From 26deddc6b94d98c4cc38773d3439ab49da14511c Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 27 Jun 2026 11:57:08 +0100
Subject: [PATCH 1/4] ci: re-pin hypatia-scan reusable to standards HEAD
 d7c2271 (hypatia#464)

---
 .github/workflows/hypatia-scan.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 5a9f3bd..bc2d366 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -21,6 +21,6 @@ permissions:
   pull-requests: write
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
     timeout-minutes: 10
-    secrets: inherit
+    secrets: inherit
\ No newline at end of file

From 0d2ee657cba2f16364581a85483006e6e29f0594 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 27 Jun 2026 11:57:10 +0100
Subject: [PATCH 2/4] ci: re-pin governance reusable to standards HEAD d7c2271
 (hypatia#464)

---
 .github/workflows/governance.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 297d965..99d39de 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -27,5 +27,5 @@ permissions:
   contents: read
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
-    timeout-minutes: 10
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
+    timeout-minutes: 10
\ No newline at end of file

From 292f8f20393287008d2e8cc30c1e27556b0a3fdf Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 27 Jun 2026 11:57:11 +0100
Subject: [PATCH 3/4] ci: re-pin scorecard reusable to standards HEAD d7c2271
 (hypatia#464)

---
 .github/workflows/scorecard.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index e4f67fa..fafec22 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -12,6 +12,6 @@ jobs:
     permissions:
       security-events: write
       id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
     timeout-minutes: 10
-    secrets: inherit
+    secrets: inherit
\ No newline at end of file

From 420be2d6f0089c2d3ea236be6d9a77fc9e558602 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 27 Jun 2026 11:57:12 +0100
Subject: [PATCH 4/4] ci: remove retired scorecard-enforcer.yml (hypatia#464)

---
 .github/workflows/scorecard-enforcer.yml | 114 -----------------------
 1 file changed, 114 deletions(-)
 delete mode 100644 .github/workflows/scorecard-enforcer.yml

diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml
deleted file mode 100644
index 5f165fb..0000000
--- a/.github/workflows/scorecard-enforcer.yml
+++ /dev/null
@@ -1,114 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-# Prevention workflow - runs OpenSSF Scorecard and fails on low scores
-name: OpenSSF Scorecard Enforcer
-
-on:
-  push:
-    branches: [main]
-  schedule:
-    - cron: '0 6 * * 1'  # Weekly on Monday
-  workflow_dispatch:
-
-# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
-# updates do not pile up queued runs against the shared account-wide
-# Actions concurrency pool. Applied only to read-only check workflows
-# (no publish/mutation), so cancelling a superseded run is always safe.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  # Publish job. The OSSF attestation flow requires that a job invoking
-  # ossf/scorecard-action with publish_results: true contain ONLY `uses:`
-  # steps (no `run:`). A `run:` step in this job makes the OSSF publish
-  # endpoint reject the upload with HTTP 400 ("scorecard job must only have
-  # steps with `uses`"), failing the whole workflow. Score enforcement is
-  # therefore split into the separate unprivileged `score-gate` job below.
-  scorecard:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      security-events: write
-      id-token: write  # For OIDC
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - name: Run Scorecard
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          publish_results: true
-
-      - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
-        with:
-          sarif_file: results.sarif
-
-  # Unprivileged enforcement gate. Re-derives the score read-only (no
-  # publish, no id-token), so it may legally contain a `run:` step.
-  # NOTE: uses JSON output deliberately. The SARIF format does NOT carry the
-  # aggregate score at .runs[0].tool.driver.properties.score (it is absent
-  # there, so a SARIF-based gate reads the `// 0` fallback and ALWAYS fails
-  # the < MIN_SCORE check); the JSON format exposes the aggregate at the
-  # top-level `.score`. publish_results is false here and does not affect the
-  # computed score, so enforcement behaviour is unchanged.
-  score-gate:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - name: Run Scorecard (analysis only)
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
-        with:
-          results_file: results.json
-          results_format: json
-          publish_results: false
-
-      - name: Check minimum score
-        run: |
-          # JSON output carries the aggregate score at the top-level `.score`.
-          SCORE=$(jq -r '.score // 0' results.json 2>/dev/null || echo "0")
-
-          echo "OpenSSF Scorecard Score: $SCORE"
-
-          # Minimum acceptable score (0-10 scale)
-          MIN_SCORE=5
-
-          if [ "$(echo "$SCORE < $MIN_SCORE" | bc -l)" = "1" ]; then
-            echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE"
-            exit 1
-          fi
-
-  # Check specific high-priority items
-  check-critical:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-
-      - name: Check SECURITY.md exists
-        run: |
-          if [ ! -f "SECURITY.md" ]; then
-            echo "::error::SECURITY.md is required"
-            exit 1
-          fi
-
-      - name: Check for pinned dependencies
-        run: |
-          # Check workflows for unpinned actions
-          unpinned=$(grep -r "uses:.*@v[0-9]" .github/workflows/*.yml 2>/dev/null | grep -v "#" | head -5 || true)
-          if [ -n "$unpinned" ]; then
-            echo "::warning::Found unpinned actions:"
-            echo "$unpinned"
-          fi