e97eba1634a475920de45853023b5aea2abee8f Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 26 Oct 2026 17:56:33 +0000 Subject: [PATCH] ci: repin the standards reusables to metadatastician/standards The standards repository moved from hyperpolymath to metadatastician between 2026-10-25 and 2026-10-26. Since then every workflow that calls a standards reusable has failed at startup with zero jobs: the scheduled Scorecard, and Governance and Secret Scanner on PRs. Workflows that call nothing in standards (CodeQL, Hypatia, Agda) still run. choreographic-types failed the same way on the same day, on an unchanged commit and the same pin. Fix: - Point the four `uses:` lines at metadatastician/standards, keeping the same commit (75bd5994). - Move the actions.lock record to the new owner: the key, the four workflow entries, and owner_id 297579217. repo_id is unchanged, since a transfer keeps the repository id. gh actions-lock is not available here, so the lock record was edited by hand. This PR's own Governance and Secret Scanner runs are the test. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV --- .github/workflows/actions.lock | 12 ++++++------ .github/workflows/governance.yml | 4 ++-- .github/workflows/mirror.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 6677655..e67868a 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -10,7 +10,7 @@ workflows: - 'actions/checkout@v7.0.1' - 'github/codeql-action@v4.39.1' '.github/workflows/governance.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/hypatia-scan.yml': - 'actions/checkout@v7.0.1' - 'actions/github-script@v9.0.0' @@ -20,7 +20,7 @@ workflows: '.github/workflows/label-triage.yml': [] '.github/workflows/labels.yml': [] '.github/workflows/mirror.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/pages.yml': - 'actions/checkout@v7.0.1' - 'actions/deploy-pages@v5.0.1' @@ -28,9 +28,9 @@ workflows: '.github/workflows/push-email-notify.yml': - 'hyperpolymath/smtp-notify-action@v0.5.0' '.github/workflows/scorecard.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' '.github/workflows/secret-scanner.yml': - - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' + - 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66' dependencies: 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9': ref: 'v6.1.0' @@ -124,10 +124,10 @@ dependencies: commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef' owner_id: 6759885 repo_id: 1352485172 - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': + 'metadatastician/standards@75bd5994470661a099df562d6d5ad2fe744dbd66': ref: '75bd5994470661a099df562d6d5ad2fe744dbd66' commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66' - owner_id: 6759885 + owner_id: 297579217 repo_id: 1116521501 uses: - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 01242e7..94b40cd 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -3,7 +3,7 @@ # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. # governance.yml — single wrapper calling the shared estate governance bundle -# in hyperpolymath/standards instead of carrying per-repo copies. +# in metadatastician/standards instead of carrying per-repo copies. # # Replaces the per-repo governance scaffolding removed in the same commit: # quality.yml, guix-guix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml, @@ -38,4 +38,4 @@ jobs: # matches the sibling repos' pin (e.g. ochrance-framework). Bump # deliberately, never float: an unpinned reusable workflow is an # unpinned trust boundary. mirror.yml / scorecard.yml already pin. - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + uses: metadatastician/standards/.github/workflows/governance-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 0296a13..eb8d6cd 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -15,7 +15,7 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 # Explicit secrets map, not `secrets: inherit` (Hypatia WH008): the callee # (standards@75bd5994) declares exactly these seven, all optional. secrets: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 5de4b4b..656c84b 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -27,4 +27,4 @@ jobs: contents: read security-events: write id-token: write - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 0263a0d..8784f72 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -23,4 +23,4 @@ jobs: contents: read pull-requests: write actions: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66 + uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66