From 04b8febdff2675afecb02b4ef7dcf9d279f4447d Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 3 Sep 2026 17:00:16 +0100
Subject: [PATCH 1/2] fix(ci): bump standards pin off diverged SHA 7fdc2705

7fdc2705 is not an ancestor of standards/main (compare: status=diverged,
ahead=4, behind=114) and no branch contains it. GitHub Actions cannot
resolve a reusable workflow at that SHA, so every run died at startup with
zero jobs and 'This run likely failed because of a workflow file issue'.

Repointed to standards main HEAD, where all three reusables exist.
---
 .github/workflows/governance.yml   | 2 +-
 .github/workflows/hypatia-scan.yml | 2 +-
 .github/workflows/scorecard.yml    | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 03ae4d7..3ecb8d8 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -30,4 +30,4 @@ permissions:
   contents: read
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@ba9506eb36a78cd081ea10ffcc543e0f1abd840b
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index a90f3ea..19bdcb5 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -39,5 +39,5 @@ permissions:
   pull-requests: write
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@ba9506eb36a78cd081ea10ffcc543e0f1abd840b
     secrets: inherit
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index e5a8a10..cd693b1 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -36,4 +36,4 @@ jobs:
       contents: read
       security-events: write
       id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@ba9506eb36a78cd081ea10ffcc543e0f1abd840b

From 9e901cf539cac141fe9c16746cad37f28586e640 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 4 Sep 2026 10:11:02 +0100
Subject: [PATCH 2/2] fix(ci): pin standards reusables to main HEAD a3308ea8

ba9506eb is reachable but not default-branch HEAD. At that revision the
governance job's .standards-dupkey sparse-checkout lists only
check-workflow-duplicate-keys.sh and check-workflows-parse.sh, while the
same step also reads scripts/update-actions-lock.sh -- a path never added
to the pattern list, so the lock verifier can never land on the runner.
main (a3308ea8) already fixes this with a separate .standards-lock
checkout listing both lock scripts.

A pin-repair target must be default-branch HEAD resolved at sweep time; a
reachable non-HEAD sha silently reintroduces every bug fixed since.
---
 .github/workflows/governance.yml   | 2 +-
 .github/workflows/hypatia-scan.yml | 2 +-
 .github/workflows/scorecard.yml    | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 3ecb8d8..5629402 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -30,4 +30,4 @@ permissions:
   contents: read
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@ba9506eb36a78cd081ea10ffcc543e0f1abd840b
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@a3308ea8d0cc513727c8ad149b1132317a886c98
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 19bdcb5..1461b70 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -39,5 +39,5 @@ permissions:
   pull-requests: write
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@ba9506eb36a78cd081ea10ffcc543e0f1abd840b
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@a3308ea8d0cc513727c8ad149b1132317a886c98
     secrets: inherit
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index cd693b1..eebefe6 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -36,4 +36,4 @@ jobs:
       contents: read
       security-events: write
       id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@ba9506eb36a78cd081ea10ffcc543e0f1abd840b
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@a3308ea8d0cc513727c8ad149b1132317a886c98