From b265982ba749f5f91b812d251df7058e59771c50 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 2 Jun 2026 19:28:20 +0100 Subject: [PATCH 1/4] =?UTF-8?q?ci(codeql):=20cron=20weekly=E2=86=92monthly?= =?UTF-8?q?=20(cut=203,=20standards#288)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per `standards#286` canonical (cut 3, Option B 2026-05-30): convert CodeQL scheduled run from weekly `0 6 * * 1` to monthly `0 6 1 * *`. PR-trigger runs unchanged — every PR still gets CodeQL. Refs `hyperpolymath/standards#288` (campaign). Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9e32d15..f50a1d1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -7,7 +7,7 @@ on: pull_request: branches: [main, master] schedule: - - cron: '0 6 * * 1' + - cron: '0 6 1 * *' # monthly 1st 06:00 UTC # Estate guardrail: cancel superseded runs so re-pushes / rebased PR # updates do not pile up queued runs against the shared account-wide From e7d71c3489004fd1506e078c1ceb6402b63b3287 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 01:51:13 +0100 Subject: [PATCH 2/4] fix(ci): remove erroneous squisher-corpus guix.scm placeholder Part of estate-wide standards#426 remediation - cleanup. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- guix.scm | 71 -------------------------------------------------------- 1 file changed, 71 deletions(-) delete mode 100644 guix.scm diff --git a/guix.scm b/guix.scm deleted file mode 100644 index cdf73ef..0000000 --- a/guix.scm +++ /dev/null @@ -1,71 +0,0 @@ -;; SPDX-License-Identifier: MPL-2.0 -;; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -;; -;; Guix package definition for {{PROJECT_NAME}} -;; -;; Usage: -;; guix shell -D -f guix.scm # Enter development shell -;; guix build -f guix.scm # Build package -;; -;; TODO: Replace {{PROJECT_NAME}} and customize inputs for your language/stack. -;; See: https://guix.gnu.org/manual/en/html_node/Defining-Packages.html - -(use-modules (guix packages) - (guix gexp) - (guix git-download) - (guix build-system gnu) - (guix licenses) - (gnu packages base)) - -(package - (name "{{PROJECT_NAME}}") - (version "0.1.0") - (source (local-file "." "source" - #:recursive? #t - #:select? (lambda (file stat) - (not (string-contains file ".git"))))) - (build-system gnu-build-system) - (arguments - '(#:phases - (modify-phases %standard-phases - ;; TODO: Customize build phases for your project - ;; Examples for common stacks: - ;; - ;; Rust: - ;; (replace 'build (lambda _ (invoke "cargo" "build" "--release"))) - ;; (replace 'check (lambda _ (invoke "cargo" "test"))) - ;; - ;; Elixir: - ;; (replace 'build (lambda _ (invoke "mix" "compile"))) - ;; (replace 'check (lambda _ (invoke "mix" "test"))) - ;; - ;; Zig: - ;; (replace 'build (lambda _ (invoke "zig" "build"))) - ;; (replace 'check (lambda _ (invoke "zig" "build" "test"))) - (delete 'configure) - (delete 'build) - (delete 'check) - (replace 'install - (lambda* (#:key outputs #:allow-other-keys) - (let ((out (assoc-ref outputs "out"))) - (mkdir-p (string-append out "/share/doc")) - (copy-file "README.adoc" - (string-append out "/share/doc/README.adoc")))))))) - (native-inputs - (list - ;; TODO: Add build-time dependencies - ;; Examples: - ;; rust (gnu packages rust) - ;; elixir (gnu packages elixir) - ;; zig (gnu packages zig) - )) - (inputs - (list - ;; TODO: Add runtime dependencies - )) - (home-page "https://github.com/hyperpolymath/{{PROJECT_NAME}}") - (synopsis "{{PROJECT_PURPOSE}}") - (description "RSR-compliant project. See README.adoc for details.") - (license (list - ;; MPL-2.0 extends MPL-2.0 - mpl2.0))) From 0c073e41e4ea525179e430de9ae0857a5caafd73 Mon Sep 17 00:00:00 2001 From: Mistral Vibe Date: Fri, 11 Sep 2026 14:16:09 +0100 Subject: [PATCH 3/4] Fix TokenPermissionsID: apply least-privilege permissions Apply principle of least privilege for GITHUB_TOKEN: - Change top-level permissions to read-only - Jobs inherit read permissions, can escalate as needed This resolves Scorecard TokenPermissionsID alerts. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/rhodibot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml index 45c74cc..8cd6c47 100644 --- a/.github/workflows/rhodibot.yml +++ b/.github/workflows/rhodibot.yml @@ -21,7 +21,7 @@ on: types: [completed] permissions: - contents: write + contents: read pull-requests: write jobs: From 694026cd5f7004ddb2c8bf021e7e4046d2aeebfa Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Sun, 13 Sep 2026 20:51:43 +0000 Subject: [PATCH 4/4] ci(rhodibot): grant write access to repository contents --- .github/workflows/rhodibot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml index 8cd6c47..45c74cc 100644 --- a/.github/workflows/rhodibot.yml +++ b/.github/workflows/rhodibot.yml @@ -21,7 +21,7 @@ on: types: [completed] permissions: - contents: read + contents: write pull-requests: write jobs: