Merge branch 'main' into banner/cicd-squabbler

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -35,11 +35,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.28.1
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v3.28.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.28.1
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v3.28.1
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/dogfood-gate.yml

@@ -42,7 +42,7 @@ jobs:
 
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
-        uses: hyperpolymath/a2ml-validate-action@cb3c1e298169dc5ac2b42e257068b0fb5920cd5e # main
+        uses: hyperpolymath/a2ml-validate-action@05bcb78917c09702e90ed18004298a6728753914 # main
         with:
           path: '.'
           strict: 'false'
@@ -91,7 +91,7 @@ jobs:
 
       - name: Validate K9 contracts
         if: steps.detect.outputs.k9_count > 0
-        uses: hyperpolymath/k9-validate-action@236f0035cc159051c8dd5dc7cd8af1e8cf961462 # main
+        uses: hyperpolymath/k9-validate-action@bddcd9109ee96f9ea3fdb4bf51084fe9cd0909ce # main
         with:
           path: '.'
           strict: 'false'

.github/workflows/push-email-notify.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send push notification email
-        uses: dawidd6/action-send-mail@994f270325d4f7257aff241a35488ef54ba364a4 # pinned
+        uses: dawidd6/action-send-mail@c50dc4cc848ade21f848990889906d804fae78c5 # pinned
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}

.github/workflows/quality.yml

@@ -26,7 +26,7 @@ jobs:
         run: |
           find . -type f -perm /111 -name "*.sh" | head -10 || true
       - name: Check for secrets
-        uses: trufflesecurity/trufflehog@30d5bb91af1a771378349dbbb0c82129392acf70 # v3.93.3
+        uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.93.3
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha || github.event.before }}

.github/workflows/scorecard.yml

@@ -16,10 +16,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@a44c93a5cd3d293ee3e8b488444dcdc19c4e5d49
-    # Reusable called-workflow permissions are CAPPED by the caller's grants;
-    # without security-events: write here the scorecard SARIF upload fails with
-    # startup_failure (hypatia WF018). id-token: write enables OIDC publish.
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
     permissions:
       contents: read
       security-events: write

.github/workflows/secret-scanner.yml

@@ -13,8 +13,6 @@ concurrency:
 # at plan time with zero jobs.
 permissions:
   contents: read
-  pull-requests: write
-  actions: read
 # Single secret scanner. The standards reusable runs gitleaks (+ a Rust-secrets
 # check). An inline TruffleHog job previously lived here, but the reusable
 # DELIBERATELY retired TruffleHog as redundant (gitleaks gives sufficient
@@ -23,5 +21,5 @@ permissions:
 # .github/workflows/README.adoc.
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@a44c93a5cd3d293ee3e8b488444dcdc19c4e5d49
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@db12a6ad3ef9076d5f7bdcf98d7d15cf8547555a
     secrets: inherit